Home > Line of Products ↓ >

SuperImager Plus Forensic Field Unit with Thunderbolt port

SuperImager Plus Forensic Field Unit with Thunderbolt 3.0 Expansion Box
SuperImager Plus Forensic Field Unit with Thunder-Bolt port - Forensic Imager and Computer Forensic Field Platform


 
Alternative Views:


  • The SuperImager Plus Field Forensic Unit (with Thunderbolt port and i7) - is a mobile, super compact, easy to carry, affordable, powerful hardware and extremely fast Forensic Imaging unit that enable the user to capture data from almost every digital storage device in a very easy way. The unit is supplied with Thunderbolt 3.0 Expansion box with PCIE 3.0 x4 and it is running under Linux Ubuntu OS and it can perform: Forensic Imaging with full compression, Erase Data, View Data, Encrypt Data, Cellphone/Tablets Extract and Analysis Data, and Forensic Full Analysis.
  • The SuperImager Plus Forensic Field Unit with Thunderbolt port built-in: Thunderbolt 3.0 port, 4 USB 3.0 ports, HDMI, DP, 1GbE, SPK, SDXC
    Ability to capture from: SAS, SATA, IDE, USB3.0, SCSI, FC, 1394, USB3.1, NVMe interfaces by plugging the appropriate controller into the Expansion Box

Product Code: SIT-0001-00A
Please call for pricing

Description Technical Specs Extended Information
 
The SuperImager® Plus Forensic Field Unit with Thunderbolt port- is a mobile, super compact, easy to carry, affordable, powerful hardware and extremely fast Forensic Imaging unit that enable the user to capture data from almost every digital storage device in a very easy way. The unit is supplied with Thunderbolt 3.0 Expansion box with PCIE 3.0 x4 and it is running under Linux Ubuntu OS which is less targeted OS by malware, and it reduces the OS performance overhead
The unit can be used to perform:
  1. Forensic Capture using Bit-by-Bit, DD, E01/EX01(with full compression) formats
  2. Upload Forensic images to the network
  3. Erase data from Evidence drive using DoD (ECE, E), Security Erase, Enhanced Security Erase protocols
  4. View the captured data directly on the Ubuntu Desktop Screen
  5. Encrypt the data while capturing (AES256)
  6. HASH the data while capturing (SHA-1, SHA-2, MD5)
  7. Run Cellphone/Tablets data Extraction and Analysis - Windows side
  8. Run Forensic Triage application - Windows side
  9. Run a full Forensic Analysis application like Encase/Nuix/FTK - Windows side
  10. Run Virtual Drive Emulator

The SuperImager Plus Forensic Field unit with Thunderbolt port built-in: Thunderbolt 3.0 port, 4 USB 3.0 ports, HDMI, DP, 1GbE, SPK, SDXC
The Thunderbolt Expansion Box built-in: 2 Thunderbolt 3.0 ports, 1 PCIE 3.0 X4 (16x slot)
Supplied: 2 ports e-SATA 2 controller (installed in the TB Expansion Box), USB3.0 to SATA fast 2.5" adapter

Ability to capture from: SAS, SATA, IDE, USB3.0, SCSI, FC, 1394, USB3.1, NVMe interfaces by plugging the appropriate controller into the Expansion Box

Dual Boot Option: The unit is running Ubuntu OS for forensic imaging and virtual drive emulator purpose. The dual boot to Windows is optional for additional cost. It needed when user intend to install and use third-party applications to perform data analysis, cellphone extraction and more


