Frequently Asked Question

How do I image a T2 Mac Bootable? (Preferred Approach)
Last Updated 5 months ago

This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2-encryption chipset using the bootable method.

  1. Boot the Mac into the native Recovery Mode by holding Command + R during startup.
  2. Authenticate with Admin credentials.
  3. Navigate to Utilities > Startup Security.
  4. Switch the security to No Security and enable booting from external media.
  5. Plugin your RECON IMAGER Drive.
  6. Restart and hold the option key to enter the boot menu.
  7. Boot to RECON IMAGER Mode-D.
    1. If FileVault is enabled, please follow steps 8 and 9; otherwise, continue to step 10.
  8. Locate the FileVault encrypted volume (User's Data Partition) in Disk Manager and select Decrypt.
  9. Enter the Admin Password or Recovery Key to decrypt.
  10. Switch to the Disk Imager tab.
  11. Select your Source Drive:
    1. If FileVault Encrypted, select the Decrypted User Data Partition
    2. If Not FileVault Encrypted, select the synthesized disk (Disk1 for Non-Fusion Drive, Disk2 if Fusion Drive).
  12. Select your desired image type.
  13. Select your HFS+ or APFS formatted destination drive.
  14. Enter your image name and case details.
  15. Select "Start" to begin the acquisition.
  16. Process in RECON LAB to preserve and parse the image properly.

Please Wait!

Please wait... it will take a second!