SuperImager® Plus Desktop 4 NVMe + 4 SAS/SATA Forensic unit is a standalone forensic imaging device that can be used to perform multiple Forensic tasks, allowing the user to capture data in the Lab from numerous source drives to multiple target drives simultaneously and upload them to a network. It also enables the user to perform a full Forensic analysis using Encase, Nuix, and Axiom applications or capture data from multiple cellphones using Cellebrite, MSAB application. The unit is industrial and durably built in a desktop style, the application designed with easy-to-use touchscreen icons. The unit has built-in 4 U.2 NVMe ports, 4 SAS/SATA ports, and 8 USB 3.2 ports, and it is the perfect tool when imaging from both SAS/SATA and NVMe storage. In addition, the unit uses the latest extremely fast CPU to achieve imaging above 187GB/min with NVMe SSD.
The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, capture a single partition, Mix E01/DD format, VHD, Triage of Files and Folders.
Here are some of the tasks the unit can be used for:
1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only parts.
2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters and with the file's metadata and HASH each file (for example, run E01 capture of 2 parallel simultaneous sessions using 4 NVMe SSD and 16 CPU compression engines).
3) Perform Forensic Imaging from many Suspect drives to one large Evidence drive; in append mode.
4) Upload many Forensic images to a network (SMB, CIFS, NFS).
5) Erase data from Evidence drive - using DoD (ECE, E), Security Erase, NVMe Secure Erase, or Sanitize Erase protocols.
6) View the data directly on the Ubuntu Desktop screen.
7) Encrypt the data while capturing (using the AES256 engine).
8) HASH the data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines simultaneously.
9) Run a quick Keyword Search on the Suspect drive before capture.
10) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
11) Run a Forensic Triage application(Win) to capture and view the important Suspect data.
12) Run a full Forensic Analysis application like Encase/Nuix/FTK.
13) Run Virtual Drive Emulator (Linux).
14) Encryption and Decryption on the fly of drives that contain sensitive information.
15) Easily reconfigure the unit’s ports, where each target port can be configured as a source or target, enabling the user to run 4:4 sessions or eight image uploads to a network.
16) Convert the unit’s 8 USB 3.2 ports to SATA ports and run more parallel sessions (using some USB 3.0 to SATA adapters).
17) Use the SuperImager unit as a “Write Blocker” device: This feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.
A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Write block mode.
The SuperImager unit will be connected to the same network where the user is connected, and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.
The unit is designed to help expedite the forensic imaging process, especially in facilities with a large backlog in imaging drives, by performing parallel forensic imaging in a true optimized multiple session's application.
The advantage of this unit is that it supports imaging from mixed media of SATA, SAS, USB, and NVMe SSD.
Additional operations: HASH authentication, drive diagnostics, and automation of process using scripting.