The SuperImager Plus Portable Rugged Portable Digital Forensic Lab with 10GbE is a forensic imaging device that can serve as a complete Field Computer Forensic Investigative platform. The unit built with 15.6″ LCD, 4 SAS/SATA ports (12Gb/s PCIE 4.0), 4 U.2 NVMe ports(PCIE 4.0), one e-SATA port, 2 Thunderbolt 4.0 ports, 8 USB 3.2 ports, one 10 GbE port, and extremely fast “write-blocking” hardware. It is configured with Dual Open OS (Linux for fast imaging/Win11 for forensic analysis and cellphone data extraction); under Linux, the user can run multiple parallel simultaneous Forensic Imaging (mirror image, image a single partition, Linux-DD, EnCase, mix E01/DD, VHD, Triage of Files and Folders-include cellphones), with 4 HASH values (MD5, SHA1, SHA2, and SHA512 run all the four at the same time), encryption, compression, keyword search all on the fly and save images to a RAID or a network. Under Win 11 the user can perform a full Forensic analysis using third-party applications like EnCase, Nuix, Axiom, and other apps, cellphone data capture using Cellebrite, MSAB, and Oxygen apps, RAID reconstruction, network analysis, and data recovery using R2 Studio.

The unit hardware is very robust, running i7 CPU (5.0 GHz, 12 Cores), the 15.6″ large display helps visualization when running a full Forensic analysis software, and the rugged case makes it easy to carry when traveling.

Total ports:

• one e-SATA port on the main unit

• 4 SAS/SATA ports (In a drop drive socket) supplied with power & data (12Gb/s, PCIE 4.0)

• 4 NVMe ports (PCIE 4.0): 4 native U.2 NVMe ports, including 4 M.2 to U.2 vertical adapters with special and easy SSD locking mechanism, U.2 Extension cables, and secure brackets supporting all the three (U.2, M.2, PCI-E) NVMe SSD

• 7 USB3.2 Gen2 (10Gigabit/s), 1 USB3.2 Gen1 ports

• 2 Thunderbolt 4.0 ports: One TB4.0 port can be used with supplied TB to HDMI adapter to plug the unit to external monitor, the other TB4.0 port can be used to plug optional TB3.0 to PCIE Expansion box supporting legacy drives such as FC/SCSI/1394, or adding 4 more of SAS/SATA ports, or pluging 10GbE Adapter if user need one more 10GbE port.

The unit’s main purpose is to run simultaneous multiple Forensic imaging onsite for capturing data from SAS/SATA/USB/NVMe drives in a cross-media capture and Upload the images to a local network. The second purpose is to complete the Forensic investigation onsite by performing a full Forensic analysis of the captured data, cellphone data extraction and more tasks

The unit supplied with:

• Remote Capture KIT.

• Virtual Emulator (for viewing the Suspect drive before the capture).

• Mac/Thunderbolt kit – Capture from Mac with TB2/TB3, 1394 ports (M1, M2)

Some speed tests:

SATA to SATA Linux-DD copy max speed 32.7GB/min.

NVMe to NVMe mirror image max speed 187GB/min. (see attached pictures)

The SuperImager’s main application (the unit’s software) supports many imaging operations. Here are some of the tasks that the user can use it for:

1) Multiple Parallel Forensic Imaging: Supports Mirror Copy (bit by bit), Linux-DD copy , E01/Ex01 (with full compression) copy, Mixed-Format DD/E01, Select and image a single partition, and Selective Capture (copy files and folders with the use of file extension filters, including HASH of each file and capture of each file metadata).

2) Erase data from Evidence drive: Using DoD (ECE, E), Security Erase, NVMe Format, and Sanitize Erase protocols.

3) View the data directly on the Ubuntu Desktop screen.

4) Encrypt the data while capturing (with AES256).

5) HASH the data while capturing – run the four MD5, SHA-1, SHA-2, and SHA512 HASH engines simultaneously.

6) Run a quick Keyword Search on the Suspect drive before capture.

7) Run 8 Cellphone/Tablet logical data Extraction.

8) Run a Forensic Triage application.

9) Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom.

10) Run Virtual Drive Emulator.

11) Run Remote Capture from unopened laptops (Intel Based CPU).

