Frequently Asked Question
This section is designed to help run examiners through the process of imaging an Intel Mac that was made after 2018 and does include a T2-encryption chipset from the desktop with RECON ITR.
- Boot the Mac to the desktop.
- Log into the admin account.
- Plugin your RECON ITR SSD drive.
- Open the
System Settings > Privacy & Security > Full Disk Access.
- Click the lock icon and authenticate with Admin Password
- Click the '+' Icon and navigate to the RECON_ITR.app to add Full Disk permissions to the application.
- Click the lock icon again to prevent additional changes.
- Launch your RECON ITR application.
- Select the RECON IMAGER button and enter the administrator password.
- Select Disk1 as your source (If Disk1 returns errors due to the OS version, select the slice of Disk1 that displays Macintosh HD - Data)
- Enter your image name and case details and press "Start".
- Process in RECON LAB to preserve and parse the image properly.