Frequently Asked Question

This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2 chipset through Target Disk Mode.

**Disclaimer: You will need to have another Mac with compatible hardware (around the same year of release) running equal to or newer version of macOS. For best results, you will also need an Apple proprietary thunderbolt cable to connect them.**

1. Plug your RECON ITR Bootable Imager into your Examiner Mac and boot to RECON IMAGER Mode-C

2. Power on the Target Mac and hold the T key

3. Connect both Macs using a Thunderbolt Cable

4. In RECON IMAGER’s Disk Manager, select the Refresh button

   1. If FileVault is enabled, please follow steps 5 and 6; otherwise, continue to step 7

5. Locate the FileVault encrypted partition select Decrypt

6. Enter the Admin-Password or Recovery Key when prompted

7. Navigate to RECON IMAGER’s Disk Imager at the top

8. Click the refresh button

9. Select your Source Drive

   1. If FileVault Encrypted, select the Decrypted User Data Partition

   2. If not FileVault Encrypted, select the synthesized disk (Disk1 for Non-Fusion Drive, Disk2 if Fusion Drive)

10. Select your desired image type

11. Select your HFS+ formatted destination drive

12. Enter your image name and case details

13. Select Start to begin the acquisition

    1. If prompted, enter the admin credentials

14. Process in RECON LAB to preserve and parse the image properly