14) Unlock drives with ATA pass-code, BitLocker pass-code, Opal pass-code for SED drives

15) Built-in extremely fast “Write-Blocking” hardware for “safe” data acquisition.

16) Use the unit as a “Write Blocker” device: This feature enables the unit to function as a secure bridge between workstations on a network to Suspect drives attached to the unit by using the iSCSI protocol over a network connection. A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode. The unit will be connected to the same network, and the Suspect drives will be attached to the unit in read-only mode. The unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

17) Data Recovery: The SuperImager application has an extensive built-in mechanism to extract as much data as possible from bad, unreadable sectors. For more balancing between extracting time and extracting data, the SuperImager unit also supports the Linux R2 Studio Forensic suite, considered one of the best tools for data recovery.

Additional available operations: Erase verification on a drive that erased, Full or Quick Format, HASH a drive, drive diagnostics, and automated process with scripting. The application supports forensic imaging of multiple drives in simultaneous forensic imaging sessions. The Optional TB expansion box enables the user to connect to a 10 Gigabit/s network, to an external HDMI monitor, or to plug in additional optional storage controllers (SAS, SCSI, 1394, and FC) to support imaging from more storage devices.
The main difference between using a product with U.2 port (and with Extension cables) vs. using M.2 port and plugging the media directly into the port: NVMe U.2 port is more versatile and can support three types of NVMe SSD: M.2, U.2, PCIE NVMe storage controller, while M.2 port is limited to M.2 SSD. Using the U.2 Extension cables protects the unit’s NVMe port from overuse and many insertions by plugging the SSD directly into the unit’s port and damaging the port. Competitors that use NVMe M.2 ports are limited with their supports (Only M.2), and force the user to plug the media directly into the port. The U.2 extension cables are very durable and built with high quality and precision, and they exhibit an extreme transfer rate of over 200 GB/min.

The SuperImager application is optimized to achieve extreme top speeds when using NVMe SSD: Running HASH only of SHA-1 @ 132.5 GB/min, Mirror Image @ 189.3GB/min, Erase + Verify @ 137GB/min, Read @ 202GB/min, Linux- DD @ 151.5GB/min

Features

 

Example of a log file of NVMe to NVMe Linux-DD imaging session from WD 500GB M.2 NVMe SN850 to Corsair 2TB M.2 NVMe MP600 PRO

 

Example of a log file of NVMe to NVMe Mirror imaging session from Samsung 2TB M.2 NVMe 990 PRO to Corsair 2TB M.2 NVMe MP600 PRO

Technical Specs

SuperImager Plus Forensic Imaging Application Settings:

• HPA/DCO Automatic Supports: The application can detect HPA and DCO special areas on the Source drive. Then, resize the Source drive to its full native capacity to capture any “hidden data in those areas (HPA/DCO supported by some SATA drives).
• Bad Sectors Handling: The user can select to skip bad sectors, skip bad blocks, or abort the operations. The skipped, bad sectors will be displayed in the log file in detail or summary format.
• 48bit LBA Addressing: Supports drives with sizes up to 256TB.
• OS: Dual open OS of Ubuntu and Windows.
• Security: Imaging is done under the Linux OS (Linux is less targeted by malware).
• Application Updates: The application can easily be updated by using any of the unit’s USB ports and by a simple tap on the “update software” icon from the unit’ main menu.

Application Features:

• GUI: The application is built with large, easy-to-use icons. In a few clicks, the user can set up an operation.
• Speed: Extremely fast, it is one of the fastest Forensic Imaging solutions available on the market today, achieving a speed of above 32GB/min for SATA SSD and above 100GB/min for NVMe SSD.
  • Tested with the HASH verification operation with SHA-1, SSD ran at a top speed of 30GB/min and with 1TB WD Blue SATA-2 HDD ran at a top speed of 10GB/min.
  • Tested with the Forensic Imaging operation of 1 to 2 with SHA-1, 3 SSD of Samsung Pro 240GB ran a top speed of 32GB/min.
  • Tested with the Forensic Imaging operation of 1 to 2 with SHA-1, 3 SSD of Samsung NVMe 1 TB ran at a top speed of 100GB/min.

