Logical Imaging and Automatic Artifact Extraction
All features of RECON IMAGER with added support for Logical Imaging and Automatic macOS Artifact Extraction!
- Ability to select individual folders or files
- Automatic macOS artifact extraction which can be manually processed or automatically processed in RECON LAB
• APFS fully supported• APFS fully supported
• Image all Intel® Based Macs, including the MacBook Pro with Touch Bar
• Create decrypted FileVault images
• Rolling updates to support all new Macs
• Image Mac RAM without an admin password
• No need for hardware write-blockers
• Fusion Drive Support
• Apple Core Storage Support
New with Version 4!
SUMURI, with Version 4 of RECON IMAGER, has developed a solution to image local Time Machine snapshots of Macs with T2 Chipsets using native Mac technologies. Additionally, RECON IMAGER (V4) can be used to capture local Time Machine snapshots when the password is known and Secure Boot can be turned off and also when the password is not known and the Mac with the T2 Chipset is imaged via Target Disk Mode.
SUMURI’s RECON IMAGER (V4) is able to acquire all of the data to include all the files, the Apple Extended Metadata, and local Time Machine Snapshots. RECON IMAGER (V4) does not need to use hacks or reversed engineered solutions and can still acquire all the data in a logical way. Acquiring the data logically while getting all the data saves space on an examiner’s collection drives.
Additionally, RECON IMAGER (V4) is able to locate and present the snapshots to the examiner in seconds. The examiner then has the ability to choose individual snapshots (specific to a date and time) or all of the snapshots to image.