As a platform using Win10, the unit can be used to perform full forensic analysis, cellphone data extraction, Triage data collection, and more.
The top speed recorded imaging NVMe SSD can reach up to 160 GB/min.
The unit hardware is very robust, running i7 11 generation CPU and with 32 GB of memory.
The unit supplied with:
- Remote Capture KIT
- Virtual Emulator (viewing the Suspect drive before the capture).
- 4 U.2 Extension Cables.
- 4 U.2 to M.2 NVMe adapters.
- Thunderbolt 3.0 to PCI-E Expansion Box with 4 SAS ports controller + U.2 & M.2 NVMe controller.(The Thunderbolt Expansion Box brings a lot of additional connectivity)
Important Options are:
- e-SATA port: One port on the main unit
- 4 SAS/SATA ports: 4 ports on the TB Expansion Box (only data)
- 5 NVMe ports: 4 U.2 NVMe on the main unit (power & data) and one M.2 NVMe port on the TB Expansion Box
- TB3.0 port
- The Thunderbolt Expansion box brings a lot of additional connectivity.
Thunderbolt 3.0 to 10GbE adapter and the Mac/Thunderbolt acquisition kit.
The main difference between this unit and the SuperImager® Plus 8" Portable Forensic Unit with 3 NVMe + 4 SATA/SAS ports: The number of NVMe ports on the main unit.
The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, Mix DD/E01, capture a single partition, VHD, Triage of Files and Folders.
Some of the tasks the unit can be used for:
1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only parts. Copy 1:4 for SATA drives, 1:4 NVMe drives, or any mix between the 5 NVMe ports to 5 SATA ports or 8 USB3.0 ports.
2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters.
3) Erase data from Evidence drive - using DoD (ECE, E), Security Erase, NVMe Format with Secure Erase, or Sanitize Erase protocols.
4) View the captured data directly on the Ubuntu Desktop screen.
5) Encrypt the data while capturing (using the AES256 engine).
6) HASH the data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines simultaneously.
7) Run a quick Keyword Search on the Suspect drive before capture.
8) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
9) Run the Forensic Triage application using third-party applications on (Windows 10), and view the captured data.
10) Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom.
11) Run Virtual Drive Emulator before the data was captured (Linux).
12) Run Remote Capture from unopened laptops - Intel-Based CPU/Mac CPU.
13) Use the Thunderbolt 3.0 port to capture data from USB 3.2 storage devices, Mac via Thunderbolt 2/3 port or 1394 port, or connect to 10 GbE network with the use of TB3.0 to 10GbE adapter.
14) Unlock drives with ATA pass-code, BitLocker pass-code, Opal pass-code for SED drives.
15) Use the unit as a “Write Blocker” device: This feature enables the unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection. A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Write block mode. The SuperImager unit will be connected to the same network, and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.
Additional operations: HASH authentication, Restore a Drive, Drive Diagnostics, Erase Evidence drive before use, and automation of processes using scripting.
The application supports simultaneous forensic imaging of multiple drives in multiple sessions.
The main difference between using a product with U.2 port (and with Extension cables) vs. using M.2 port and plugging the media directly into the port: NVMe U.2 port is more versatile and can support three types of NVMe SSD: M.2, U.2, PCIE NVMe storage controller, while M.2 port is limited to M.2 SSD. Using the U.2 Extension cables protects the unit's NVMe port from overuse and many insertions by plugging the SSD directly into the unit's port and damaging the port. Competitors that use NVMe M.2 ports are limited with their supports (Only M.2), and force the user to plug the media directly into the port. The U.2 extension cables are very durable and built with high quality and precision, and they exhibit an extreme transfer rate of over 200 GB/min.
The SuperImager application is optimized to achieve extreme top speeds when using NVMe SSD: HASH SHA-1 131GB/min, Mirror Image 97 GB/min, Erase + Verify 130 GB/min, Verify 165 GB/min