Description

The SUPERIMAGER PLUS 8″ T3 PORTABLE FORENSIC IMAGING UNIT WITH I7 AND THUNDERBOLT AND NVME PORTS + SATS/SATA unit is a forensic imaging device with the ability to perform in the field multiple Forensic tasks, allowing the Forensic investigator to capture data from multiple source drives, with supports to many kinds of storage interfaces, to multiple target drives simultaneously with 3 HASH values(MD5, SHA1, SHA2 at the same time) and extremely fast. It also enables the user to perform a full Forensic Analysis in the field by using EnCase, Nuix, Axiom, or any other analysis application for Windows 10, perform extraction and analysis of data from multiple cellphones, or use and run any third-party Windows 10 application. The unit is compact and easy to carry, with built-in 4 ports of SAS/SATA (with a secure connector), e-SATA port, 8 USB3.0/3.1 port, Thunderbolt 3.0 (40 Gigabit/s) port, and it is supplied with a Thunderbolt 3.0 Expansion box with 1394A/B, NVMe M.2, 4 SAS controllers that plug inside the TB 3.0 box and provides supports to those interfaces. Additionally, the Thunderbolt 3.0 port and the Thunderbolt 3.0 Expansion box allows the user to capture data from Ma(using the optional Mac Acquisition Kit) save captured images to a network via 10 Gigabit/s Ethernet, or with the use of other storage controllers such as SCSI, FC to capture data from almost any type of storage interface.
Extreme speed of 32GB/min with SATA SSD and 187GB/min with NVMe SSD
The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, E01/DD mix, single partition, VHD, Files and Folders as a Triage.

Here are some of the tasks the unit can be used for:

1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only partitions, Add more capture capabilities with the use of fast USB3.1 to SATA adapters.
2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extensions filters.
3) Erase data from Evidence drive – using DoD (ECE, E), Security Erase, Enhanced Security Erase, Sanitize erase, NVME erase, USER Erase protocols.
4) View the CAPTURED data directly on the Ubuntu Desktop screen or the Windows screen.
5) Encrypt the data while capturing (using the AES256 engine) and decryption at the destination with the use of MediaClone utility.
6) HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.
7) Run a quick Keyword Search on the Suspect drive prior to capture. or during the capture.
8) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side, or use MediaClone application supporting Android Cellphones.
9) Run Forensic Triage application: Capture files and folder using the MediaClone application or using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.
10) Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom (Windows side).
11) Run Virtual Drive Emulator prior to the data being captured on the Linux side and preview the suspect data or copy important files and folders (this option is enabled on this unit).
12) Run Remote Capture from unopened laptops – Intel Based CPU (supplied with this unit).
13) Use the native Thunderbolt 3.0 port (40Gigabit/s) to capture data from USB3.1 Gen2 storage devices, Mac via Thunderbolt 2/3 port or 1394 port, or connect to 10GbE network with the use of TB3.0 to 10 GbE adapter.
14) Unlock drives with ATA pass-code, BitLocker pass-code, Opal pass-code for SED drives.
15) New feature – Use the SuperImager unit as a “Write Blocker” device: This new feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.
A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode.
The SuperImager unit will be connected to the same network and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as: SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

Additional operations that are available include HASH a drive, Drive Diagnostics, Image Restore, drive Erase of Evidence drive prior to a use, and Scripting.

The application supports forensic imaging of multiple drives, in multiple sessions, in simultaneous forensic imaging runs.

The unit is supplied with 4 SAS/SATA extension cables with power and data, Thunderbolt 3.0 to PCIE Expansion Box with NVMe M.2 controller, 1394A/B controller, Remote capture KIT, Virtual Drive Emulators, M.2 SATA adapters, MSATA adapters, MicroSATA adapters, 4 SAS/SATA controller.