Booting Is Back Baby!

Booting is Back Baby!

Those of us who have been working with Macs for a while know all about the twists and turns that come with new Apple releases. With the T2 Security Chipset, we all thought that boot imaging was dead and gone, only to have it come back after a few macOS updates. You’ll never guess what happened with the Apple Silicon Chips…

Imaging Apple devices got so complicated we had to make a whole map just to keep it straight.

RECON ITR has an exciting new update available now. Some recent changes to macOS have allowed us to add a new boot option that is specially designed for Apple Silicon Macs. This new feature allows examiners to easily image the latest Macs with M1, M1 Pro and, M1 Max processors. No more struggling with sharing mode or being forced to image live from the user’s desktop. The additional boot option will be added to the user’s RECON ITR SSD and be easier and more forensically sound than previous imaging approaches. If you want to see for yourself our YouTube page has videos all about how to boot your Apple Silicon Macs.

When they first came out Apple Silicon Macs had very strict boot security. Apple implemented signed system volumes that required any volume to be authenticated. This made it impossible to create an external boot imager. Not only was it not logistically viable, but the signed volume also would not boot if the operating system was altered in any way.
​​
Then comes macOS 12! In October Apple released a new version of macOS that added a whole host of new features. They also changed how Apple Silicon Macs handle boot security.

After this change to macOS, a whole new approach was needed for imaging. Since we have always worked on a Mac-native platform we could easily adapt and take advantage of the changes. Working with the operating system instead of fighting against it makes quickly reacting to changes like this a breeze.

Stop by our updates page to get the latest version of RECON ITR and take a new approach to imaging Apple Silicon Macs!