Features
    • Main Hardware Features:
    • Case: Mobile, easy to carry
    • CPU: i7 Gen-6
    • Hardware: Very high quality high performing components
    • Hardware upgrade: The unit can be upgraded at time of purchasing for additional cost, to a large internal SSD, or to 32GB internal memory
    • OS: Linux Ubuntu 64 Bit
    • Application Updates: Application can be easily updated via USB thumb drives and special update screen
    • Application Settings:
    • HPA/DCO Automatic Supports: The application has the ability to automatically open HPA and DCO areas, and resize the "Suspect" hard drive to its full native capacity, in order to capture any “hidden data” (HPA/DCO are special areas on the hard disk drive that support this feature)
    • Bad Sectors Handling: User can select to skip bad sectors/blocks, or abort the operation when it encounters bad sectors/block of sectors on the "Suspect" hard disk drive
    • Ports:
    • Forensic Images Destination: The user can save Forensic Images to a local network shared folder for easy access and analysis, or save images to external USB3.0 RAID (encryption is optional) storage in a very good speed
    • Easy Capture from almost any Storage Protocols and Interfaces: SAS, SATA, e-SATA enclosures, IDE, USB2.0, USB3.0, USB3.1, MMC, M.2 NGFF(SATA, or PCIE base), NVMe 2.5" or M.2, 1394, Thunderbolt, FC, and SCSI (The user just plug the appropiate storage controller in the Thundedrbolt expasnion box which connected to th emain unit)
    • Form Factors: Capture data from various form factor devices: 3.5", 2.5", ZIF, 1.8", Micro-SATA, Mini-SATA, PCIE*, Mini PCIE*, M.2 NGFF
    • Cross Copy from Ports and Interfaces: The user can choose to capture from one type of port, storage protocol and interface, and save the forensic Images into a different port, storage protocol and interface. The cross copy of data can be done between SAS/SATA/IDE/USB/SCSI/1394/FC/NVMe interfaces
    • Application Features:
    • GUI: The application is built with large icons and is very simple and easy-to-navigate. In a few clicks user can set the operation, and it will be quickly up and running
    • Speed: Extremely fast (HASH authentication 57.5GB/min SHA-1 with Intel 750 2.5" NVMe drive)
    • Extreme Speeds when performing Forensic capture with E01/EX01 formats and with full Compression:
    • • The new Linux-based SuperImager Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations, while performing at incredibly high speeds with E01/EX01 compression. The application allows users to manually select and adjust the number of threads and the level of compression used during each session
    • • Forensic data capture with Encase E01/Ex01 formats with full compression is widely used operation in the forensic industry, and generally requires a trade-off between speed, space, and time of decompressing by the EnCase application
    • HASH Authentication: Simultaneously calculates on-the-fly up to 3 Hash Authentication values MD5/SHA-1/SHA-2
    • Encryption: On-the-fly AES256 encryption of the "Suspect" Hard Disk Drive, saving the encrypted data on "Evidence" Hard Disk Drive in 100%, DD, E01/Ex01 formats.
    • Decryption: The user can perform decryption on a drive, previously encrypted by any of the SuperImager units. Alternatively user can use a standalone MediaClone Linux decryption utility application to perform decryption on that drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the Linux utility, where the encrypted drive and a blank destination drive were attached to the PC. (The user needs to supply to the utility application the saved encryption key)
    • Forensic Images can be saved in those Formats: 100% Bit- by-Bit, Linux DD Format, Encase E01/Ex01 formats include options for optimized compression
    • Evidence Drive Formats: exFAT/FAT/NTFS/HFS+/EXT4
    • Log Files: Audit trail in PDF formats, with ability to customize the reports and adding company Logo
    • Drive Spanning: Supports spanning the captured data onto many “Evidence” drives , when the Evidence drives are not large enough (Also supports restore from spanned multiple drives)
    • Main application Features:
    • • Forensic Imaging Mode
    • • Forensic Restore back data to original drive
    • • Erase data from drives and Quick Format
    • • HASH calculation authentication and verification
    • • Virtual Drive Emulator
    • Main Forensic Imaging Mode Features:
    • • Forensic Imaging Modes: Mirror image(100% or any % of the drive), DD, E01/EX01 – with optional compression
    • • HASH while capture: MD5, SHA-1, SHA-2 (all 3 HASH engines can be selected simultaneously)
    • • Erase The Reminder of the drive
    • • Encryption/Decryption
    • Parallel operations:
    • Parallel Forensic Imaging - Multiple Session Operations: User can run a multiple efficient parallel operation, since many ports are available. User can mix different type of operations, and each operation is set as a new independent session. Example of operations: erase data from a hard disk drive on one port, hash verify on second port, while forensic imaging 1 to 1 on the remaining ports
    • Evidence Ports and parallel operations between them:
    • USB3.0 ports: 4 ports (copy up to 2:2)
    • SATA target ports: With the use of USB3.0 to SATA adapters, the user can convert 4 USB3.0 ports to be 4 SATA ports (copy 2:2)
    • Parallel operation – Linux Elaborated:
    • Hard Drive Detection Application Screen: All hard disk drives and storage devices that are connected to the units will be scanned and displayed in one application screen called “the detection screen”. User can tap on each drive to get its detailed info, as well as selecting it for the desired operation they are planning to use
    • Parallel Forensic Imaging: It depends on the number and the kind of ports that each model has. The application is very flexible in running multiple sources to multiple destinations, all in a simultaneous operations. The user has the flexibility to change a role of a port from Evidence to Suspect, and is not limited by the pre-assigned "Suspect" ports. The session control application screen provides the user with a very comprehensive information and control over the running sessions, including all the setting of the session, and ability to abort the session
    • Parallel Forensic Imaging - Multiple Session Operations: User can run multiple efficient parallel operations and can mix different type of operations; for example erase hard disk drive on one port, hash verification on another port, while performing forensic imaging on other ports (each operation can function as a
    • new independent session).
    • Network:
    • Network Capture: Data from network folder can be captured and saved into “Evidence” drives via iSCSI storage protocols (SMB, NFS, CIFS)
    • Saves Forensic Images to Network: Upload simultaneously Multiple Forensic images to a local network (DD, E01)
    • Remote Capture - Capture Data from the Internal Hard Disk Drives of a Computer: Using USB or 1Gigabit Ethernet ports of the laptop/computer, enables capture without the needs to remove the hard drive from the Laptop/computer (The captured speed is restricted to performance of the Laptop/PC CPU and the 1Gigabit/s connection)
    • Erase and Quick Format Operation:
    • Hard Disk Drive Erase Protocols: DoD 5220-22M, Security Erase, Enhanced Security Erase, or user can define the final data filling pattern and the number of iterations (Security Erase, Enhanced Security Erase, and DoD erase protocols are NIST 800-88 compliance)
    • Quick Format: NTFS, FAT, HFS+, EXT4, and exFAT
    • Logs and Erase Certification: The application generates extensive erase log files and erase certification (option to save to NIST 800-88 format) that are easy to export to USB thumb drive
    • Unit as a Platform:
    • File Preview: Browse and preview captured data on the Internal Display
    • High Performances: As a platform, a forensic investigator can, in addition to imaging and capturing data, load and run third-party applications to analyze the captured data:
    • • Cellphone/Tablet data extraction and analysis: Cellebrite, Oxygen, BlackBag, MPE+, Paraben applications
    • • Triage data collection: Nuix/Encase portable applications
    • • Full computer forensic analysis: Encase, Nuix, and FTK applications
    • Warranty: One year warranty for the main unit. (It is not include cables and accessories)
    • Built-in the US: The units are built and tested in the US
    • * Expansion ready unit

Share your knowledge of this product. Be the first to write a review »