MediaClone SuperImager Plus 8" Portable 3 NVMe + 3 SATA + 4 SAS Forensic Imaging Unit with Thunderbolt Port

The unit is Portable, Compact, easy to carry, and extremely fast. It is built with 2 NVMe U.2 data & power ports, 2 SATA3 data & power ports, one e-SATA port in the back of the unit, 8 USB3.2 ports, one USB3.2 Gen 2x2 USBc port, and two Thunderbolt 4.0 ports.

The unit is configured with Dual Open OS of Linux for fast, efficient Forensic imaging and Windows 11 for running full Forensic Analysis (EnCase, Nuix, Axiom, and others), cellphone data extraction(Cellebrite, MASB, and others), and triage data collection. Using the Linux OS, the user can run: multiple,simultaneous independent forensic imaging sessions (mirror image, image a single partition, Linux-DD, EnCase, mix E01/DD, VHD, Triage with Files and Folders) with 4 HASH values(MD5, SHA1, SHA2, and SHA512 run all the four at the same time), encryption AES256 XTS, compression, keyword search all on the fly and save images to a network.

The max speed achieved: 31GB/min SATA SSD, 187GB/min NVMe SSD.

The unit hardware is robust, running i7 13 generation CPU with 32GB of memory, 1TB SSD, and 8” LCD display.

Main ports:

• 3 SATA ports: 2 SATA ports (power & data) and one e-SATA port on the main unit
• 4 SAS/SATA ports: On the TB3.0 Expansion Box
• 3 NVMe ports: 2 U.2 NVMe nativ eports on the main unit (power & data), one U.2 & M.2 NVMe port on the TB3.0 Expansion Box, and addition NVMe port (#4) with the use of the second TB4.0 port with fast USB3.2 Gen2x2 to NVMe adapter.
• 2 TB4.0 ports
• 1 USB3.2 Gen2x2 (USBc) port, and 8 USB3.2 ports

The unit supplied with:

• Remote Capture KIT
• Virtual Emulator (viewing the Suspect drive before the capture).
• 2 U.2 Extension Cables.
• 2 U.2 to M.2 NVMe adapters.
• Thunderbolt 3.0 PCI-E Expansion Box with 4 SAS ports controller, split cables, power cables, and with U.2 and M.2 NVMe controller.

The Thunderbolt 3.0 Expansion box brings a lot of additional connectivity.

Thunderbolt 3.0 to 10GbE adapter and the Mac/Thunderbolt acquisition kit are important options.

To compare this unit to other MediaClone Portable units that support NVMe: SuperImager Plus 8” T3 unit has one NVMe port, and the SuperImager Plus 8” with mix 5 NVMe + 5 SAS/SATA has 5 NVMe ports.

Here are some of the tasks that the user can do:

1. Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD format, E01/Ex01 format (with full compression), Mixed-Format DD/E01, Single partition, copy the whole drive or only parts. Copy 1:6/2:4/3:3 for SATA drives, 1:1, 1:2 for NVMe SSD, 2:2 for SAS drives, or any mix between the 3 NVMe ports to 7 SATA/SAS ports or 11 USB3.2 ports.
2. Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters and save HASH and metadata of the files.
3. Erase data from the Evidence drive before use - using DoD (ECE, E), Security Erase, NVMe Secure Erase, Sanitize, or User-Erase protocols.
4. View the Suspect drive directly on the Ubuntu Desktop screen using the virtual drive emulator.
5. Encrypt the data while capturing (using the AES256 XTS engine) and decryption at the destination using MediaClone utility
6. HASH the data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines, simultaneously.
7. Run a quick Keyword Search on the Suspect drive before or during the capture.
8. Run Multiple Cellphones/Tablets data Extraction and Analysis using a third-party application on the Windows 11 side.
9. Run the Forensic Triage application with selective capture mode or with the use of a third-party application on the Windows 11 side.
10. Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom.
11. Run Virtual Drive Emulator to view the Suspect drive before captured (Linux)
12. Run Remote Capture from unopened laptops - Intel-Based CPU (supplied with this unit).
13. Use the Thunderbolt 4.0 port to connect to 10GbE network with the use of TB3.0 to 10GbE adapter.
14. Unlock drives with passcode such ATA, BitLocker, Opal for SED drives, and TruCrypt.
15. Use the SuperImager Plus unit as a “Write Blocker” device: This feature enables the unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit and by using the iSCSI protocol over a network connection. A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Writes-Block safe mode. The unit will be connected to the same network, and the Suspect drive will be attached to the unit in read-only mode. The unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

Additional operations: HASH authentication, Drive Diagnostics, Evidence drive erase before use, image restores from DD/E01, and automation with scripting.