SuperImager Plus 8 inc Portable 3 NVMe +6/SAS/SATA Forensic Imaging Unit with Thunderbolt - Dual Open OS

The unit is Portable, Compact, easy to carry, and extremely fast. It is built with 2 NVMe U.2 data & power ports, 2 SATA3 data & power ports, one e-SATA port in the back of the unit, 6 USB3.2 ports, one USB3.2 Gen 2x2 USBc port, and two Thunderbolt 4.0 ports.

The unit is configured with Dual Open OS of Linux for fast, efficient Forensic imaging and Windows 11 for running full Forensic Analysis (EnCase, Nuix, Axiom, and others), cellphone data extraction(Cellebrite, MASB, and others), and triage data collection. Using the Linux OS, the user can run: multiple,simultaneous independent forensic imaging sessions (mirror image, image a single partition, Linux-DD, EnCase, mix E01/DD, VHD, Triage with Files and Folders) with 4 HASH values(MD5, SHA1, SHA2, and SHA512 run all the four at the same time), encryption AES256 XTS, compression, keyword search all on the fly and save images to a network.

The max speed achieved: 31GB/min SATA SSD, 187GB/min NVMe SSD.

The unit hardware is robust, running Core Ultra 7 CPU with 32GB of memory, 1TB SSD, and 8” LCD display.

Main ports:

• 3 SATA ports: 2 SATA ports (power & data) and one e-SATA port on the main unit

• 4 SAS/SATA ports: On the TB3.0 Expansion Box

• 3 NVMe ports: 2 U.2 NVMe nativ eports on the main unit (power & data), one U.2 & M.2 NVMe port on the TB3.0 Expansion Box, and addition NVMe port (#4) with the use of the second TB4.0 port with fast USB3.2 Gen2x2 to NVMe adapter.

• 2 TB4.0 ports
• 1 USB3.2 Gen2x2 (USBc) port, and 6 USB3.2 ports

The unit supplied with:

• Remote Capture KIT

• Virtual Emulator (viewing the Suspect drive before the capture).

• 2 U.2 Extension Cables.

• 2 U.2 to M.2 NVMe adapters.

• Thunderbolt 3.0 PCI-E Expansion Box with 4 SAS ports controller, split cables, power cables, and with U.2 and M.2 NVMe controller (The Thunderbolt 3.0 Expansion box brings a lot of additional connectivity, like Thunderbolt 3.0 to 10GbE adapter).

Here are some of the tasks that the user can do:

1) Multiple Parallel Forensic Capture: Raw Image Mirror bit by bit, Linux-DD format, E01/Ex01 format (with full compression), Mixed-Format DD/E01. Ablityy to select single partition or capture the whole drive.

2) Run a Selective Imaging (Targeted Imaging) of files, folders with file extension filters and save HASH and metadata of the files (Logical Extraction)

3) Erase data from the Evidence drive before use - using DoD (ECE, E), Security Erase, NVMe Secure Erase, Sanitize, or User-Erase protocols.

5) Encrypt the data while capturing (using the AES256 XTS engine) and decryption at the destination using MediaClone supplied utility.

6) HASH the data while capturing – run simultaneously all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines.

7) Run a quick Keyword Search on the Suspect drive before or during the capture.

8) Run Multiple Physical Cellphones/Tablets data Extraction and Analysis using a third-party application on the Windows 11 side.

9) Run the Forensic Triage application with selective capture mode or with the use of a third-party application on the Windows 11 side.

10) Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom.

11) Run Virtual Drive Emulator to view the Suspect drive before captured (Linux)

12) Run Remote Capture from unopened laptops - Intel-Based CPU (supplied with this unit).

13) Use the Thunderbolt 4.0 ports to connect to 10GbE network with the use of optional TB3.0 to 10GbE adapter.

14) Unlock drives with passcode such ATA, BitLocker, Opal for SED drives, and TruCrypt.

15) Use the SuperImager Plus unit as a “Write Blocker” device: This feature enables the unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit and by using the iSCSI protocol over a network connection. A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Writes-Block safe mode. The unit will be connected to the same network, and the Suspect drive will be attached to the unit in read-only mode. The unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

Additional operations: HASH authentication, Drive Diagnostics, erase Evidence drive use, image restores from DD/E01, and process automation with scripting.