MediaClone SuperImager Plus 8” Portable Forensic unit with NVMe SATA mix ports with 2 NVMe ports and 2 SATA ports + 4 e-SATA ports

More Views

MediaClone SuperImager Plus 8” Portable Forensic unit with NVMe SATA mix ports with 2 NVMe ports and 2 SATA ports + 4 e-SATA ports

Availability: In stock

SuperImager Plus 8" NVMe + SATA Forensic Field unit with 5 SATA3 ports, 8 USB3.0 ports, 2 NVMe ports, and one Thunderbolt 3.0 port: The unit includes U.2 to M.2 NVMe adapters that enables capturing NVMe SSD at top speed of 65GB/min. It is a top performance Field Computer Forensic Imaging tool and Complete Digital Forensic Investigation platform. The user can run multiple parallel simultaneous forensic imaging from many devices, with 3 HASH values, and with encryption on the fly.



MediaClone SuperImager Plus 


The SuperImager® Plus 8” NVMe + SATA Forensic Field Unit - is a mobile, compact, easy to carry, versatile, and extremely fast Forensic Imaging unit that can serve as a complete Field Computer Forensic Investigation platform. The unit is running under Linux Ubuntu OS with a dual boot to Windows 8.1. The unit has a built-in 2 extremely fast NVMe ports, 2 SATA ports with power, one e-SATA port, one Thunderbolt 3.0 port (40Gigabit/s), 8 USB3.0 ports and is supplied with 2 NVMe U.2 to M.2 adapters and 2.5" NVMe cables. The unit is supplied TB3.0 to PCIE Expansion Box with 4 e-SATA ports, Remote capture KIT and Virtual Emulators option are enabled. 
The unit can be used to perform: 
  1. Multiple parallel simultaneous Forensic Capture using bit by bit, DD, E01/Ex01(with full compression), Mix E01/DD formats, copy the whole drive or only one partition. Copy to 1:6/2:4/3:3 for SATA drives1:1 NVMe drives or any mix between the 2 NVMe ports to 7 SATA ports or 8 USB3.0 ports
  2. Run a Selective Imaging (Targeted Imaging) of files, folders, partitions with file extension filters
  3. Select to capture only partition instead of the whole drive.
  4. Erase data from Evidence drive using DoD (ECE, E), or Security Erase, or Enhanced Security Erase protocols
  5. View the CAPTURED data directly on Ubuntu Desktop Screen or Windows
  6. Encrypt the data while capturing (AES256)
  7. HASH the data while capturing (run all the 3 HASH engines at the same session SHA-1, SHA-2, MD5)
  8. Run Cellphone/Tablets data Extraction and Analysis
  9. Prepare Forensic Triage keys and view the captured targeted data
  10. Run a quick Keyword Search on the Suspect drive, prior to capture, or run a full keyword search while capturing
  11. Run a full Forensic Analysis application like Encase/Nuix/FTK
  12. Run a Virtual Drive Emulator (This option is enabled on this unit)
  13. Use the Remote Capture application to capture data from un-opened Laptops with Intel-based CPU, Tablets, and PC (Supplied with this unit)
  14. Use the Thunderbolt 3.0 port to capture data from USB3.1 storage devices, Mac via Thunderbolt 2/3 port or 1394 port
Case Study: Some example of the unit’s performances: 
  1. Complete HASH verification operation with SHA-1 enabled on SSD @ 31GB/min, on WD 1TB Blue @10GB/min.
  2. Complete Forensic Imaging 1:2 with SHA-1 enabled on 3 SanDisk Extreme II 120GB SSD @ 29GB/Min
  3. NVMe Forensic Imaging: 1:1 using Samsung MZVPV512HDGL NVMe SSD as Evidence drive, speed reach 93.7GB/min
  4. Complete Forensic E01 Imaging from 2TB WD2003FZEX with compression level 9, SHA-1 and MD5 are enabled, HASH the Evidence and compare is enabled @ 11GB/min

