3uTools is a favorite among repair shops. Its "Flash & JB" section includes a deep file manager that works when the device is in DFU mode. You can browse /private/var/mobile/Media and even delete system files.
Technically, the architecture of DFU File Manager is a study in controlled defiance. Standard file managers operate through a device's high-level APIs (Application Programming Interfaces), which require the OS to be running and authenticated. DFU File Manager, conversely, sends custom low-level USB control transfers and uses proprietary protocols (often resembling iBoot or Recovery OS commands) to read the raw NAND memory blocks. It decodes the HFS+ or APFS (Apple File System) containers without the operating system’s permission, reconstructing the directory tree from the partition map. This process is slow and meticulous, akin to reading a library by pulling each book off the shelf individually rather than using the card catalog. However, this brute-force approach is what makes it so powerful against damaged logical structures. dfu file manager