The SuperImager® Plus XLE Desktop 40 SAS/SATA ports Forensic Imaging Solution is the latest generation of MediaClone desktop Forensic solutions; it is a standalone forensic imaging with the ability to perform multiple Forensic tasks, allowing the Forensic investigator to capture data in the Lab from multiple source drives to multiple target drives simultaneously. It also enables the user to perform a full Forensic analysis using encase, Nuix Windows 10 application, or capture data from multiple cellphones and run cellphone analyses, or use any third-party Windows application. The unit is industrial and durably built, using a desktop-style, with easy to use touchscreen icons. The solution consist of the main unit with 8 SAS/SATA ports in open tray plus 10 USB3.1 ports, In addition it includes 2 cable-less Expansion Box each with 16 ports of SAS/SATA.
The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, and Linux-DD.
Here are some of the tasks the unit can be used for:
1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only parts.
2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extensions filters (for example, run 8 independent sessions of E01 capture with 16 native SAS/SATA ports and 16 E01 compression engines simultaneously).
3) Perform Forensic Imaging from many Suspect drives to one large Evidence drive; in append mode (can perform forensic imaging from 15 Suspect drives to one large Evidence drive).
4) Upload many Forensic images to a network (SMB, CIFS, NFS).
5) Erase data from Evidence drive - using DoD (ECE, E), Security Erase, Enhanced Security, or Sanitize erase protocols.
6) View the data directly on the Ubuntu Desktop screen.
7) Encrypt the data while capturing (using the AES256 engine).
8) HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.
9) Run a quick Keyword Search on the Suspect drive prior to capture.
10) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
11) Run Forensic Triage application using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.
12) Run a full Forensic Analysis application like Encase/Nuix/FTK.
13) Run Virtual Drive Emulator prior to the data being captured on the Linux side (this option is enabled on this unit).
14) Encryption and Decryption on the fly of drives that contain sensitive information.
15) Easily reconfigure the unit’s ports, where each of the target port can be configured as source or target for running 8:8 sessions, or to run an upload of 16 storages to a network.
16) Convert the unit’s 10 USB3.1 ports to SATA ports and run more parallel sessions (with the use of some USB3.0 to SATA adapters).
17) New feature - Use the SuperImager unit as a “Write Blocker” device: This new feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.
A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode.
The unit is not expandable.
The SuperImager unit will be connected to the same network and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storages, such as: SAS, SATA, USB, 1394, FC, SCSI, and NVMe.
The unit is designed to help expedite the forensic imaging process, especially in facilities where there is a large backlog in imaging drives, by performing many parallel forensic imaging in a true optimized multiple session's application. The advantage of this unit is that it supports imaging from mix media of SAS/SATA/USB.
Additional operations that are available include HASH a drive, drive diagnostics, and scripting.
|SuperImager Plus unit with i7 CPU, 16GB Memory
|Hash Verification/ Authentication Only (Reading Speed)
||Avg Speed GB/Min
|Hash single drive, in a single session (Samsung 850 EVO SSD)
| SHA-1+ MD5
| Hash 2 drives in 2 separate sessions (2 Samsung 850 EVO SSD)
| SHA-1 + MD5 drive 1
| SHA-1 + MD5 drive 2
| Hash single drive, in a single session (SanDisk Extreme II 128GB)
| SHA-1 + MD5
|Wipe Drives (Write Speed) (Samsung 850EVO SSD)
| Security Erase Mode
| Single Pass - User Erase Mode
| 100% bit by bit Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD
| with SHA-1+ MD5 Hash on
| DD Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD (2GB Files Chunks and NTFS)
| with SHA-1 + MD5 Hash on
|DD Imaging SanDisk Extreme II SSD to Samsung 850 EVO SSD 2 GB file Chunks and NTFS)
|with SHA-1 + MD5 hash on
| E01 Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD (2GB Files Chunks and NTFS)
|with SHA-1 + MD5 Hash on