The leading macOS Imaging, Triage and Reporting solution
Supports live imaging of Apple Silicon Macs!
RECON ITR brings live macOS triage and bootable/live imaging options to a single drive; an indispensable tool for anyone who needs to image and capture data from all modern macOS devices.
Both Bootable and Live Imaging Solutions
Take the guesswork out of what tool to use for imaging Macs. RECON ITR includes both bootable and live imaging solutions to image all modern Intel and Apple Silicon-based Macs.
RECON ITR combines the functions of bootable and live imaging through its Imager tool into an integrated solution that automatically identifies, displays, and can image FileVault, APFS, and Core Storage volumes and disks at a cost well below any other tool.
RECON ITR images Intel-based Macs, with or without the T2 Security Chip, and the newest Macs with Apple’s Silicon (M1/M2/M3/M4) Chip processor. No more waiting for other solutions to do what RECON ITR can do today. Pairing RECON ITR with PALADIN PRO gives you three avenues to image your target device, and the capability to work on multiple cases, all for the price of one tool.
Forensic images produced by RECON ITR can be processed easily in RECON LAB – SUMURI’s Flagship Full Forensic Analysis Suite, which automates analysis of image files of macOS, iOS, Windows, and more!
The Only macOS Triage Solution to Provide Answers in Seconds
RECON ITR has hundreds of plugins to parse thousands of artifacts from macOS, locally stored iOS backups, and Boot Camp built-in. RECON ITR performs triage within the same tool you use for imaging to give you answers in seconds of live running Macs, or Macs connected in Target Disk Mode (Shared Disk Mode) in a write-blocked environment.
Triage Reporting Options at Your Fingertips To Get the Answers You Need Quickly
RECON ITR’s automated plugins find important artifacts, parse the data, and present it to you in a unified format that can be refined to produce the report you need.
macOS Volatile Data Collection
RECON ITR includes automated plugins for Volatile Data collection. Find important artifacts related to malware, hacking, and user logins from the Live environment with RECON ITR’s traige tools.
Logical Imaging with Automatic Artifact Collection
RECON ITR ’s Imager tool allows for Selective Logical Imaging of macOS Data drives. Quickly select the data to be imaged down to the file.
RECON ITR is the only tool capable of preserving original timestamps during logical imaging of Mac data.
RECON ITR also has the ability to collect macOS artifacts from any user account through automated plugins, which can be processed in RECON LAB!
Built-in Software Write-Blocking
RECON ITR ’s bootable imaging modes and its live triage disk manager come with built-in write blocking capabilities through disk arbitration. No need to purchase additional solutions to image and triage in a forensically sound manner.
Local iOS Backup Triage and Processing
Forensics Simplified
Every new purchase of RECON ITR includes a free PALADIN PRO to cover all imaging and triaging needs across macOS, Windows, and Linux.
PALADIN has become the World’s #1 Forensic Suite used by thousands of digital forensic examiners from Law Enforcement, Military, Federal, State, and Corporate agencies.
The PALADIN Toolbox
The PALADIN Toolbox combines the power of several court-tested Open Source forensic tools into a simple interface that can be used by anyone. With the PALADIN Toolbox, a user can easily and quickly Triage, Search, Image, and more!
DEMO REQUEST
RECON ITR demos are active for 15 days.
RECON ITR demos only include the Live RECON ITR application, not the Bootable RECON IMAGER modes.
*All fields required to process this request