Description
The SuperImager® Plus Complete Field KIT with 8” T3 Forensic Field Unit i7 Edition with Dual Boot Enabled consists of:
SuperImager Plus 8″ T3 Field Forensic Complete KIT includes the SuperImager Plus 8″ T3 Forensic Field unit with Thunderbolt 3.0 port, PCIe 3.0 x4 Expansion Box, Dual Boot Linux/Win 8.1, with Virtual Drive Emulator enabled, Selective Capture of Files and folder feature, Remote Capture KIT, all in a rolling hard carry case, and includes accessories and adapters. A complete platform for field forensic investigator. Imaging, Selective capture, Emulate, HASH, Encrypt, Erase, View, Remote Capture, Network Capture, Cellphone Extraction, Triage Data Collection, Full Forensic Analaysis.
A) SuperImager Forensic 8″ T3 Field Forensic Dual Boot Enabled – i7 Edition with Thunderbolt 3.0 port (i7 CPU, 250GB SSD, 16GB internal memory SAS 3.0), an extremely fast Forensic Imaging device (Run HASH authentication @ 65GB/min on NVMe SSD), and a mobile forensic platform unit. Built-in with 8″ Touchscreen color LCD display, 4 SAS/SATA-3 ports, 8 USB3.0 ports, 1Gigabit Ethernet port, e-SATA port, DP, Audio Ports, and Thunderbolt 3.0 port. In one read pass over the “Suspect” drive, the SuperImager application can achieve: Forensic Imaging with E01 compress, Encryption with AES256, 3 parallel HASH Authentication (MD5, SHA1, SHA2), and Saving Images to 2 external drives, external compact mobile USB3.0/eSATA TB RAID storage devices, and to a local Network. The unit supplied and pre-configured with Dual boot Linux/Windows and with Virtual Drive Emulator enabled. The application also supports Selective Capture mode where the user can select files and folder for a quick copy, and keyword search to run prior of the capture.
B) Thunderbolt 3.0 to PCIE 3.0 Expansion Box with M.2 NVMe controller installed
C) 1394 Kit – Support capture from Firewire storage devices include Mac (Include 1394 controller and 1394 cables)
D) SCSI Kit – Supports capture data from SCSI Hard Disk Drives (include SCSI controller, cables,and adapters)
E) NVMe complete kit (supports M.2 and 2.5″ NVMe SSD)
F) Virtual Drive Emulator option enabled
G) Remote Capture KIT(Intel based CPU)
H) Rugged and rolling IM2500i case, customized foam, with a lid organizer
I) Essential Accessories
Main Hardware Features
-
- Case: Mobile, easy to carry
- CPU: i7 7th Generation
- Display: 8″ (800×600) LED backlight Touchscreen color LCD display
- Hardware: Very high quality high performing components
- Hardware upgrade: The unit can be upgraded at time of purchasing for additional cost, to a larger internal SSD, or the memory can be upgraded to 32GB
- OS: Ubuntu 64 Bit and Win 8.1 Professional 64 Bit in a dual boot. The open Ubuntu OS allows for easy application modification to include new features, easy adaptation to new hardware and ease of adding third-party Ubuntu applications.
- Writes Block: MediaClone is using a Linux environment that never automatically mounts any of the Suspect/source drive partitions and all the source drives are automatically set as read-only to prevent accidental writes.
- Application Updates: The application can be easily updated by using USB thumb drives and by using the “Update Software from USB” icon in the application tools screen
Applications Settings
-
- HPA/DCO Automatic Supports: The application has the ability to automatically open HPA and DCO areas, and resize the “Suspect” hard drive to its full native capacity, in order to capture any “hidden data” (HPA/DCO are special areas on the hard disk drive that support this feature)
- Bad Sectors Handling: The user can select to skip bad sectors, a block of bad sectors, or to abort the operation when it encounters bad sectors on the “Suspect” drive. The skipped bad sectors will be reported in the log file in detailed or in summary
- Forensic Images Destination: The user can save Forensic Images to any attached storages to the SuperImager unit, or to any connected network using the unit 1Gigabit/s port or the 10Gigabit Option, or to any external USB3.0 RAID (encryption is optional) or external NAS storage in a very good speed.
- Captured Storage Protocols and Interfaces: SAS, SATA, e-SATA enclosures, IDE, USB2.0, USB3.0, MMC, M.2 NGFF(SATA or PCIE base), Thunderbolt 2.0, Thunderbolt 3.0, USB3.1, SCSI*, FC*, 1394*, NVMe*
- PCIe Supports: Supported M.2 and 2.5” PCIE SSD, PCIE Express cards and PCIE express Memory using the SuperImager T3 port and the TB3.0 to PCIE Expansion Box and with the NVMe Kit or PCIE Express card reader.
