RECON ITR Version 26.0.0
RECON ITR v26.0.0 is a complete rebuild of the application from the ground up.
Every line of code has been rewritten, replacing the previous foundation with a fully native macOS architecture. This is not an incremental update. The core application, imaging utility, and all supporting tools have been rebuilt to take full advantage of modern macOS, current Apple hardware, and the performance characteristics of Apple Silicon.
The feature set, workflow, and forensic capabilities examiners relied on in previous versions are preserved and expanded. The foundation they run on is entirely new.What's in v26.0.0
- macOS Triage
- RECON ITR's macOS triage engine includes over 100 artifact scripts that collect user and system data for analysis and reporting. Scripts target the full range of macOS forensic artifacts: application data, system preferences, user activity, and more, producing structured output ready for examination and reporting.
- iOS Backup and Triage (iLEAP)
- iOS backup acquisition and triage are handled through integrated iLEAP scripts. RECON ITR supports encrypted and unencrypted iOS backup acquisition, parsing, and artifact collection for iOS devices.
- RECON Imager
- RECON Imager is the imaging utility integrated into RECON ITR, available as both a desktop application and a bootable environment. v26.0.0 delivers a completely rewritten imager with a modernized interface across all imaging modes.
- Disk Management
- Mount drives in read-write or read-only mode
- Unmount drives and manage connected storage
- Format drives for use as imaging destinations
- Decrypt FileVault-protected volumes for acquisition
- Disk Imager
- Full disk imaging
- APFS Container imaging
- Individual volume imaging
- Logical Imager
- File search and selection for targeted acquisition
- Artifact plugins for collecting specific system and user data files
- Configurable selection of macOS system and application data
- File Timeline
- The File Timeline tool scans a target directory and all subdirectories, presenting a chronological view of file metadata dates across the file system. Examiners can review creation and modification timelines to identify activity patterns and understand how data moved through a system over time.
- File Search
- Targeted search across connected drives or directories. Supports keyword search, filename search, and file signature search for identifying files of interest without a full acquisition.
- Log Collector
- Collects macOS Unified Logs from a target system and outputs them as a plain text file or native logarchive for review and analysis.
Availability
RECON ITR v26.0.0 is available now for all current license holders. Customers whose licenses have lapsed should contact the SUMURI sales team to confirm renewal status before upgrading.
Need help or want to chat about these new features? We’re happy to talk to you!
Email: hello@sumuri.com Phone: +1 302.570.0015