Frequently Asked Question
This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2 chipset using the bootable method.
Boot the Mac into Recovery Mode by holding Command + R on Startup.
Authenticate with Admin credentials.
Navigate to Utilities > Startup Security.
Switch the security to No Security and enable booting from external media.
Plugin your RECON IMAGER Drive.
Restart and hold the option key to enter the boot menu.
- Boot to RECON IMAGER Mode-C
If FileVault is enabled, please follow steps 8 and 9; otherwise, continue to step 10
Locate the FileVault encrypted volume (User's Data Partition) in Disk Manager and select Decrypt.
Enter the Admin Password or Recovery Key to decrypt.
Switch to the Disk Imager tab.
- Select your Source Drive
If FileVault Encrypted, select the Decrypted User Data Partition
If not FileVault Encrypted, select the synthesized disk (Disk1 for Non-Fusion Drive, Disk2 if Fusion Drive)
Select your desired image type
Select your HFS+ formatted destination drive
Enter your image name and case details
Select Start to begin the acquisition
Process in RECON LAB to preserve and parse the image properly.