RECON LAB runs on a Mac to allow recovery of data missed by other forensic tools.
Minimum recommended system requirements is a Macintosh with an i7 quad-core processor and 16GBs of RAM.
- Three Stage Processing – Fully Automated, Semi-Automated and Manual analysis
- Automated Processing of Hundreds of Apps – Windows, macOS and iOS Artifacts
- See Everything – Recover and analyze Apple Extended Metadata missed by other Forensic Tools
- Save Time – Advanced Filters and Pre-Process settings let you begin your case faster.
- Advanced Sort and Filter Options – Sort and Filter by Automated Results, Metadata and Apple Extended Metadata
- Advanced Reporting with Integrated Built-in Editor
- RAM Analysis for Windows and Mac
- MAC FORENSIC IMAGING AND A WHOLE LOT MORE.
MAC FORENSIC IMAGING AND A WHOLE LOT MORE.
• APFS fully supported
• Image all Intel® Based Macs, including the MacBook Pro with Touch Bar
• Create decrypted FileVault images
• Rolling updates to support all new Macs
• Image Mac RAM without an admin password
• No need for hardware write-blockers
• Fusion Drive Support
• Apple Core Storage Support
RECON TRIAGE is now on an Samsung T5 250GB SSD USB 3.1 external micro-drive for fast data transfer using it live in the field!
The 250 GB Samsung T5 can be used to save output and reports from RECON TRIAGE.
RECON TRIAGE creates advanced output and can produce thousands of reports. Simple configuration and fast results. Engineered by SUMURI, a world leader in Macintosh and iOS forensics.
RECON TRIAGE is designed to triage Macs in minutes, not days or weeks.
RECON TRIAGE is a single distribution that works in the field on live running Mac computers.
RECON TRIAGE can collect information from live running systems or write-protected hard drives.
- Pre-configured to find evidentiary artifacts quickly on macOS filesystems (10.7 and above).
- Rapid release schedule for updates and new module development.
- Reporting formats – PDF, HTML, CSV and XML
- Advanced Timeline Analysis.
- Track and view a suspect’s location.
- Recover user and system passwords.
- Identify the origin of files.
- Automatic chat timeline construction for iMessages and Skype.
- Ability to customize and save templates.
- Advanced and in-module File Exporter.
- Custom Plugin development available.
- Identify and export Virtual Machines.
- Image RAM
- Volatile Data collection.
- And we’re just getting started!
* Samsung 250 GB T5 USB drive has a 1 Year Warranty. Technical Support is included as long as the annual renewal is active.