SuperImager Plus
Forensic Imaging Application
SuperImager Plus is a high-performance forensic imaging
platform built for fast, flexible, and secure evidence acquisition. Designed
for investigators and forensic labs, it combines powerful imaging,
verification, erasure, triage, and platform capabilities in one system.
Why SuperImager Plus
Fast forensic imaging
Capture at speeds above 32 GB/min for SATA SSDs and above 100 GB/min
for NVMe SSDs, depending on drive type and workflow.
Flexible acquisition workflows
Perform full bit-by-bit imaging, selective imaging, partition-based capture,
restore operations, and parallel sessions across multiple ports.
Strong data integrity
Run up to four hash algorithms simultaneously during capture and
verification, including MD5, SHA-1, SHA-2, and SHA-512.
Built for forensic environments
Imaging runs under Linux for a secure acquisition environment, while the
dual-OS design supports both Ubuntu and Windows for broader workflow
flexibility.
Complete forensic platform
Beyond imaging, SuperImager Plus can support analysis, triage, drive emulation,
erase workflows, RAID handling, and third-party forensic applications.
48bit LBA Addressing: Supports drives with sizes
up to 256TB.
OS: Dual open OS of Ubuntu and Windows.
Application Updates: The application can easily
be updated by using any of the unit's USB ports and by a simple tap on the
"update software" icon from the unit' main menu.
Core Capabilities
Full Drive Imaging
·
Raw Image - Create complete forensic
images in Capture a full drive, a selected percentage of a drive, or a single
partition, then save to local storage, external RAID, NAS, or network
locations
- Linux
DD
- E01
/ Ex01
- Mixed-format
Targeted Imaging and Triage
Reduce acquisition time by capturing only the data you need:
- Selected
partitions
- Files
and folders
- Filtered
file types by extension
Targeted imaging also supports per-file metadata capture and
simultaneous hash calculation.
Imaging, Verification, and Restore
Run imaging with on-the-fly verification and optional target
HAS comparison to confirm data integrity. Restore previously captured DD, E01,
or Ex01 images back to new drive in its original format.
Encryption and Decryption
Protect captured evidence with AES-256 XTS encryption
during imaging.
Decrypt MediaClone-encrypted drives later using either a SuperImager unit or
MediaClone’s standalone Linux decryption utility.
Drive Spanning
Capture across multiple evidence drives when a single
destination does not have enough capacity. Spanned image sets are also
supported for restore operations.
Performance and Efficiency
SuperImager Plus is engineered to optimize CPU cores and
hyperthreading for demanding forensic imaging workflows, including compressed E01/Ex01
acquisition. Users can manually tune:
- Compression
level
- Number
of parallel engines
- CPU
hyperthreading allocation
This allows labs to balance speed, storage efficiency,
and downstream decompression time based on case requirements.
Advanced Imaging Features
Multi-Session and Parallel Operations
Run multiple independent tasks and sessions at the same time
with no limitations on the number of tasks. For example, you can:
- Erase
one drive using one port
- Verify
Hashes on another port
- Perform
one-to-many forensic imaging on additional connected drives
Cross-Port Capture
Acquire from one interface type and save to another using
available destination ports.
Reverse Imaging and Bad-Sector Recovery
Support difficult media with features such as:
- Imaging in reverse direction for drives with read issue in the
beginning of the drive
- Calculation of segmented HASH.
- Disable read look-ahead mode for SATA drives where the hard drive
reads more blocks ahead of the application request. (Avoid freezing
problematic drives)
- Automatically generated detailed reports on unread sectors
- Power cycle of drive that stuck on bad sector.
- Adjust time out for each drive
- Tracking changes in drive's health using SMART attributes table.
- Adjust Read sector size to fine tuning when reading from bad area to
capture more data when skipping a bad sector
HPA/DCO Detection
Detect hidden drive areas such as HPA and DCO,
then resize the source drive to full native capacity to ensure hidden data can
be captured.
Image Formats Supported
SuperImager Plus supports:
- Bit-by-bit
mirror images
- Linux
DD
- EnCase
E01 / Ex01
- Mixed-format
output to multiple destinations
- File-based
selective capture
- Single-partition
capture
Each destination can be configured independently in
supported workflows.
Imaging Options
• Mix
Format output of E01/DD
• Standalone
HASH authentication (raw image/DD/E01)
• Target
Drives Spanning: Supports multi-drive spanning for large image captures
• Parallel
Span Mode: When the source drive is much faster than the target drives, writing
data to multiple destination drives in parallel can save a lot of imaging time
– no need for special reconstruction software
Data Integrity and Authentication
SuperImager Plus supports standalone and in-process hash
calculation using:
This enables:
- On-the-fly
verification during acquisition
- Post-capture
authentication
- File-level
hash generation in selective imaging mode
Security
Encryption: On-the-fly AES256 XTS encryption of
the "Suspect" drive, saving the encrypted data on the
"Evidence" drive in 100%, DD, E01/Ex01 formats.
Decryption: The user can perform decryption on a drive that has
previously been encrypted with any of the SuperImager units. Alternatively, the
user can use a standalone MediaClone Linux decryption utility application to
perform decryptions on an encrypted drive using any PC. The supplied standalone
decryption utility application can be burned onto a USB flash drive that later
can be used to boot the PC to the MediaClone Linux decryption utility
application, where the encrypted drive and a blank destination drive are
attached to the PC (the user needs to supply to the utility application the
saved encryption key). MediaClone developed its decryption utility application
to ensure that the user can always decrypt the drive that was once encrypted
via a MediaClone unit and not rely on TruCrypt or other third-party
applications that might not be supported in the future.
Network and Remote Capture
Network Support
Capture from or save to network locations using:
Capture can be a single file or a complete network folder
and save to a network is only for DD/E01/Ex01 formats
Remote Capture
Acquire data from internal drives in laptops and computers
without removing the drive or booting the system’s native OS. Supported
workflows include capture over:
Mac Support
Optional workflows are available for:
- Mac
with M1/M2 chips via network
- Mac
with T1/T2 through supported interfaces and adapters
Data Erase and Formatting
SuperImager Plus also functions as a secure data sanitization
tool, with support for:
- DoD
5220.22-M
- Security
Erase
- Enhanced
Security Erase
- Sanitize
- NVMe
Secure Erase
- User-defined
erase patterns
Additional features include:
- Erase
verification
- NIST
800-88 compliant workflows
- S.M.A.R.T.
testing before and after erase
- Erase
certification and detailed logs
- Exportable
erase database
Supported file systems for formatting include:
Built-In Investigation Platform
SuperImager Plus is more than an imager. It can also serve
as a complete forensic workstation for:
- File
preview in write-blocked mode
- Drive
emulation for Suspect drive with Windows OS
- RAID
reconstruction support for software and hardware RAID systems
- Cellphones
and tablets extraction tools
- Triage
applications
- Full
forensic analysis software
- Network
capture and analysis workflows
Supported third-party forensic tools may include platforms
such as Cellebrite, Oxygen, Axiom, MSAB, GrayKey, EnCase, Nuix, and FTK,
depending on customer environment and licensing.
Additional Features
- Large,
easy-to-use touch screen icons-based interface
- Automatic
PDF generated logs
- Detailed
audit trails
- Audio
notifications
- Scripted
task automation
- Language
support, including Korean and Chinese
- Keyword
search before or during imaging
- RAID
detection for select RAID configurations
- Cloud
sync support through third-party services
- Built-in write-blocking hardware
- Designed,
built, and tested in the USA
Warranty: One-year free warranty on the main unit (does
not include a warranty on accessories, adapters, and cables).
