Frequently Asked Question
This section is designed to help run examiners through the process of imaging an Intel Mac that was made before 2018 and does not include a T2 chipset.
Plugin the RECON ITR Bootable Imager
Hold the OPTION and POWER buttons together until the options to use the RECON IMAGER boot up options appear
Select the corresponding mode of RECON IMAGER. (Section 3 of the RECON IMAGER Manual: https://sumuri.com/recon-imager-manual/)
Once the IMAGER application loads, click on the DISK IMAGER icon at the top of the screen
- Click the dropdown menu labeled “Source” and select the disk you wish to image
Non-Fusion Drive Macs, you should choose Disk0 to obtain a full physical image
Fusion Drive Macs, you’ll need to choose Disk0 for the first image, then select Disk1 for the second image.
- Select your preferred imaging format
DMG is preferred, best for preserving Apple Metadata, Extended Attributes, and timestamps.
Select the HFS+ formatted destination drive that you wish to save the image on
Enter your image name and case details
Click the “Start” button to begin imaging
Process in RECON LAB to preserve and parse the image properly