sumuri

The leading macOS Imaging, Triage and Reporting solution

Supports live imaging of Apple Silicon Macs!

macOS Volatile Data Collection – Automatic Volatile Data collection of important artifacts related to malware, hacking and user logins.

Support for Apple Silicon, T2 Security Chips, APFS File Systems, and Local Time Machine Snapshots (APFS Snapshots).

Image all Intel Macs with the power of RECON IMAGER PRO with both bootable and live imaging options.

Support for macOS, Windows, and Linux with all the features of PALADIN PRO.

USB
Recon ITR

Both Bootable and Live Imaging Solutions

Take the guesswork out of what tool to use for imaging Macs. RECON ITR includes both Bootable and Live Imaging solutions to image all Intel-based Macs, Apple Silicon Macs, and their filesystems.

RECON ITR combines both the functions of bootable and live imaging from RECON TRIAGE and RECON IMAGER PRO into an integrated solution that automatically identifies, displays, and can image FileVault, APFS, and Core Storage volumes and disks at a cost well below any other tool.

RECON ITR images all Intel-based Macs with or without T2 Security Chips and the newest Macs with Apple’s Silicon (M1/M2/M3) Chip processor. No more waiting for other solutions to do what RECON ITR can do today.

Recon ITR includes three solutions to image and triage across macOS, Windows, and Linux. Now, including PALADIN PRO, RECON ITR gives you three chances to image and the capability to work on multiple cases all for the price of one.

The Only macOS Triage Solution to Provide Answers in Seconds

RECON ITR has hundreds of plugins to parse thousands of artifacts from macOS, iOS backups and Boot Camp built-in. RECON ITR performs analysis and triage within the same tool to give you answers in seconds of live running Macs or Macs connected in Target Disk Mode in a write-blocked environment.

Endless Reporting Options at your Fingertips to get the Answers you need Quickly

RECON ITR automatically finds important artifacts, parses the data and presents them to you in a unified format that can be refined to produce the perfect report.

macOS Volatile Data Collection

RECON ITR includes automatic collection of Volatile Data for important artifacts related to malware, hacking and user logins

Capture Mac RAM from both the live and bootable environments with RECON ITR’s RAM Imager.

Forensic images produced by RECON ITR can be processed easily in RECON LAB – SUMURI’s Flagship Full Forensic Suite which automates analysis of Mac, iOS, Windows and more! 

Logical Imaging with Automatic Artifact Collection

RECON ITR includes Selective Logical Imaging with RECON IMAGER PRO included. Quickly select the data to be imaged down to a single file.

RECON ITR is the only tool capable of preserving original timestamps during logical imaging of Mac data.

RECON ITR also has the ability to automatically collect macOS artifacts from any user account which can be processed automatically in RECON LAB!

Built in Software Write-Blocking

RECON ITR comes with built in write blocking capabilities. No need to purchase additional solutions to image and triage in a forensically sound manner.

iOS Backup Triage and Process

RECON ITR automatically detects, parses and can triage iOS backups. Recover messages, web browsing history and more in seconds.

Bootcamp Triage

RECON ITR has the ability to triage Boot Camp partitions in the field.  There is no need to create an image and return to the lab to see the data.

Sumuri Paladin

FORENSICS SIMPLIFIED

RECON ITR now includes a free PALADIN PRO with every new purchase to cover all imaging and triaging needs across macOS, Windows, and Linux.

PALADIN has become the World’s #1 Forensic Suite used by thousands of digital forensic examiners from Law Enforcement, Military, Federal, State, and Corporate agencies.

PALADIN TOOLBOX

The PALADIN Toolbox combines the power of several court-tested Open Source forensic tools into a simple interface that can be used by anyone. With the PALADIN Toolbox, a user can easily and quickly TRIAGE – SEARCH – IMAGE, and more!

DEMO REQUEST

RECON ITR demos are active for 15 days.

RECON ITR demos only include the Live RECON ITR application, not the Bootable RECON IMAGER modes.

*All fields required to process this request

Scroll to Top