Frequently Asked Question
This section is designed to help run examiners through the process of imaging an Apple Silicon Mac from the desktop with RECON ITR.
- Boot the Apple Silicon Mac and log into an Administrator Account.
- Plugin your RECON ITR SSD.
- Open the System Settings application and navigate to
System Settings > Privacy & Security > Full Disk Access.
- Click the lock icon and authenticate with Admin Password.
- Click the '
+' Icon and navigate to the
RECON_ITR.appto add Full Disk Access permissions to the application.
- Click the lock icon again to prevent additional changes.
- Launch the RECON ITR application and click the "RECON IMAGER" icon in the RECON ITR splash screen menu.
- Select the disk you want to image. Should be one of the partitions of Disk3, labeled
Macintosh HD - Data.
- Select your Image Type:
- Sparseimage: It is best used when ingesting the image into a Mac-native analysis tool like RECON LAB since it is the preferred format for preserving timestamps, metadata, and data.
- DMG: More versatile format, ingestible by both Mac-native tools and certain Windows tools.
- Folder: Best used with Windows-only analysis tools. It is not preferable, but it is an option if you are limited in your analysis tools.
- Select your HFS+ or APFS formatted destination drive.
- Fill out your case information.
- Click Start to start imaging.