Frequently Asked Question

How do I image a Non-T2 Intel Mac?
Last Updated 6 months ago

This section is designed to help run examiners through the process of imaging an Intel Mac that was made before 2018 and does not include a T2-encryption chipset.

  1. Plugin the RECON ITR Bootable Imager
  2. Hold the Option button during startup until the options to use the RECON IMAGER boot partitions appear.
  3. Select the corresponding mode of RECON IMAGER. (Section 3 of the RECON IMAGER Manual:
  4. Once RECON IMAGER loads, click on the DISK IMAGER icon at the top of the screen.
  5. Click the dropdown menu labeled "Source" and select the disk you wish to image:
    1. Non-Fusion Drive Macs, you should choose Disk0 to obtain a full physical image.
    2. Fusion Drive Macs, you'll need to choose Disk0 for the first image, then select Disk1 for the second image.
  6. Select your preferred imaging format:
    1. DMG is preferred, best for preserving Apple Metadata, Extended Attributes, and timestamps.
  7. Select the HFS+ formatted destination drive that you wish to save the image on.
  8. Enter your image name and case details.
  9. Click the "Start" button to begin imaging.
  10. Process in RECON LAB to preserve and parse the image properly.

Please Wait!

Please wait... it will take a second!