Frequently Asked Question

How do I image a T2 Mac through Target Disk Mode?
Last Updated 5 months ago

This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2-encryption chipset through Target Disk Mode using RECON ITR.

** Disclaimer: You will need to have another Mac with compatible hardware (around the same year of release) running an equal-to or newer version of MacOS. For best results, you will also need an Apple proprietary thunderbolt cable to connect them.**

  1. Plug your RECON ITR SSD into your Examiner Mac and boot to RECON IMAGER Mode-D.
  2. Power on the Target Mac and hold the T key.
  3. Connect both Macs using a Thunderbolt Cable.
  4. In RECON IMAGER's Disk Manager, select the Refresh button.
    1. If FileVault is enabled, please follow steps 5 and 6; otherwise, continue to step 7.
  5. Locate the FileVault encrypted partition select Decrypt.
  6. Enter the Admin-Password or Recovery Key when prompted.
  7. Navigate to RECON IMAGER's Disk Imager at the top.
  8. Click the refresh button.
  9. Select your Source Drive:
    1. If FileVault Encrypted, select the decrypted user Data partition.
    2. If Not FileVault Encrypted, select the synthesized disk (Disk1 for Non-Fusion Drive, Disk2 if Fusion Drive).
  10. Select your desired image type.
  11. Select your HFS+ formatted destination drive.
  12. Enter your image name and case details.
  13. Select "Start" to begin the acquisition.
    1. If prompted, enter the admin credentials.
  14. Process in RECON LAB to preserve and parse the image properly.

Please Wait!

Please wait... it will take a second!