Frequently Asked Question

This section is designed to help run examiners through the process of imaging an Intel Mac that was made before 2018 and does not include a T2 chipset.

1. Plugin the RECON ITR Bootable Imager

2. Hold the OPTION and POWER buttons together until the options to use the RECON IMAGER boot up options appear

3. Select the corresponding mode of RECON IMAGER. (Section 3 of the RECON IMAGER Manual: https://sumuri.com/recon-imager-manual/)

4. Once the IMAGER application loads, click on the DISK IMAGER icon at the top of the screen

5. Click the dropdown menu labeled “Source” and select the disk you wish to image

   1. Non-Fusion Drive Macs, you should choose Disk0 to obtain a full physical image

   2. Fusion Drive Macs, you’ll need to choose Disk0 for the first image, then select Disk1 for the second image.

6. Select your preferred imaging format

   1. DMG is preferred, best for preserving Apple Metadata, Extended Attributes, and timestamps.

7. Select the HFS+ formatted destination drive that you wish to save the image on

8. Enter your image name and case details

9. Click the “Start” button to begin imaging

10. Process in RECON LAB to preserve and parse the image properly