• Forensic Images – Destination: The user can save Forensic Images to any storage device attached to unit, or any connected network, using the unit’s 1 Gigabit/s port (or 10 Gigabit/s depend on the unit), or to any external USB3.0 RAID (encryption is optional), or to an external NAS storage.
• Cross Copy from unit’s ports: The user can select to capture from one port with one type of storage interface and save the forensic image onto a different storage interface using the unit’s destination ports.
• Audit trail and operation Log Files: Logs are generated automatically by the application and saved on the Evidence/Target drive in PDF format.

Application’s Main Operations:

• Forensic Imaging Mode includes Restore Images.
• Virtual Drive Emulator.
• Complete Forensic Platform.
• Data Erase and Format
• HASH Calculation Authentication and Verification
• Remote Capture and Network Supports

Forensic Imaging Mode:

• Full Drive Imaging
• Mirror imaging bit by bit (100% or any % of the drive), DD, E01/Ex01 – with optional adjustable compression level, Mix-Format of DD/E01/Ex01, Selective Capture (Capture Partitions, Files & Folders, with the use of file extension filters), Selecting a partition to capture.
• Forensic Restore: Back up the captured data (DD/E01/Ex01) into another drive in the original format.
  Targeted Imaging (Triage):
• Selective Imaging feature to select only partitions, files, or folders (like the Windows User-Folders or Windows User-Documents and User-Pictures). With the use of pre-set file extension filters or adding its filters, the Forensic Investigator can narrow their capture scope and shorten its acquisition time. In this mode, the application also supports calculating 4 HASH values (all the 4 at the same time) for each selected and captured file and saves its metadata. It supports capture from the “Suspect” drive that is formatted and mountable under Linux: FAT/eFAT/NTFS/EX2-4,/HFS+/HPFS/APFS.

Forensic Images Formats:

• 100% Bit by Bit Mirror Image.
• Linux-DD Format.
• Encase E01/Ex01 Formats (Includes options for optimizing the E01 compression by adjusting its level and the number of parallel engines).
• Mix-Format: The user can capture from one source drive and save the images onto multiple destination ports; each target port can be selected as one of the 3 E01/Ex01/Linux-DD formats.
• File-based copy: Copy files and folders using selective imaging with file extension filters, calculate 4 hash values for each file and capture the file’s metadata.
• Single partition Capture: Gives the user the ability to select only one partition (per session) to perform forensic imaging and save it into the Evidence drive in DD/E01/Ex01 format.

Imaging and Verify: The user can select to run forensic imaging with 4 HASH engines on the fly simultaneously (MD5, SHA1, SHA2, SHA512) and also enable the “HASH target and compare HASH” feature. That is a standard operation to ensure the captured image is not altered or corrupted.
Drive Spanning: Supports spanning the captured data onto multiple “Evidence” drives when the Evidence drives are not large enough (Supports restore images spanned over multiple drives).
Encryption: On-the-fly AES256 encryption of the “Suspect” drive, saving the encrypted data on the “Evidence” drive in 100%, DD, E01/Ex01 formats.
Decryption: The user can perform decryption on a drive that has previously been encrypted with any of the SuperImager units. Alternatively, the user can use a standalone MediaClone Linux decryption utility application to perform decryptions on an encrypted drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the MediaClone Linux decryption utility application, where the encrypted drive and a blank destination drive are attached to the PC (the user needs to supply to the utility application the saved encryption key). MediaClone developed its decryption utility application to ensure that the user can always decrypt the drive that was once encrypted via a MediaClone unit and not rely on TruCrypt or other third-party applications that might not be supported in the future.
Forensic Imaging Sessions: In one read-pass from the “Suspect” drive, the application can run the following operations simultaneously: Forensic imaging with E01 format and full compression, Encryption with AES256, 4 HASH Verification and Authentication values (MD5, SHA1, SHA2, SHA512), and save the captured Forensic Images to 2 “Evidence” drives to a local network, and external compact USB3.2/e-SATA TB RAID encrypted storage. The basic Forensic Imaging mode can be 1:1, 1:2, 1:3, 2:2, 2:3… The new Linux-based SuperImager Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations while performing at incredibly high speeds with E01/Ex01 formats and full compression. In addition, the application allows the user to manually select and adjust the number of CPU hyperthreading and the level of compression used during each session. Forensic data capture with Encase E01/Ex01 formats with full compression is widely used for operations in the forensic industry and generally requires a trade-off between speed, space, and time of decompression by the Encase application.

