Mac forensic imaging—simplified

RECON IMAGER is the leading Mac imaging solution. Two native macOS boot options allows support for all Intel® based Macs.

RECON IMAGER makes imaging APFS, Apple FileVault, Fusion and Cores Storage volumes simple!


Mac forensic imaging and a whole lot more.

  • APFS fully supported
    Image all Intel® Based Macs, including the MacBook Pro with Touch Bar.
  • Create decrypted FileVault images.
  • Rolling updates to support all new Macs.
  • Image Mac RAM without an admin password.
  • No need for hardware write-blockers.
  • Fusion Drive Support.
  • Apple Core Storage Support.

New with Version 4!

SUMURI, with Version 4 of RECON IMAGER, has developed a solution to image local Time Machine snapshots of Macs with T2 Chipsets using native Mac technologies.  Additionally, RECON IMAGER (V4) can be used to capture local Time Machine snapshots when the password is known and Secure Boot can be turned off and also when the password is not known and the Mac with the T2 Chipset is imaged via Target Disk Mode.

SUMURI’s RECON IMAGER (V4) is able to acquire all of the data to include all the files, the Apple Extended Metadata, and local Time Machine Snapshots.  RECON IMAGER (V4) does not need to use hacks or reversed engineered solutions and can still acquire all the data in a logical way. Acquiring the data logically while getting all the data saves space on an examiner’s collection drives.

Additionally, RECON IMAGER (V4) is able to locate and present the snapshots to the examiner in seconds.  The examiner then has the ability to choose individual snapshots (specific to a date and time) or all of the snapshots to image.

RECON IMAGER version 4 is scheduled to be released on March 21, 2019, Thursday.