Imaging a Silicon Mac (ft. Recon ITR)

Starting with the M1 chip in 2020, Apple Silicon Macs introduced an ENTIRELY different system and security architecture. And so, the not-so-good news is...

you can't really image an Apple Silicon Mac the same way you image an Intel-based Mac anymore

a not-so-good feeling

The biggest change with Apple Silicon Macs is that you cannot do a full physical disk acquisition anymore...and whichever imaging method you use, one thing is essential: you’ll need valid administrator credentials.

The Data Volume contains user and system-generated data, while the Container Disk includes the Data Volume together with other encrypted volumes (System, Preboot etc.)

So, while keeping that in mind, we can use RECON ITR to acquire either. RECON ITR is built specifically for imaging Macs, including Apple Silicon Macs.

2 ways you can do this! (and again, whichever method you choose, you’ll need valid administrator credentials.)

And just like that, you can enter RECON ITR's Disk Imager to select the Container or the Data Volume and proceed with imaging

Some Imaging Tips!

1. When choosing the image type, always use DMG or sparseimage/sparsebundle!

2. You have 2 options for your destination drive! You can either choose to prepare your own external APFS drive OR image it directly to your RECON ITR SSD drive. The latter makes it convenient, especially with Macs typically having very little ports
   

• 

• 

---

Conclusion

So while Apple Silicon Macs have changed the way forensic imaging is done, acquisition is still of course, possible. You just need the ✅ right method, ✅ right image format, ✅ administrator credentials, and of course, RECON ITR 😜