MediaClone SuperImager Plus 8" Portable 5 NVMe + 6 SATA/SAS Forensic Imaging Unit with Thunderbolt Port

The SuperImager® Plus 8” 5 NVMe + 6 SATA/SAS Forensic unit Forensic Imaging 8” Portable Field unit with 5 NVMe, 6 SATA/SAS*, e-SATA, USB3.2 Gen 2x2, USB3.2, and 2 Thunderbolt 4.0 ports. It is one of the top performance Field Computer Forensic Imaging tools and a Complete Digital Forensic Investigation platform. It is configured with Dual Open OS of Linux for Forensic fast imaging and Windows 11 for full forensic analysis, cellphone data extraction, and triage data collection. The unit is built with one e-SATA port, 4 U.2 native NVMe power & data ports, 9 USB3.2 ports, 2 Thunderbolt 4.0 ports, and supplied with one M.2 NVMe PCIe controller + 4 SAS ports controller installed in the TB 3.0 Expansion Box. Under Linux, the user can run multiple parallel simultaneous forensic imaging capture (mirror image, a single partition capture, Linux-DD, EnCase, mix E01/DD, VHD, Triage capture of Files and Folders) with 4 HASH values(MD5, SHA1, SHA2, SHA-512 run all the four at the same time), encryption AES256 XTS, compression, keyword search all on the fly and save images to a network.

As a platform using Win11, the unit can be used to perform full forensic analysis, cellphone data extraction, Triage data collection, and more. The top speed recorded imaging NVMe SSD can reach up to 160GB/min. The unit hardware is very robust, running i7 11 generation CPU and with 32GB of memory.

The unit supplied with:

• Remote Capture KIT
• Virtual Emulator (viewing the Suspect drive before the capture).
• 4 U.2 Extension Cables.
• 4 U.2 to M.2 NVMe adapters.
• Thunderbolt 3.0 to PCI-E Expansion Box with 4 SAS ports controller + U.2 & M.2 NVMe controller. (The Thunderbolt Expansion Box brings a lot of additional connectivity)

Main Ports:

• e-SATA port: Two ports on the main unit
• 4 SAS/SATA ports: 4 ports on the TB 3.0 Expansion Box (only data)
• 5 NVMe ports: 4 U.2 NVMe on the main unit (power & data) and one M.2 NVMe port on the TB 3.0 Expansion Box, with optional of additionall NVMe port using the second TB 4.0 port and adapter.
• 2 TB4.0 ports
• USB3.2 Gen2x2 (USBc3) + 8 USB3.2 ports
• The Thunderbolt Expansion box brings a lot of additional connectivity.

Important Options are: Thunderbolt 3.0 to 10GbE adapter and the Mac/Thunderbolt acquisition kit.
The main difference between this unit and the SuperImager® Plus 8" Portable Forensic Unit with 3 NVMe + 4 SATA/SAS ports: The number of NVMe ports on the main unit.

The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, Mix DD/E01, AFF4, capture a single partition,Triage of Files and Folders.

Some of the tasks the unit can be used for:

1. Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, AFF4, copy the whole drive or only parts. Copy 1:5 for SATA drives, 1:4 NVMe drives, or any mix between the 5 NVMe ports to 6 SATA ports or 11 USB3.2 ports.
2. Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters.
3. Erase data from Evidence drive - using DoD (ECE, E), Security Erase, NVMe Format with Secure Erase, or Sanitize Erase protocols.
4. View the captured data directly on the Ubuntu Desktop screen.
5. Encrypt the data while capturing (using the AES256 XTS engine).
6. HASH the data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines simultaneously.
7. Run a quick Keyword Search on the Suspect drive before capture.
8. Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
9. Run the Forensic Triage application using third-party applications on (Windows 11), and view the captured data.
10. Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom.
11. Run Virtual Drive Emulator before the data was captured (Linux).
12. Run Remote Capture from unopened laptops - Intel-Based CPU/Mac CPU.
13. Use the Thunderbolt 4.0 port to capture data from USB3.2 storage devices, Mac via 1394 port, or connect to 10GbE network with the use of TB3.0 to 10GbE adapter.
14. Unlock drives with ATA pass-code, BitLocker pass-code, Opal pass-code for SED drives, and VerCrypt.
15. Use the unit as a “Write Blocker” device: This feature enables the unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection. A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Write block mode. The SuperImager unit will be connected to the same network, and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

Additional operations: HASH authentication, Restore a Drive, Drive Diagnostics, Erase Evidence drive before use, and automation of processes using scripting. The application supports simultaneous forensic imaging of multiple drives in multiple sessions.

The main difference between using a product with U.2 port (and with Extension cables) vs. using M.2 port and plugging the media directly into the port: NVMe U.2 port is more versatile and can support three types of NVMe SSD: M.2, U.2, PCIE NVMe storage controller, while M.2 port is limited to M.2 SSD. Using the U.2 Extension cables protects the unit's NVMe port from overuse and many insertions by plugging the SSD directly into the unit's port and damaging the port. Competitors that use NVMe M.2 ports are limited with their supports (Only M.2), and force the user to plug the media directly into the port. The U.2 extension cables are very durable and built with high quality and precision, and they exhibit an extreme transfer rate of over 200 GB/min.

The SuperImager application is optimized to achieve extreme top speeds when using NVMe SSD: HASH SHA-1 131GB/min, Mirror Image 187GB/min, Erase + Verify 130GB/min, Verify 165GB/min