Asset 7

RECON TRIAGE can get you answers to important questions quickly within minutes or even seconds with automated analysis.

Intelligent Live Imaging

Mac Forensics… Simplified

RECON TRIAGE is an indispensable tool for anyone who needs to capture data from a running Mac computer. RECON TRIAGE automates live imaging, volatile data collections, RAM imaging and more!
Get answers quickly
RECON TRIAGE can get you answers to important questions quickly within minutes or even seconds with automated analysis.

No need to be a rocket scientist.

RECON TRIAGE is designed for both novice and advanced investigators. Be up and running in seconds and produce hundreds of reports in minutes!

Note: You have a 15 month period (1 year and 3 months) from the start date to renew software at the renewal list price, after this time you will have to pay the full price for the software.


The power of RECON TRIAGE is combined with the power of the 500GB Samsung T5 SSD with speed up to 540 MB/s USB 3.1 Gen 2!

RECON TRIAGE contains powerful features in a simplistic interface. Advanced output can produce thousands of customized reports. Simple configuration and fast results. Features support both corporate and law enforcement investigations.

RECON TRIAGE supports macOS 10.7 and above.

Supports the Latest macOS File Systems and Artifacts

  • Process APFS and FileVault macOS computers
  • Process hundreds of artifacts from iOS backups
  • Built-in Live Imaging
  • Automatic identification of Spoliation artifacts.
  • Advanced Timeline Analysis.
  • Identify the origin of files.
  • Automatic chat timeline construction for Messages and Skype.
  • Complete a Mac exam in minutes, not weeks.
  • Easily produce hundreds of reports – PDF, HTML, CSV and XML.
  • Image RAM, capture Volatile Data and more!


Intelligent Live Imaging

Quickly identify the areas of data that are relevant to your investigation. RECON TRIAGE can build an artifact specific forensic image of the target Mac.

RAM Imaging

Recover vital data that other tools miss by capturing data stored in the Mac’s RAM.

RAM and Live Images can be imported into RECON LAB

All live images and RAM images produced by RECON TRIAGE can be processed easily in RECON LAB – SUMURI’s Flagship Full Forensic Suite which automates analysis of Mac, iOS, Windows and more!  Find out about RECON LAB here.

Mac Forensics… Simplified

Expert Mac forensics is now as easy as checking a box.

RECON TRIAGE automatically finds important artifacts, parses the data and presents them to you in a unified format that can be refined to produce the perfect report.

Capture Volatile Data 
RECON TRIAGE allows you to capture important volatile data which is crucial in investigating malware.

Mac Password Recovery

Quickly and easily recover Keychain and user passwords from most versions of macOS.  (The Password Recovery feature is only available to vetted agencies and is not for export).


Where to find your USB Serial Number? Click on the Apple Menu > About this Mac > System Report > USB

*All fields required to process this request