Description

The SuperImager® Plus Desktop NVMe Forensic Lab Unit is a heavy duty, industrial, and extremely fast Forensic Imaging unit that captures data from multiple sources to multiple target drives. The unit is running under Linux Ubuntu OS. It easy to use with many built-in features that help the user to automated imaging or uploading.

Key Features:
The unit hardware: i7 – 7th generation CPU, 32GB Memory, 250GB SSD internal storage, with 8 NVMe SFF-8639 ports and 10 USB3.1 (10Gigabit/s) ports, Ubuntu 18.04LTS OS with a dual boot of Linux and Win10 Prof. The unit supplied with 8 SFF-8639 to M.2 NVMe cables and adapters and with secure brackets. (The top speed reading from an NVMe SSD is 97GB/min).
Main Usage: For imaging a large volume of NVMe SSD.
Application using Ubuntu open OS: Multi-tasks, truly simultaneous multiple forensic imaging from one or many source ports to one or many target ports with different interfaces and options. Like imaging 1:7, 4:4, 8 to a network of NVMe SSD drives using a mirror image, DD, E01 compressed, mix mode and more. Also, the user can select to run in one imaging session 3 HASH engines (SHA1, SHA2, MD5), AES256 encryption and a quick keyword search on the fly at amazing speeds.

Usage: Under the Linux OS: Full Forensic imaging, HASH, Erase and Format, Virtual Emulator, Remote Capture, Encrypt, Decrypt, Keyword Search before or while the imaging, Scripting.

Under Windows 10 Pro: Load and use any third-party applications to perform: Full Forensic analysis (EnCase, Nuix, Magnet), Multiple Cellphone data extractions (Cellebrite, MSAB, Paraben) using the unit’ fast USB ports.

The user can use to the unit to:

• Forensic Imaging: E01/Ex01 format and with full compression, DD, Mirror, Mixed format DD/E01, Selective Imaging of files and folders using file extension filters (for example run E01 capture of 4 multiple parallel sessions using 8 NVMe SSD and with 16 CPU compression engines).
• Imaging of many to one: Perform Forensic Imaging from many Suspect drives to one large Evidence drive, in append mode.
• Upload Images to network: Upload many Forensic images to a network (SMB, CIFS, NFS).
• Erase: Erase data from many drives simultaneously using DoD(ECE, E), Security Erase, Enhanced Security, Sanitize erase modes.
• View captured data: View the captured data directly on Ubuntu Desktop.
• Virtual Drive Emulator: boot, mount and view the Suspect drive in its native environment (mount raw drive or DD/E01 drive image), and extract important files into Evidence drive or any external storage(SATA drives).
• Encryption and Decryption on the fly of drives that contain sensitive information.
• Unit’s Port Role: Easily reconfigure the unit’s ports, where each of the target port can be configured as source or target for running 4:4 sessions, or to run 8 uploads to network.
• USB to SATA adapters: Convert the unit’s 8 USB3.0 ports to SATA ports and run more parallel sessions (with the use of some USB3.0 to SATA adapters).
• Network: use the unit’ 2 Thunderbolt 3.0 ports (USB-c 10gigabit/s) to connect TB3.0 to PCIE 3.0 compact Expansion Box to supports other types of media.
• Use the unit’s two 1Gigabit/s and one 5Gigabit/s native network ports to increase upload speed of DD/E01 images

The unit is designed to help expedite the forensic imaging process, especially in facilities where there is a large backlog in imaging drives by performing many parallel forensic imaging in a true optimized multiple session’s application.

The Unit Built-in: 8 native NVMe ports in a 8 open tray drive caddy, 8 native USB3.0 ports, 2 USB 3.1 ports, 2 Thunderbolt 3.0 ports(USB3.1), e-SATA port, 3 Generic USB2.0 port, Two of 1Gigabit/s Ethernet port, one of 5Gigabit/s port, HDMI port, DP port.

The Unit as Forensic Imaging Tool: In one read pass from the “Suspect” drive, the application can run the following operations simultaneously: Forensic Imaging with E01 format and with full compression, Encryption with AES 256, simultaneously calculate 3 HASH Verification and Authentication values (MD5, SHA1, SHA2), and Saving the captured Forensic Images to many destinations such us 1) Two “Evidence” drives 2) Network 3) External compact USB3.0/e-SATA TB RAID encrypted storage 4) NAS. In addition, the user can run (optional) Virtual Drive Emulator to browse the Suspect drive under Windows, transfer and copy important files from the Suspect drive to any destination drives.

The Unit as Data Eraser: Supports DoD and Security Erase, Enhanced Security, Sanitize, User erase protocols that are NIST 800-88 compliance.