Frequently Asked Question

How do I image an Apple Silicon Mac through Sharing Mode?
Last Updated 11 months ago

This section is designed to help run examiners through the process of imaging an Apple Silicon Mac using Sharing Mode.

Apple Silicon Machine

  1. Turn off the machine

  2. Hold the power button to boot into macOS recovery

  3. Select Options

  4. Select Utilities>Share Disk

  5. Select the disk you want to image

  6. Click start sharing

Acquisition Machine running  RECON ITR

  1. Launch RECON ITR

  2. Open the Disk Manager

  3. Turn off Disk Arbitration (wait 60 seconds)

  4. Connect the M1 machine with a Thunderbolt cable (wait 60 seconds)

  5. Open Finder and navigate to Network connections in the sidebar

  6. Click the target machine in your listed Network connections

  7. Click the “Connect as…” button in the top right of the Finder window

  8. Select “Registered User” and enter the target machine’s Admin Username and Password.

  9. Launch the imager app

  10. Image the device listed as an SMB connection as a sparseimage

Please Wait!

Please wait... it will take a second!