Frequently Asked Question
This section is designed to help run examiners through the process of imaging an Apple Silicon Mac from the desktop.
Boot the Apple Silicon Mac and log into an Administrator Account
Plugin your RECON ITR SSD
Open the System Preferences > Privacy and Security > Privacy > Full Disk Access
Click the lock icon and authenticate with Admin Password
Click the ‘+’ Icon and navigate to the RECON_ITR.app to add Full Disk permissions to the application.
Click the lock icon again to prevent additional changes.
Launch the RECON ITR application and click “RECON IMAGER”
Select the disk you want to image. Should be one of the partitions of Disk3, labeled Macintosh HD - Data
- Select your Image Type
Sparseimage: It is best used when ingesting the image into a Mac-native analysis tool like RECON LAB since it is the preferred format for preserving timestamps, metadata, and data.
DMG: More versatile format, ingestible by both Mac-native tools and certain Windows tools.
Folder: Best used with Windows-only analysis tools. It is not preferable, but it is an option if you are limited in your analysis tools.
Select your HFS+ formatted destination drive
Fill out your case information
Click Start to start imaging