Put the iPhone XR into DFU mode (not Recovery mode). Connect to your computer. A device in DFU mode will have a black screen and not respond to any buttons.

An is a minimal, temporary file system loaded entirely into the device’s RAM. It does not persist after a reboot. Apple itself uses ramdisks during the iOS restore process. When you put your iPhone XR into DFU (Device Firmware Update) mode and connect to iTunes/Finder, Apple sends a ramdisk image to the device. This image contains the essential tools to erase, partition, or install the main iOS firmware.

It is a vital tool for law enforcement and digital forensics companies like Cellebrite or Magnet Forensics. It allows them to extract evidence from a seized device, even if the suspect refuses to provide the passcode. It is often the only way to recover data from a device that has been disabled or locked for a long period.

The XR would load the ramdisk, but I hit a kernel panic right after mounting /dev/disk0s1 . Seems like A12’s SEP and NVRAM restrictions block full userspace access. However, I could run limited commands via a minimal launchd replacement – enough to read /dev/disk0s1s1 metadata.

: Gaining SSH access to the device's filesystem to acquire data without a standard passcode.

Successfully booting iPhone XR from a custom ramdisk – some notes