Understanding the Internals of iOS Devices - Practical Mobile Forensics - page 60

/dev/disk0s1s2 on /private/var (hfs, local, journaled,
noatime, protect)
To view the raw disk images on the iPhone, connect a jailbroken iPhone to a workstation
over SSH, and run the ls -lh rdisk* command. rdisk0 is the entire file system
and rdisk0s1 is the firmware partition. rdisk0s1s1 is the root file system and rd-
isk0s1s2 is the user file system, as shown in the following command lines:
iPhone4:/dev root# ls -lh rdisk*
crw-r----- 1 root operator 14, 0 Oct 10 04:28 rdisk0
crw-r----- 1 root operator 14, 1 Oct 10 04:28 rdisk0s1
crw-r----- 1 root operator 14, 2 Oct 10 04:28 rdisk0s1s1
crw-r----- 1 root operator 14, 3 Oct 10 04:28 rdisk0s1s2