Data Eraser and Format:

• Erase the Evidence drive before use (with an extremely fast speed of up to 32GB/min with SSD and up to 11GB/min with HDD). The user also can select to erase the remainder of the drive after the copy.
• Drive Erase Protocols: DoD 5220-22M, Security Erase, Enhanced Security Erase, Sanitize, NVMe Secure Erase, or a User-mode where the user can define the final data filling pattern and the number of iterations (Security Erase, Enhanced Security Erase, Sanitize, and DoD erase protocols are all NIST 800-88 compliant).
• Quick or Full Format a drive: NTFS, FAT, HFS+, EXT4, and exFAT.
• Erase Verify: Run Erase Verify to verify that the drive was erased before use.
• Erase Logs and Erase Certification: The application generates extensive erase logs and files with an NIST 800-88 erase certification (also runs S.M.A.R.T. tests before and after the erase operation and is saved to XML file format), which can be exported to a USB thumb drive. The application also has a built-in erase database that can easily be exported to XLS.
• Evidence Drive Formats: exFAT/FAT/NTFS/HFS+/EXT4.

HASH Calculation Authentication and Verification as a Standalone Operation:
It simultaneously calculated 4 HASH values MD5/SHA-1/SHA-2/SHA512 on a captured drive for image no alter verification (This operation is different from the HASH calculation during the capture).

Network Supports:

• Network Capture: Data from a network folder can be captured and saved into “Evidence” drives using the iSCSI storage protocols. The application (for both capturing from a network and saving to a network) supports SMB, NFS, and CIFS network protocols. The capture can run with HASH authentication and HASH verification.
• Saves Forensic Images to Network: Upload multiple Forensic images to a local network (DD, E01) simultaneously by using 10 Gigabit/s port.
• Disable Network process and protocols for security reasons: Those network protocols are easy to disable using Ubuntu Preferences Tools.
• Copy lose files from/to the network: The user can copy files from/to a network with HASH authentication for better data integrity.
• Remote Capture (Intel based CPU): Capture data from the Internal Drives of an un-opened Laptop or Computer: Using USB or 1 Gigabit Ethernet ports on the laptop/computer enables the user to use the Remote capture application via a USB stick without the need to remove the drive from the laptop/computer or boot the laptop from its OS (the capture speed is limited to the performance of the Laptop/PC CPU and the 1 Gigabit/s connection). The Remote Capture Option Kit includes the USB flash drive, 1 Gigabit/s to USB3.0 Adapter, and a crossover network cable. The Remote capture application supports capture via USB/1394/TB/R45 network ports.

• Optional support for Mac with M1/M2 CPU: Remote Capture from Mac with M1/M2 chip (in beta testing), via network connection when the unit and the Mac are connected to the same network, or using network crossover cable, ( For Mac with Thunderbolt 3.0 and for a faster connection the user can use Thunderbolt to 10GbE adapters both on the the SuperImager unit and the Mac and with the use of a crossover network cable connected between them) .
• Capturing data from Mac with T1/T2: via the 1394 interface. The user needs to disable the security feature on the Mac and put the Mac in target mode. Then, connect the Mac to the optional Thunderbolt expansion box to the 1394 port. The Thunderbolt box needs to have an installed 1394 controller and be connected to the SuperImager Plus unit via the Thunderbolt 3.0/4.0 port. The Mac Kit is supplied with a 1394 B to B extension cable to be used with Mac with a 1394 port and Thunderbolt 2.0 to 1394 adapter to be used with Mac with a Thunderbolt 2.0 port.