The unit built-in: 8” Touchscreen color LCD display, 2 SATA ports data and power, 2 NVMe ports (2.5"), 8 native USB3.0 ports, one e-SATA port, 1Gigabit/s Ethernet ports, Display port, Thunderbolt 3.0 port, and audio ports. The unit is supplied with 2 U.2 to M.2 NVMe external adapters and Thunderbolt 3.0 to PCIE Expansion Box with 4 port e-SATA controller (4 lanes)
The SuperImager Plus 8” NVME + SATA Forensic Field Unit as Forensic Imaging Tool: In one read pass from the "Suspect" Drive, the SuperImager Plus application can run the following operations simultaneously: Forensic Imaging with E01 format and with full compression, Encryption with AES256, simultaneously calculate 3 HASH Verification and Authentication values (MD5, SHA1, SHA2), and saving the captured Forensic Images to 2 “Evidence” drives, to a local network, and to external compact USB3.0/e-SATA TB RAID encrypted storage. The basic Forensic Imaging mode can be 1:1, 1:2, 1:3, 1:4, 2:2 2:3 up to 3:3 for SATA, and 2:4 for USB3.0 storage devices, or 1:1 NVMe

The Unit as Complete Forensic Platform: 
In addition, the unit can serve as a platform for a Forensic investigator to run a complete investigation and to perform:
1) Cellphones and Tablets Data Extraction and Analysis 
2) Forensic Triage Data Collection
3) A complete Computer Forensic investigation Analysis with applications such as Nuix, FTK, EnCase 
4) Virtual Drive Emulator: Mount a Suspect drive or it's DD/E01 images, simulate in its native Windows Environment, and extract important files 

The Unit as Data Eraser: 
Supports erase protocols that are NIST 800-880 compliance: 
  1. DoD 5220-22M (ECE, E),
  2. Security Erase, and Enhanced Security
  3. Erase User Mode
Dual Boot: The unit is running Ubuntu OS for forensic imaging and virtual drive emulator purpose. The unit is supplied with dual boot to Windows 8.1 when user intend to install and use third-party applications to perform data analysis, cellphone data extraction and more 

Network Multiple Forensic Images Loader
- Besides the ability of the application to upload forensic images (DD, E01) to the network via the 1Gigabit/s network port, there is also a unique feature/solution that can solve the streaming bottleneck by using a single port. With this solution, the user can upload many Forensic images directly to a local network using 7 equivalent 1Gigabit/s network streams

Expansion Box an important: Since the unit has a fast Thunderbolt 3.0 port (up to 40Gigabit/s), an important option is the Thunderbolt to PCIE 3.0 Expansion box. That enable the user to add different storage controllers and capture data from other storage protocols, such as SAS, SCSI, FC. In addition, the user can add 10Gigabit/s Ethernet for faster network connection.
    SuperImager Plus 8" NVMe + SATA unit with i7 CPU, 16GB Memory, and S/W Version 1.8.7
    Hash Verification/ Authentication Only (Reading Speed) Avg Speed GB/Min
    HASH single drive, in a single session (Samsung 850 EVO SSD)
    SHA-1 30.6
    MD5 30.6
    SHA-1+ MD5 30.6
    HASH 2 drives in 2 separate sessions (2 Samsung 850 EVO SSD)
    SHA-1 + MD5 drive 1 26.2
    SHA-1 + MD5 drive 2 26.6
    HASH single drive, in a single session (Intel 750 NVMe 400GB)
    SHA-1 64.0
    SHA-1 + MD5 64.0
    Wipe Drives (Write Speed) (Samsung 850EVO SSD)
    Security Erase Mode 30.0
    Single Pass - User Erase Mode 28.8
    Forensic Imaging
    100% bit by bit Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD
    with SHA-1+ MD5 HASH on 28.5
    DD Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD (2GB Files Chunks and NTFS)
    with SHA-1 + MD5 HASH on 29.1
    DD Imaging SanDisk Extreme II SSD to Samsung 850 EVO SSD 2 GB file Chunks and NTFS)
    with SHA-1 + MD5 HASH on 28.5
    E01 Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD (2GB Files Chunks and NTFS)
    with SHA-1 + MD5 HASH on 24.2
    • Main Hardware Features:
      • Case: Mobile and easy to carry
      • CPU: i7 7th Generation
      • Display: 8" (800x600) LED backlight Touchscreen color LCD display
      • Hardware: Very high-quality high performing components
    • The Unit’s Port:
      • 2 SATA ports (1 source and 1 targets data and power)
      • 2 NVMe ports (1 source and 1 targets data and power)
      • 8 USB3.0 – (2 source and 4 targets- Also all those ports can be used as a host to plug and use keyboard, mouse and other peripherals)
      • 1 Thunderbolt 3.0 Port – can be used for USB3.1, TB monitor, Thunderbolt Expansion Box (40gigbit/s)
      • 5 e-SATA port (One connected directly to the motherboard and 4 others are on the TB 3.0 Expansion Box- all are configured as targets)
      • 1 Gigabit/s Port
      • 1 Display Port
      • 1 HDMI port – Shared between internal display and an external use