RECON – Mac Triage, Imaging, Full Forensic Suite and Mac Mini Bundle



This ultimate bundle gives you everything that you need, including a Mac, to image, triage and process a Mac and more! You get all three of our RECON forensic tools and a 3.2GHz 6‑core 8th‑generation Intel Core i7 16GB Mac Mini all in one package deal.

*This bundle is only available for orders shipping within US.


  • RECON LAB runs on a Mac to allow recovery of data missed by other forensic tools.

Minimum recommended system requirements is a Macintosh with an i7 quad-core processor and 16GBs of RAM.

  • Three Stage Processing – Fully Automated, Semi-Automated and Manual analysis.
  • Automated Processing of Hundreds of Apps – Windows, macOS and iOS Artifacts.
  • See Everything – Recover and analyze Apple Extended Metadata missed by other Forensic Tools.
  • Save Time – Advanced Filters and Pre-Process settings let you begin your case faster.
  • Advanced Sort and Filter Options – Sort and Filter by Automated Results, Metadata and Apple Extended Metadata.
  • Advanced Reporting with Integrated Built-in Editor.
  • RAM Analysis for Windows and Mac.


  • APFS fully supported
    Image all Intel® Based Macs, including the MacBook Pro with Touch Bar.
  • Create decrypted FileVault images.
  • Rolling updates to support all new Macs.
  • Image Mac RAM without an admin password.
  • No need for hardware write-blockers.
  • Fusion Drive Support.
  • Apple Core Storage Support.

RECON TRIAGE is now on 500GB Samsung T5 SSD with speed up to 540 MB/s USB 3.1 Gen 2 external micro-drive for fast data transfer using it live in the field!

The 500GB Samsung T5 SSD with speed up to 540 MB/s USB 3.1 Gen 2 can be used to save output and reports from RECON TRIAGE.

RECON TRIAGE creates advanced output and can produce thousands of reports. Simple configuration and fast results. Engineered by SUMURI, a world leader in Macintosh and iOS forensics.

RECON TRIAGE is designed to triage Macs in minutes, not days or weeks.

RECON TRIAGE is a single distribution that works in the field on live running Mac computers.

RECON TRIAGE can collect information from live running systems or write-protected hard drives.

  • Pre-configured to find evidentiary artifacts quickly on macOS filesystems (10.7 and above).
  • Rapid release schedule for updates and new module development.
  • Reporting formats – PDF, HTML, CSV and XML.
  • Advanced Timeline Analysis.
  • Track and view a suspect’s location.
  • Recover user and system passwords.
  • Identify the origin of files.
  • Automatic chat timeline construction for iMessages and Skype.
  • Ability to customize and save templates.
  • Advanced and in-module File Exporter.
  • Custom Plugin development available.
  • Identify and export Virtual Machines.
  • Image RAM
  • Volatile Data collection.
  • And we’re just getting started!

* 500GB Samsung T5 USB drive has a 1 Year Warranty. Technical Support is included as long as the annual renewal is active.