RECON ITR – Two macOS Imagers in One Solution

I’ll be honest.  We’ve changed our product line up a lot and it can be a little confusing.

If you have been paying attention, Apple has also changed a lot as well.  That last “a lot” is a little bit of an understatement.  Starting with macOS 10.11 Apple began strengthening their security with sandboxed applications, System Integrity Protection, a new file system (APFS), adding additional hardware security (T2 Security Chipset) and segregated virtualized volumes for user and system data inside of a synthesized disk that is derived from a logical volume!

Oh wait, you think that Apple is done.  Coming soon, let’s now use Apple’s proprietary ARM processors instead of Intel chipsets which have been used in Macs circa 2006.

As Apple has changed quite dramatically, we had to do the same to provide the most current and up to date solutions for macOS Imaging, Triage, and Reporting.

So why the need for two imagers in RECON ITR? Currently, there is no reason but a few months ago there was a need and… there will be again.  Let me explain.

Ever-Increasing Security in Macs

As described above, with each release Apple likes to pile on more security features.  In the past, this has limited or killed the use of bootable imagers until workarounds can be found.  Because we anticipated this being a problem we decided to add RECON IMAGER into RECON TRIAGE.  This became RECON ITR. Because we are such nice people we decided to add all the features of RECON IMAGER PRO which includes automatic artifact collection, imaging to a network storage device, and selective logical imaging.

Having an imager solution that runs from your Desktop allows you to image Macs not supported by bootable imagers.  You can connect the unsupported Mac in Target Disk Mode for imaging. It’s our way of trying to future-proof Mac imaging.

In case you are wondering, we don’t charge you extra for the write-blocking.  Software write-blocking is included in ITR for free!

Two Imagers for the Price of One

Instead of charging you more for extra features, we decided to give more and charge less.

Why?  Why not? Are you not tired of everyone raising their prices?  Could you use the extra money for something else?  That’s why.  We trust that you will find a good use for the money that you have saved.

Additionally, with RECON ITR you now have two imagers instead of one.  RECON ITR comes with a Samsung T7 Touch 500 GB biometrically secured external drive for live imaging or imaging a Mac in TDM and it also comes with a bootable macOS imager on a Samsung Duo 32 GB USB.  You can boot a Mac and image with the bootable imager at the same time you image another Mac using the imager built-in to the live version of RECON ITR.  Get twice as much done for way less than other solutions.

Real Triage

Let’s discuss the “way less” part a little bit more.

RECON ITR includes “real” triage.  What do I mean by this?

RECON ITR allows for instant triage of thousands of Mac, iOS, and Windows Boot Camp artifacts plus imaging all in one solution. You can get answers in minutes from a live running system or safely triage another Mac connected in Target Disk Mode.  With other solutions, you have to use an imager to first collect the data then buy another tool in order to complete the triage.  That solution takes time and costs over $5000 USD compared to RECON ITR at $1199 USD for two imagers, volatile data collection, and instant triage.

For more information feel free to contact us anytime by chat, phone, or email or request a demo of RECON ITR here.