Let's use iOS Forensic Toolkit to extract the content of an iPhone. However, first let's take a look at what actually happens at the time the tool performs physical acquisition.
The first step of the acquisition process involves putting the device into a so-called DFU mode (Debug and Firmware Upgrade) with a combination of Home and Power buttons. Elcomsoft iOS Forensic Toolkit displays tips on how to put the device to this mode.
Once the device is in its DFU mode, we can use its F function, emulating a firmware upgrade. However, instead of Apple's original firmware, the Toolkit attempts to load an altered one. The device will verify the new firmware by checking its digital signature via bootrom functions (these are read-only and can't be switched off). Now, if we're acquiring an iPhone 4 or earlier, the Toolkit can use a bootrom exploit that allows skipping the check and sideloading the altered firmware...