- Form Factors: Capture data from various form factor devices: 3.5″, 2.5″, ZIF, 1.8″, Micro-SATA, Mini-SATA, Slim SATA, Ultra Slim SATA, PCIE*, Mini PCIE*, M.2 NGFF, CF-30.
- Cross Copy from Ports and Interfaces: The user can choose to capture from one port with one type of storage protocol and interface, and save the forensic Image into a different storage protocol and interface using destination ports. The cross copy of data can be done between any of those SAS/SATA/IDE/USB/SCSI/1394/TB interfaces.
Application Features
-
- GUI: The application is built with large icons and is very simple and easy-to-navigate. In a few clicks user can set the operation, and it will be quickly up and running
- Speed: Extremely fast: One of the fastest Forensic Imaging solution available in the market today achieving a speed of above 30GB/min. Tested with HASH verification operation with SHA-1 enabled the recorded top speed was 30GB/min with Solid State Drive, and 10GB/min with 1TB WD Blue SATA-3 Hard Disk Drive. Tested with Forensic Imaging operation of 1 to 2 with SHA-1 enabled the recorded sustained top speed was 29GB/min with 3 SSD of SanDisk 120GB Extreme II.
- Hash Authentication: Simultaneously calculates on-the-fly up to 3 HASH Authentication values MD5/SHA-1/SHA-2 at the same session.
- Encryption: On-the-fly AES256 encryption of the “Suspect” Hard Disk Drive, saving the encrypted data on “Evidence” Hard Disk Drive in 100%, DD, E01/Ex01 formats
- Decryption: The user can perform decryption on a drive, previously encrypted by any of the SuperImager units. Alternatively, the user can use a standalone MediaClone Linux decryption utility application to perform decryption on the encrypted drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the MediaClone Linux decryption utility, where the encrypted drive and a blank destination drive were attached to the PC. (The user needs to supply to the utility application the saved encryption key). MediaClone developed its own decryption utility in order to make sure that the user can always decrypt the drives that were encrypted via the MediaClone units, and not to relay on TruCrypy or other third-party application that might not be supported in the future.
- Forensic Images Formats: Multiple Image Formats 100% Bit by Bit Mirror copy, Linux DD Format, Encase E01/Ex01 Formats (include options for optimizing the compression by adjusting the compression level and the number of compression parallel engines) and Mix-Format of E01/E01/DD. Mix-Format is where the user can capture from one source drive and save the images into multiple destination ports, each target port can be selected to be one of the 3 E01/EX01/DD formats. In addition, the user can use a file-based copy to copy files and folders, by using selective imaging with file extension filters.
- Evidence Drive Formats: exFAT/FAT/NTFS/HFS+/EXT4
- Audit trail and operation Log Files: Generated automatically by the application and saves on the Evidence/Target drive (PDF).
enerated automatically by the application and saves on the - Drive Spanning:Supports spanning the captured data onto many “Evidence” drives , when the Evidence drives are not large enough (Also supports restore from spanned multiple drives)
Main application Features: Supports spanning the captured data onto many “Evidence” drives, when the Evidence drives are not large enough (Also supports restore from spanned multiple drives)
-
- Forensic Imaging Mode
- Forensic Restore back the data that was captured to another drive in the original format
- Erase data from drives and Quick Format
- Hash calculation authentication and verification
- Keyword search to be run prior to the capture
- Virtual Drive Emulator Option: Enable the user run a drive or image of a drive emulator on the unit (Windows only), and ability to share folders and copy important files. (Bypass the user Windows passcodes)
- Remote Capture (Intel based CPU) – capture from un-opened laptops and PC
Main Forensic Imaging Mode Features:
-
- Forensic Imaging Modes: Mirror Imaging bit by bit (100% or any % of the drive), DD, E01/Ex01 – with optional compression, Selective Capture(Capture Partitions, Files and Folders and with the use of file extension filters), Mix-Format of DD/E01/Ex01
- Targeted Imaging: Some time the forensic investigator does not have the time to do a full data capture of the Suspect drive. Now he/she can use the Selective Imaging feature to select only partitions, files, or folders (like the Windows user folders or Windows User- Documents and User-Pictures). With the use of pre-set file extension filters or add its own filter, the Forensic investigator, can narrow it capture scope and shorten is the acquisition time.
- Hash while capture: MD5, SHA-1, SHA-2 (all 3 can be selected simultaneously)
- Erase The Reminder of the drive, after the copy
- Encryption/Decryption
Reviews
There are no reviews yet.