Frequently Asked Question
This section is designed to help run examiners through the process of imaging an Intel Mac that was made before 2018 and does not include a T2-encryption chipset.
- Plugin the RECON ITR Bootable Imager
- Hold the
Optionbutton during startup until the options to use the RECON IMAGER boot partitions appear.
- Select the corresponding mode of RECON IMAGER. (Section 3 of the RECON IMAGER Manual: https://sumuri.com/recon-imager-manual/)
- Once RECON IMAGER loads, click on the DISK IMAGER icon at the top of the screen.
- Click the dropdown menu labeled "Source" and select the disk you wish to image:
- Non-Fusion Drive Macs, you should choose Disk0 to obtain a full physical image.
- Fusion Drive Macs, you'll need to choose Disk0 for the first image, then select Disk1 for the second image.
- Select your preferred imaging format:
- DMG is preferred, best for preserving Apple Metadata, Extended Attributes, and timestamps.
- Select the HFS+ formatted destination drive that you wish to save the image on.
- Enter your image name and case details.
- Click the "Start" button to begin imaging.
- Process in RECON LAB to preserve and parse the image properly.