Frequently Asked Question

This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2 chipset from the desktop.

1. Boot the Mac to the desktop.

2. Log into the admin account.

3. Plugin your RECON ITR SSD drive.

4. Open the System Preferences > Privacy and Security > Privacy > Full Disk Access

5. Click the lock icon and authenticate with Admin Password

6. Click the ‘+’ Icon and navigate to the RECON_ITR.app to add Full Disk permissions to the application.

7. Click the lock icon again to prevent additional changes.

8. Launch your RECON ITR application.

9. Select the RECON IMAGER button and enter the administrator password.

10. Select Disk1 as your source (If Disk1 returns errors due to the OS version, select the slice of Disk1 that displays Macintosh HD Data)

11. Enter your image name and case details and press Start.

12. Process in RECON LAB to preserve and parse the image properly.