sumuri

RECON ITR Version 7.0.0

We’re pleased to announce major imaging updates to the RECON ITR! This update brings a variety of enhancements, improved usability, and important bug fixes to streamline your forensic imaging workflows.

Smarter Imaging and Improved Stability

  • Improved Logical Imaging Experience
  • RECON Imager now provides clearer controls and feedback for file and artifact selection, destination management, and system preference collection.
  • New User Interface Enhancements
  • Tooltips, warnings, and color-coded indicators help examiners easily identify supported sources, disk states, and hashing options.
  • Better macOS Artifact Support
  • Updates across plugins and parsing routines improve accuracy on macOS 15 and 26 systems (Sonoma and Tahoe).
  • iOS Backup Improvements
  • Added support for encrypted iOS backups and parsing of iOS 18 data.
  • General Performance & Stability
  • Numerous bug fixes and refinements ensure smoother report generation, artifact collection, and imaging reliability.

Fixes & Enhancements

  • General
  • Fixed an issue where PDF reports did not generate correctly.
  • Fixed RECON ITR logic to properly check the root of LIVE for Image.
  • Added option to update licenses after launch.
  • Removed unnecessary full-disk-access reminder when already granted.
  • Fixed parsing for the WhereFrom plugin on macOS 15.4+.
  • Fixed issue with Recent Items plugin not running as expected.
  • iOS Backup
  • Added support for encrypted iOS backups.
  • Fixed parsing for iOS 18 backup format.
  • RECON Imager
  • Fixed crash when logged in as a Standard User.
  • Fixed issue where spaces in a password prevented RECON Imager from launching.

RECON ITR’s Imager 7.0.0 (Desktop & Bootable)

  • New Features
  • Added asterisks to required fields for clearer workflows.
  • Added ability to select external drives in Logical Imager.
  • Added Remove and Remove All buttons to quickly manage file selections.
  • Added Export System / Preference Files toggle to control inclusion of macOS settings and preference data.
  • Added confirmation prompts when removing files or using Remove All.
  • Added Added Artifacts table in Imaging Bucket View for quick visibility.
  • Added warning requiring user selection when running user-specific plugins.
  • Added tooltips for various hashing options.
  • Improvements
  • Logical Imager now greys out unsupported or undetected artifacts.
  • Disk Imager UI hides options that don’t apply to selected formats or devices.
  • Updated file paths for numerous macOS artifact plugins (Airport, Messages, Photos, Finder, Screen Time, etc.).
  • Moved destination drive selection to the source selection screen for a more intuitive setup.
  • System and preference files are no longer imaged by default; toggle available when needed.
  • Adjusted case buffer size during physical imaging for improved performance.
  • Fixes
  • Fixed issue allowing source partitions to be selected as destinations.
  • Fixed logical format display issues with external HFS+ partitions.
  • Fixed missing file records when large file sets were added to the Imaging Bucket in Recovery mode.
  • Fixed “Show All” display inconsistency after Disk Imager refresh.
  • Corrected success/caution messaging during disk formatting.
  • Fixed APFS partition formatting failures.
  • Fixed inaccurate file-size calculations in Logical Imager.
  • Removals
  • Deprecated plugins removed: Disk Utility, Disk Utility Saved List, USB Attached, and Wi-Fi Locations.

Availability

RECON ITR v7.0.0 is included in the latest update package for all current license holders. The update brings unified improvements across both the main triage application and its integrated RECON Imager utility for macOS Tahoe and earlier systems.

Need help or want to chat about these new features? We’re happy to talk to you!

Email: hello@sumuri.com Phone: +1 302.570.0015

Scroll to Top