MediaClone SuperImager Plus Desktop NVMe + SAS/SATA Standalone Multiple Drives Forensic Imaging Unit

The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, AFF4, capture a single partition, Mix E01/DD format, Triage of Files and Folders.

Here are some of the tasks the unit can be used for:

1. Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, AFF4, copy the whole drive or only parts.
2. Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters and with the file's metadata and HASH each file (for example, run E01 capture of 2 parallel simultaneous sessions using 4 NVMe SSD and 16 CPU compression engines). Also, run simultaneously logical data extraction from multipe smartphones.
3. Perform Forensic Imaging from many Suspect drives to one large Evidence drive; in append mode.
4. Upload many Forensic images to a network (SMB, CIFS, NFS).
5. Erase data from Evidence drive - using DoD (ECE, E), Security Erase, NVMe Secure Erase, or Sanitize Erase protocols.
6. View the data directly on the Ubuntu Desktop screen.
7. Encrypt the data while capturing (using the AES256 XTS engine).
8. HASH the data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines simultaneously.
9. Run a quick Keyword Search on the Suspect drive before capture.
10. Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 11 side.
11. Run a Forensic Triage application(Win) to capture and view the important Suspect data.
12. Run a full Forensic Analysis application like Encase/Nuix/FTK.
13. Run Virtual Drive Emulator (Linux).
14. Encryption and Decryption on the fly of drives that contain sensitive information.
15. Easily reconfigure the unit’s ports, where each target port can be configured as a source or target, enabling the user to run 4:4 sessions or eight image uploads to a network.
16. Convert the unit’s 8 USB3.2 ports to SATA ports and run more parallel sessions (using some USB3.0 to SATA adapters).
17. Use the SuperImager unit as a “Write Blocker” device: This feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.

A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Write block mode.

The SuperImager unit will be connected to the same network where the user is connected, and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

The unit is designed to help expedite the forensic imaging process, especially in facilities with a large backlog in imaging drives, by performing parallel forensic imaging in a true optimized multiple session's application.

The advantage of this unit is that it supports imaging from mixed media of SATA, SAS, USB, and NVMe SSD.

Additional operations: HASH authentication, drive diagnostics, and automation of process using scripting.

NVMe U.2 port is more versatile and can support three types of NVMe SSD: M.2, U.2, PCIe NVMe storage controller, while M.2 port is limited to M.2 SSD. Using the U.2 Extension cables protects the unit's NVMe port from overuse and many insertions by plugging the SSD directly into the unit's port and damaging the port. (It is easier to replace an extension cable than the interface board of a damaged port!). Competitors that use NVMe M.2 ports are limited with their supports (Only M.2), and force the user to plug the media directly into the port. U.2 extension cables are very durable and built with high quality and precision, and they exhibit an extreme transfer rate of over 200 GB/min.