Frequently Asked Question

This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2 chipset using the bootable method.

1. Boot the Mac into Recovery Mode by holding Command + R on Startup.

2. Authenticate with Admin credentials.

3. Navigate to Utilities > Startup Security.

4. Switch the security to No Security and enable booting from external media.

5. Plugin your RECON IMAGER Drive.

6. Restart and hold the option key to enter the boot menu.

7. Boot to RECON IMAGER Mode-C

   1. If FileVault is enabled, please follow steps 8 and 9; otherwise, continue to step 10

8. Locate the FileVault encrypted volume (User's Data Partition) in Disk Manager and select Decrypt.

9. Enter the Admin Password or Recovery Key to decrypt.

10. Switch to the Disk Imager tab.

11. Select your Source Drive

    1. If FileVault Encrypted, select the Decrypted User Data Partition

    2. If not FileVault Encrypted, select the synthesized disk (Disk1 for Non-Fusion Drive, Disk2 if Fusion Drive)

12. Select your desired image type

13. Select your HFS+ formatted destination drive

14. Enter your image name and case details

15. Select Start to begin the acquisition

16. Process in RECON LAB to preserve and parse the image properly.