Before first unlock.
Let's say you have a situation where the device is locked
and you're not sure what you're going to do.
So what we can do is we can use UFED.
You can also do this manually if you use Mattia's--
You can read his blog.
You can use the script, and it's going
to go through and walk you through how to do it on a Mac.
But here, we are in UFED.
We choose full file system checkmate.
You are then prompted to enter the device passcode.
Do not guess the passcode at this point.
If you guess incorrectly, it will disable the iPhone
and ultimately wipe it.
This is literally going out and touching the iPhone, saying,
hey is this passcode correct?
Be careful.
I also recommend you do show characters to prevent typos.
But in this situation, we don't know it.
So we're not going to guess.
We choose Cancel.
Step 3 comes up and says, do you want to run a BFU dump?
You're like, sure.
Now, a BFU you extraction is better than BFU on Android.
And I want to show you your cheat sheet.
If we go into your course Dropbox, so for585.com/h01,
and we go into cheat sheets, you are going to see this iOS 15
cheat sheet.
I want to take a look at this.
You are going to see that this is laid out with all
of these different files.
First of all, there are many tabs across the bottom.
That's important to know.
But do you see how there's a category called BFU, backup,
sysdiagnose, and then back up on iOS 15, which is different?
And that's assuming you encrypt the backup.
You are going to see that you're going
to get a lot of information about that device from a BFU.
So it is definitely worth your time to look at this.