Parallel Operations:

• Parallel Forensic Imaging – Multiple Session Operations: Improves the efficiency of the evidence data collection process by using multitasking and using a parallel imaging process. The user can take advantage of the SuperImager unit’s multiple available ports and run multiple, efficient, parallel operations. The user can mix different types of operations, and each operation can be set as a new independent session. An example of an operation: erase data from a drive connected to one port and HASH verify a different drive connected to the second port, all while performing forensic imagining of 1 to many on drives connected to the remaining ports.
• Port’s rule Increases Possibilities: The application is very flexible in running multiple sources to multiple destinations, all in simultaneous operations. The user has the flexibility to change a port’s role from “Evidence” to “Suspect” port. The session control application screen provides the user with comprehensive information and direct control over the running sessions, including all the settings of the session and the ability to abort the session.
• Detection Application Screen: All drives and storage devices that are connected to the unit will be “scanned” and displayed on one application screen called “The Detection Screen”. The user can tap on each drive to get its detailed info and run some specific utilities regarding that drive (as long as it is a target drive) – as a quick S.M.A.R.T. test (only using the “Target” port), run a Virtual Emulator (“Source” port), safely preview the contents of the drive (“Source” port), as well as select it for any desired operation they are planning to use.

More Features:

• Drive Trim: This allows the user to manipulate the HPA/DCO area on the drive to create an Evidence/Target drive with the same capacity of the Suspect/Source drive.
• Application Audio Notification: The user can enable some audio notification features, like the end of a session.
• Unit’s User Configuration: This feature allows the administrator of the unit to set specific operations with specific settings and allows the user to secure it with a lock password (This feature needs to be requested at the time of purchasing the main unit – it is needed for security purposes).
• Tasks Scripting: The user can create a script to run sequential and parallel operations. There are no limitations on the number of scripts or operations. If the operation requires the user’s input, it will pause and wait for it.
• Language Supports: Easy to implement translations for new languages. It supports Korean and Chinese languages.
• Keyword search before imaging: It allows the user to perform a quick keyword search on the Suspect drive with filters on the file extension types and a few important keywords. (This is a quick keyword search to determine if a “Suspect” drive needs to be captured.
• Keyword search while imaging: Gives the user the ability to perform a quick keyword search on the Suspect drive’s files and folders, with filters on the files extension types and with a few important keywords included in the search images.
• Cloud Storage Connection: With Insync paid services, the user can sync to Microsoft OneDrive, Google Cloud, and other cloud storage and capture the data.

The unit as a Complete Forensic Platform: The unit built-in with High Performances Hardware and configured with dual open OS (Linux, Win) and can serve as a platform for a Forensic Investigator to perform a complete investigation using one unit. A forensic investigator can, in addition to imaging and capturing data, install and run any third-party applications to: analyze the captured data, extract data from cellphone, preformes RAID reconstruction, network analysis, and more.

• Virtual Drive Emulator (Linux): Enables the user to run a drive, or image of a drive emulator, on the unit (Windows only) and allows the user to share folders and copy important files (bypass the user’s Windows password). Mount a Suspect drive, or its DD/E01 images, simulate it in its native Windows Environment and extract important files.
• Write-Blocking Hardware: Built-in extremely fast “Write-Blocking” hardware for “safe” data acquisition.
• Secure Write Blocked File Preview (Linux and Win): Browse and preview the captured data on the unit’ monitor. The user should connect the drive to the unit’s Suspect port to protect the drive via the port’s write-blocking mechanisms, turn on the power to the drive using the application’s power icon, and mount the drive using Ubuntu. The drive Doc files, including XLS, can be viewed using the Ubuntu Open Office package. Alternatively, the user can boot the unit to Windows and view the captured data using Windows.
• Cellphone/Tablet data extraction and analysis: Install and run Cellebrite, Oxygen, BlackBag, MPE+, Paraben, Axiom, MSAB, Graykey applications, and more (the user can also use the many of the unit’s USB3.2 ports to run multiple cellphone extractions in a very good performance)
• Triage data collection: Install and Nuix/Encase/Axiom/ADF portable applications.
• Full computer forensic analysis: Install and rub Encase, Nuix, Axiom, and FTK applications (data is already captured, and the hardware can support running a full analysis with good performance).

Built-in the USA: The units are designed, built, and tested in the USA.
Warranty: One-year free warranty on the main unit (does not include a warranty on accessories, adapters, and cables).

