Frequently Asked Question

How do I image a Apple Silicon Mac Live?
Last Updated 9 months ago

This section is designed to help run examiners through the process of imaging an Apple Silicon Mac from the desktop.

  1. Boot the Apple Silicon Mac and log into an Administrator Account

  2. Plugin your RECON ITR SSD

  3. Open the System Preferences > Privacy and Security > Privacy > Full Disk Access

  4. Click the lock icon and authenticate with Admin Password

  5. Click the ‘+’ Icon and navigate to the RECON_ITR.app to add Full Disk permissions to the application.

  6. Click the lock icon again to prevent additional changes.

  7. Launch the RECON ITR application and click “RECON IMAGER”

  8. Select the disk you want to image. Should be one of the partitions of Disk3, labeled Macintosh HD - Data

  9. Select your Image Type
    1. Sparseimage: It is best used when ingesting the image into a Mac-native analysis tool like RECON LAB since it is the preferred format for preserving timestamps, metadata, and data.

    2. DMG: More versatile format, ingestible by both Mac-native tools and certain Windows tools.

    3. Folder: Best used with Windows-only analysis tools. It is not preferable, but it is an option if you are limited in your analysis tools.

  10. Select your HFS+ formatted destination drive

  11. Fill out your case information

  12. Click Start to start imaging

Please Wait!

Please wait... it will take a second!