The SuperImager® Plus 8” 5 NVMe +5 SATA/SAS Forensic unit is a Portable forensic imager with the ability to perform multiple Forensic tasks, allowing the Forensic investigator to capture data in the field from multiple source drives to multiple target drives simultaneously and extremely fast (100GB/min). It also enables the user to perform a full Forensic analysis in the field using encase, Nuix application for Windows 10, or capture data from multiple cellphones and run cellphone analyses, or use any third-party Windows application. The unit is compact and easy to carry, with built-in 4 ports of NVMe (U.2), 1 e-SATA port, 8 ports of USB3.0, 1 port of Thunderbolt 3.0 (40Gigabit/s), and it is supplied with a Thunderbolt 3.0 Expansion box with 4 SAS ports, and with 1 M.2 NVMe controller plugged in the expansion box.

The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, and Linux-DD.

 

Here are some of the tasks the unit can be used for:

 

1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only parts. Copy 1:4 for SATA drives, 1:4 NVMe drives, or any mix between the 5 NVMe ports to 5 SATA ports or 8 USB3.0 ports.

2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extensions filters.

3) Erase data from Evidence drive - using DoD (ECE, E), Security Erase, NVMe Secure Erase, or Sanitize erase protocols.

4) View the data directly on the Ubuntu Desktop screen.

5) Encrypt the data while capturing (using the AES256 engine).

6) HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.

7) Run a quick Keyword Search on the Suspect drive prior to capture.

8) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.

9) Run Forensic Triage application using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.

10) Run a full Forensic Analysis application like Encase/Nuix/FTK.

11) Run Virtual Drive Emulator prior to the data being captured on the Linux side (this option is enabled on this unit).

12) Run Remote Capture from unopened laptops - Intel Based CPU (supplied with this unit).

13) Use the Thunderbolt 3.0 port to capture data from USB3.1 storage devices, Mac via Thunderbolt 2/3 port or 1394 port.

14) New feature - Use the SuperImager unit as a “Write Blocker” device: This new feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.

A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode.

The SuperImager unit will be connected to the same network and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as: SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

 

Additional operations that are available include HASH a drive, drive diagnostics, and scripting.

 

The application supports forensic imaging of multiple drives, in multiple sessions, in simultaneous forensic imaging runs.

 

The unit is supplied with 4 NVMe U.2 to M.2 adapters, 2.5” NVMe cables, and a TB3.0 to PCIE Expansion Box with 4 e-SATA ports, 1 M.2 PCIE controller, Remote capture KIT, and Virtual Emulators option is enabled.