Mac Triage, Imaging and Full Forensic Suite Bundle



This combo is your all-in-one solutions for imaging, triage and analyzing Macs for hundreds less than any other solution.

In addition to processing Macs the included RECON LAB process Windows, Linux, Google, iOS and more!


RECON LAB runs on a Mac to allow recovery of data missed by other forensic tools.

Minimum recommended system requirements is a Macintosh with an i7 quad-core processor and 16GBs of RAM.

  • Three Stage Processing – Fully Automated, Semi-Automated and Manual analysis.
  • Automated Processing of Hundreds of Apps – Windows, macOS and iOS Artifacts.
  • See Everything – Recover and analyze Apple Extended Metadata missed by other Forensic Tools.
  • Save Time – Advanced Filters and Pre-Process settings let you begin your case faster.
  • Advanced Sort and Filter Options – Sort and Filter by Automated Results, Metadata and Apple Extended Metadata.
  • Advanced Reporting with Integrated Built-in Editor.
  • RAM Analysis for Windows and Mac.


  • APFS fully supported
    Image all Intel® Based Macs, including the MacBook Pro with Touch Bar.
  • Create decrypted FileVault images.
  • Rolling updates to support all new Macs.
  • Image Mac RAM without an admin password.
  • No need for hardware write-blockers.
  • Fusion Drive Support.
  • Apple Core Storage Support.

RECON TRIAGE is now on 500GB Samsung T5 SSD with speed up to 540 MB/s USB 3.1 Gen 2 external micro-drive for fast data transfer using it live in the field!

The 500GB Samsung T5 SSD with speed up to 540 MB/s USB 3.1 Gen 2 can be used to save output and reports from RECON TRIAGE.

RECON TRIAGE creates advanced output and can produce thousands of reports. Simple configuration and fast results. Engineered by SUMURI, a world leader in Macintosh and iOS forensics.

RECON TRIAGE is designed to triage Macs in minutes, not days or weeks.

RECON TRIAGE is a single distribution that works in the field on live running Mac computers.

RECON TRIAGE can collect information from live running systems or write-protected hard drives.

  • Pre-configured to find evidentiary artifacts quickly on macOS filesystems (10.7 and above).
  • Rapid release schedule for updates and new module development.
  • Reporting formats – PDF, HTML, CSV and XML.
  • Advanced Timeline Analysis.
  • Track and view a suspect’s location.
  • Recover user and system passwords.
  • Identify the origin of files.
  • Automatic chat timeline construction for iMessages and Skype.
  • Ability to customize and save templates.
  • Advanced and in-module File Exporter.
  • Custom Plugin development available.
  • Identify and export Virtual Machines.
  • Image RAM
  • Volatile Data collection.
  • And we’re just getting started!

* 500GB Samsung T5 SSD with speed up to 540 MB/s USB 3.1 Gen 2 USB drive has a 1 Year Warranty. Technical Support is included as long as the annual renewal is active.