SUMURI

05/26/2026

Check Steve’s latest article on why the lack of a fully published APFS specification creates hidden hurdles for digital forensics and why deep filesystem knowledge is still critical for complete investigations.

Read it here:

Here’s why that matters in macOS forensics APFS is the foundation of modern macOS systems, yet one of the most important facts about it is often overlooked. Apple has never published a complete, authoritative specification for APFS.

05/26/2026

What is the Global Timeline in RECON ITR?

Global Timeline is a cross-artifact chronological analysis feature in RECON ITR v26.

It pulls records from multiple triage plugins, images, audio, file system artifacts, print job logs, and more, into a single unified timeline filtered by date range and searchable by keyword.

Each record is labeled with its source plugin and timestamp context, so you know exactly what you are looking at and when it occurred.

New tutorial now live. We walk through:
✅ Loading a triage case and navigating to Global Timeline
✅ Selecting plugins and applying date filters
✅ Using keyword search to narrow results in real time
✅ Bookmarking filtered records for reporting

RECON ITR v26 is available now at sumuri.com
https://sumuri.com/recon-itr-release-notes/

Follow for more RECON ITR tutorials.

05/25/2026

This Memorial Day, we honor and remember those who made the ultimate sacrifice for our country.

Their courage, dedication, and selflessness will never be forgotten.

Today, we pause in gratitude for the freedom they helped protect.

05/19/2026

Just released: How to Update RECON ITR to the Latest Version

RECON ITR keeps your forensic investigations running at peak performance. In this new video, we show you exactly how to update RECON ITR on your Mac, from download to completion.

The update process is straightforward:
1.) Download the RECON ITR Updater
2.) Grant Full Disk Access
3.) Run the updater and confirm
4.) Complete the installation

This guide covers every step so you can get your forensic tools updated quickly and confidently.

For offline updates, reach out to [email protected].

05/15/2026

At SUMURI, we believe that true expertise requires a foundation of vendor-neutral proficiency. That’s why we lean on certification to ensure our key members are among the best in the field.

Huge congratulations to Henschen and Windham for successfully completing their intensive, two-week in-person training in Orlando!

This is their first step, but the journey doesn't end here. They are now moving into the next phase of their path toward becoming Certified Forensic Computer Examiners (CFCE). We are proud to support them as they sharpen their skills and uphold the highest standards in Digital Forensics.

Keep up the great work, gents!

05/15/2026

Join SUMURI at Techno Security East 2026!

Innovation doesn't take a vacation. Join us at the Myrtle Beach Sheraton & Convention Center from June 2-4 for three days of deep dives into digital forensics.

Visit the SUMURI team at Booth #314 to explore our latest software updates, including RECON ITR v26.0, and experience the unrivaled power of TALINO workstations. We will also be on-site to discuss our vendor-neutral Mac forensics training, essential for any modern lab.

We look forward to connecting with our partners and peers in South Carolina!

05/14/2026

Check Steve’s latest article on why AI-ready hardware is becoming a critical part of modern investigative workflows and why the conversation needs to go beyond just software.

Read it here:

Artificial intelligence is no longer just a future concept for digital forensics, cybercrime, law enforcement, and crimes-against-children investigations. It is already being discussed, tested, and integrated into real workflows.

05/13/2026

What does the iOS triage results screen look like in RECON ITR?

If you have used RECON ITR's macOS triage before, the iOS triage results screen works the same way. Plugins are listed on the left with record counts, results can be filtered by date range or keyword, and Global Search lets you query across every plugin at once. When you are ready to report, export bookmarked records or the full triage case as HTML, PDF, or CSV.

New tutorial now live. We walk through:
✅ Navigating the iOS triage results screen and plugin list
✅ Filtering results by date range and keyword
✅ Bookmarking records across multiple plugins
✅ Generating a Global Report in PDF, HTML, or CSV

RECON ITR v26.0 is available now at sumuri.com.

Follow for more RECON ITR tutorials.

05/11/2026

Check Steve’s latest article about APFS snapshots and why they are the hidden evidence source most Mac examiners are missing.

Read it here:

And why timing matters more than you think APFS snapshots are one of the most powerful and often misunderstood sources of evidence on a Mac. Most examiners are aware that snapshots exist, but far fewer fully appreciate how they impact what data is available, when it was available, and how that data

05/08/2026

At IACIS 2026 Training Conference, I decided to do something a little different for the ending review of the Mac Triage block of the BCFE class.

What started as a fun review idea turned into a full lyric video and song called “Think Different” — mixing Mac forensics, Apple Silicon, triage concepts, and a little humor into something the class could actually enjoy and remember. 😄

Honestly, I wasn’t expecting the reaction it got. The class loved it and kept asking where they could hear the song again, so we decided to share it here.

Hope you enjoy it as much as the class did.

https://www.youtube.com/watch?v=S9JQ4Nk_uhI

— Steve Whalen / Salty Gnome
🎵 Music by Salty Gnome
🎥 Posted by SUMURI

Check out more music and projects from Salty Gnome here:

🎧 YouTube Music: https://www.youtube.com/channel/UCXRYIDFGf0rAYt5xujFMeYQ
Salty Gnome on YouTube Music

📘 Facebook:
https://www.facebook.com/saltygnomemusic
Salty Gnome Music on Facebook

“Think Different” started as a fun ending review song for our Mac Triage class… and somehow turned into a full lyric video that the class actually wanted to ...