SuperImager^® Plus 8” T4 Portable Forensic 3 NVMe + 4 SAS/SATA (12Gb/s PCIE 4.0) ports

SuperImager Plus 8” T4 Portable Forensic Imaging Unit with Thunderbolt and NVMe ports - Dual Open OS unit is a forensic imaging device with the ability to perform in the field multiple Forensic tasks, allowing the Forensic investigator to simultaneously capture data from various source drives to multiple targets drives with 4 HASH values(MD5, SHA1, SHA2, SHA512 at the same time), image verification at extreme fast speed. It also enables the user to perform a full Forensic Analysis in the field by using EnCase, Nuix, Axiom, or any other analysis application for Windows 11, and perform physical data extraction from multiple cellphones. The unit is compact and easy to carry, with built-in 4 SAS/SATA ports (with a secure connector), two e-SATA ports, 9 USB3.2 ports(6 Gen2, 2 Gen1,1 Gen2x2), two Thunderbolt 4.0 ports (40 Gigabit/s can be use for 2 NVMe SSD), and it is supplied with a Thunderbolt 3.0 Expansion box with 1394A/B controller, NVMe U.2/M.2 solution. Additionally, the Thunderbolt 4.0 ports and the Thunderbolt 3.0 Expansion box allow the user to capture data from Mac (using the optional Mac Acquisition Kit supports for Mac with T1/T2 and M1/M2), save captured images to a network via 10Gigabit/s Ethernet, or capture data from legacy drives such as SCSI, FC.
The unit is supplied with TB4.0 to NVMe fast adapter provides the unit with the second and third NVMe ports.

The unit performs with an extreme speed of 31GB/min with imaging SATA to SATA SSD, 165GB/min with mirror imaging NVMe SSD, 51.2GB/min mirror imaging SATA to external NVMe, 47.6GB/min Ex01 Imaging with full compression SATA to SATA SSD.

The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, E01/DD mix, AFF4, a single partition, and Files and Folders as a Triage operation.

Here are some of the tasks the unit can be used for:

1. Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, AFF4, copy the whole drive or only partitions, (no limitation on the number of parallel sessions).
2. Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters and copy the metadata of each file.
3. Erase data from Evidence drive prior to the capture - using DoD (ECE, E), Security Erase, Enhanced Security Erase, Sanitize Erase, NVMe- Format, USER-Erase protocols.
4. View the Captured data directly on the Ubuntu Desktop or Windows screens, in a secure enviroment.
5. Encrypt the data while capturing (using the AES256 engine) and decryption at the destination with the use of MediaClone utility.
6. Simultaneously HASH data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines simultaneously.
7. Run a quick Keyword Search on the Suspect drive before imaging or during the imaging.
8. Simultaneously run multiple Smamrtphones/Tablets logical data extraction usining the SuperImager application. Run cellphone physical data extraction and full forensic analysis using a third-party application (Windows 11).
9. Run Forensic Triage application: Capture files and folders using the MediaClone application or using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.
10. Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom (Windows side).
11. Run Virtual Drive Emulator before the data capture (Linux), preview the "Suspect" data, and copy important files and folders.
12. Run Remote Capture from unopened laptops - Intel Based CPU (supplied with this unit).
13. Use the native Thunderbolt 4.0 ports (40 Gigabit/s) to capture data from USB3.2 Gen-2 storage devices, or connect to 10GbE network with the use of TB3.0 to 10GbE adapter.
14. Unlock and capture drives with ATA passcode, BitLocker passcode, Opal passcode for SED drives, and VeraCrypt.
15. Use the unit as a “Write Blocker” device: This feature enables the unit to function as a secure bridge between workstations on a network to Suspect drives attached to the unit by using the iSCSI protocol over a network connection.
16. Support for remote capture from Mac with M1/M2 CPU.
17. Run simultaneouly logical extration from many smartphones (Andriod, iPhones)
18. Use the TB4.0 to NVMe external adapter to capture data from more NVMe SSD or image NVMe to NVMe SSD.
19. Built-in extremely fast "Write-Blocking" hardware for “safe” data acquisition.

A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Writes-block" mode.

The SuperImager unit will be connected to the same network, and the Suspect drives will be attached to the unit in read-only mode. The unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

Additional operations: HASH authentication, Drive Diagnostics, Image Restore, Drive Erase of Evidence drive before use, and set automation processes with Scripting capabilities.

The SuperImage application supports simultaneous forensic imaging of multiple drives, in multiple sessions (we did invent this in 2013).

The unit is supplied with 4 SAS/SATA extension cables with power and data, Thunderbolt 3.0 to PCIe Expansion Box with U.2 to PCIe NVMe controller and U.2 to M.2 NVMe adapter, 1394A/B controller, Remote capture KIT, Virtual Drive Emulators, M.2 SATA adapters, MSATA adapters, MicroSATA adapters and USB3.2 2x2 tp NVME adapter.