Click "Data Recovery" -> "Start Scan." The toolkit will load a custom ramdisk (a stripped-down iOS environment) into the iPhone’s RAM. This takes 2-3 minutes. Once booted, you will see a directory tree of the device’s file system, including /private/var/mobile/Media/DCIM . Even deleted photos appear grayed out. Click "Deep Recovery" to analyze free blocks.
The toolkit loads a custom forensic ramdisk. This temporary OS runs entirely in RAM and does not modify the device’s actual iOS installation. gecko iphone toolkit
It could reset the counter that prevented further entries, allowing for manual passcode attempts. Click "Data Recovery" -> "Start Scan