Frequently Asked Question

How do I image a Apple Silicon Mac Live?
Last Updated 6 months ago

This section is designed to help run examiners through the process of imaging an Apple Silicon Mac from the desktop with RECON ITR.

  1. Boot the Apple Silicon Mac and log into an Administrator Account.
  2. Plugin your RECON ITR SSD.
  3. Open the System Settings application and navigate to System Settings > Privacy & Security > Full Disk Access.
  4. Click the lock icon and authenticate with Admin Password.
  5. Click the '+' Icon and navigate to the to add Full Disk Access permissions to the application.
  6. Click the lock icon again to prevent additional changes.
  7. Launch the RECON ITR application and click the "RECON IMAGER" icon in the RECON ITR splash screen menu.
  8. Select the disk you want to image. Should be one of the partitions of Disk3, labeled Macintosh HD - Data.
  9. Select your Image Type:
      Sparseimage: It is best used when ingesting the image into a Mac-native analysis tool like RECON LAB since it is the preferred format for preserving timestamps, metadata, and data.
    1. DMG: More versatile format, ingestible by both Mac-native tools and certain Windows tools.
    2. Folder: Best used with Windows-only analysis tools. It is not preferable, but it is an option if you are limited in your analysis tools.
  10. Select your HFS+ or APFS formatted destination drive.
  11. Fill out your case information.
  12. Click Start to start imaging.

Please Wait!

Please wait... it will take a second!