Extended Information

Main Hardware Features:

• Case: Mobile, lightweight, Rugged, and easy to carry.
• CPU: i7 CPU.
• Display: Color LCD 15.6” display, LED back-light.
• Hardware: Very high-quality, high performing components; some with military specifications.
• OS: Linux Ubuntu 64 bit and Win 10 Professional 64 Bit in a dual boot.
• Security: Linux OS (Linux is less targeted by malware).
• Hardware Upgrade: The unit can be upgraded at the time of purchasing for additional cost to a larger internal SSD.

Hardware Specifications: –

• RAM: 32GB DDR5 internal memory.

• Internal storage: 1TB SSD SATA.

• Storage controller: NVMe 4 ports storage controller (each port 4x PCIE4.0), SAS 12/GB/s PCIE 4.0 storage controller
  Hardware Ports and Supports:

• Source Ports: One SAS/SATA, one NVME U.2, and one USB3.2 gen2 ports are set as source ports (the user cannot change the role of these ports).
• Target Ports: Three SAS/SATA, 3 U.2 NVMe, 2 USB-C/Thunderbolt 4.0, 7 USB3.2 ports
• e-SATA port: One target port (connected directly to the motherboard) for external storage (“hot” plug) for DVD, or as a normal Evidence Port.
• USB3.2 Gen1 port: 1 Target port ( all the unit’s USB ports can also be used as a host to plug and use a keyboard, mouse, and other peripherals).
• USB3.2 Gen 2 (10 Gigabit/s): One source and 6 target ports.
• USB-C/Thunderbolt 4.0: Two target ports:

  1) connect to Optional Thunderbolt to PCIE Expansion Box.

  2) connect to HDMI external monitor with supplied adapter.

  3) connect to un-opened Mac via TB expansion Box and 1394 adapter for Mac with T1 chip.

• 10 Gigabit/s Network port: For network connectivity and remote data acquisition from an unopened PC/Laptop.
• Additional ports: Two Audio ports with 3.5mm connectors to support the plug ear-phones, and/or microphones, and include 2 side speakers
• Supports Storage Protocols and Interfaces: NVMe, SAS,SATA, e-SATA enclosures, IDE, USB2.0, USB3.2, MMC, 1394, TB.
• Supports Form Factors: 3.5”, 2.5”, ZIF, 1.8”, Micro-SATA, Mini-SATA, Slim SATA, Ultra Slim SATA, M.2 SATA, PCIE-Memory Card*, Mini PCIE, SFF-8639 U.2 NVMe, M.2 NVMe, and CF-30. * with optional adapters

Power Characteristics:

• Power Supply: A built-in, universal, auto switching 500W UL/CE/PSE power supply.

• Input Voltage: 100-240V/50-60Hz.
  Operating Environment:

• Temperature: 5°C – 55°C (40°F-130°F).

• Relative Humidity:20-60% non-condensing.
  Mechanical Characteristics:

• Unit net weight: 35.00 lbs.

• Unit dimensions: 20″ x 15″ x 8″.

• Shipping dimensions: 24″ x 18″ x 12″, 40.00 lbs.
  Included Items:

• 4 SAS/SATA 29 pins Extension cables.

• 4 NVMe U.2 extension cables with locking mechanism, and U.2 to M.2 Vertical Adapters.

• Mac/Thunderbolt Kit: Enable the user to capture form Mac with 1394/ Thunderbolt 2.0 (Supports for Mac with T1/T2 chip is via the TB3.0 expansion Box with 1394 controller, and supports for Mac with M1/M2 chip is with the use of the 1Gigabit/s to TB2/USB/USBc adapter)

• USB mini Keyboard.

• Remote capture kit via USB port or 1 Gigabit/s Ethernet ports.

• Thunderbolt to HDMI adapter

• Accessory bag to store all adapters, cables, and the keyboard.
  Options:

• Thunderbolt Expansion Box with FC/SCSI/1394

• 10GbE adapter to Thunderbolt

• SATA to USB3.0 Adapter (User can transform USB3.0 port into SATA port with the use of external power supply)

• USB3.0 to SATA 4 Channel Kit convert 4 USB3.0 ports to 4 SATA ports at high speed (20GB/min) The Kit includes 4 USB3.0 to SATA drive adapters and one power supply to power 4 SATA hard disk drives