Frequently Asked Question

How do I image a T2 Mac Live?
Last Updated 5 months ago

This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2-encryption chipset from the desktop with RECON ITR.

  1. Boot the Mac to the desktop.
  2. Log into the admin account.
  3. Plugin your RECON ITR SSD drive.
  4. Open the System Settings > Privacy & Security > Full Disk Access.
  5. Click the lock icon and authenticate with Admin Password
  6. Click the '+' Icon and navigate to the to add Full Disk permissions to the application.
  7. Click the lock icon again to prevent additional changes.
  8. Launch your RECON ITR application.
  9. Select the RECON IMAGER button and enter the administrator password.
  10. Select Disk1 as your source (If Disk1 returns errors due to the OS version, select the slice of Disk1 that displays Macintosh HD - Data)
  11. Enter your image name and case details and press "Start".
  12. Process in RECON LAB to preserve and parse the image properly.

Please Wait!

Please wait... it will take a second!