SuperImager Plus 8” T3 Portable Forensic Imaging Unit with i7, and Thunderbolt and NVMe ports

Forensic Imager Portable Field unit with SAS/SATA, USB3.1, and Thunderbolt 3.0 ports, running Dual Boot of Linux OS for Forensic data imaging and virtual emulator, and Windows 10 for full forensic analysis, cellphone data extraction and analysis, and triage data collection. The unit is Portable, compact, easy to carry, and extremely fast. It is built with 4 SAS/SATA ports, 8 ports of USB3.1, one port of Thunderbolt 3.0, and is supplied with a Thunderbolt Expansion box with an M.2 NVMe controller that enables capturing of NVMe SSD and other interfaces. The user can run multiple, parallel, simultaneous forensic imaging operations from many storage devices, with 3 HASH values, and with an encryption on the fly. The unit includes a Remote Capture KIT and an Enabled Virtual Emulator option. The unit’s top speed: 31GB/min SATA SSD, 187GB/min NVMe.

Are you interested in this product?

1300 55 33 24

contact@cdfs.com.au

Quote Request

Download SuperImager® Plus 8” T3 Forensic Field Unit Brochure

 

Download Hardware Compare Tableau TX1 vs. MediaClone SuperImager
Plus T3 units

 

Download Logicube Neo vs. SuperImager Plus T3-unit

 

The SuperImager® Plus 8” T3 Portable Forensic NVMe + SATS/SATA unit is a forensic imaging device with the ability to perform in the field multiple Forensic tasks, allowing the Forensic investigator to capture data from multiple source drives, with supports to many kinds of storage interfaces, to multiple target drives simultaneously with 4 HASH values(MD5, SHA1, SHA2, SHA512 at the same time) and extremely fast. It also enables the user to perform a full Forensic Analysis in the field by using EnCase, Nuix, Axiom, or any other analysis application for Windows 10, perform extraction and analysis of data from multiple cellphones, or use and run any third-party Windows 10 application. The unit is compact and easy to carry, with built-in 4 ports of SAS/SATA (with a secure connector), e-SATA port, 8 USB3.0/3.1 port, Thunderbolt 3.0 (40 Gigabit/s) port, and it is supplied with a Thunderbolt 3.0 Expansion box with 1394A/B, NVMe M.2, 4 SAS controllers that plug inside the TB 3.0 box and provides supports to those interfaces. Additionally, the Thunderbolt 3.0 port and the Thunderbolt 3.0 Expansion box allows the user to capture data from Ma(using the optional Mac Acquisition Kit) save captured images to a network via 10 Gigabit/s Ethernet, or with the use of other storage controllers such as SCSI, FC to capture data from almost any type of storage interface.
Extreme speed of 32GB/min with SATA SSD and 187GB/min with NVMe SSD

 

The SuperImager’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, Linux-DD, E01/DD mix, single partition, VHD, Files and Folders as a Triage.

 

Here are some of the tasks the unit can be used for:

 

1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only partitions, Add more capture capabilities with the use of fast USB3.1 to SATA adapters.

2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extensions filters.

3) Erase data from Evidence drive – using DoD (ECE, E), Security Erase, Enhanced Security Erase, Sanitize erase, NVME erase, USER Erase protocols.

4) View the CAPTURED data directly on the Ubuntu Desktop screen or the Windows screen.

5) Encrypt the data while capturing (using the AES256 engine) and decryption at the destination with the use of MediaClone utility

6) HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.

7) Run a quick Keyword Search on the Suspect drive prior to capture. or during the capture.

8) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side, or use MediaClone application supporting Android Cellphones.

9) Run Forensic Triage application: Capture files and folder using the MediaClone application or using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.

10) Run a full Forensic Analysis application like Encase/Nuix/FTK/Axiom (Windows side).

11) Run Virtual Drive Emulator prior to the data being captured on the Linux side and preview the suspect data or copy important files and folders (this option is enabled on this unit).

12) Run Remote Capture from unopened laptops – Intel Based CPU (supplied with this unit).

13) Use the native Thunderbolt 3.0 port (40Gigabit/s) to capture data from USB3.1 Gen2 storage devices, Mac via Thunderbolt 2/3 port or 1394 port, or connect to 10GbE network with the use of TB3.0 to 10 GbE adapter.

14) Unlock drives with ATA pass-code, BitLocker pass-code, Opal pass-code for SED drives

15) New feature – Use the SuperImager unit as a “Write Blocker” device: This new feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.

 

A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode.

 

The SuperImager unit will be connected to the same network and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as: SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

 

Additional operations that are available include HASH a drive, Drive Diagnostics, Image Restore, drive Erase of Evidence drive prior to a use, and Scripting.

 

The application supports forensic imaging of multiple drives, in multiple sessions, in simultaneous forensic imaging runs.

 

The unit is supplied with 4 SAS/SATA extension cables with power and data, Thunderbolt 3.0 to PCIE Expansion Box with NVMe M.2 controller, 1394A/B controller, Remote capture KIT, Virtual Drive Emulators, M.2 SATA adapters, MSATA adapters, MicroSATA adapters, 4 SAS/SATA controller.

 

SuperImager Plus 8″ T3 unit with i7 CPU, 32GB Memory, and S/W Version 1.8.133.11
Operation Avg Speed GB/Min
HASH single drive, in a single session (Samsung 870 EVO SSD)
SHA-1 32.1
MD5 32.1
SHA-1+ MD5 32.1
HASH 2 drives in 2 separate sessions (2 Samsung 870 EVO SSD)
SHA-1 + MD5 drive 1 29.0
SHA-1 + MD5 drive 2 29.0
HASH single drive, in a single session (1TB WD black M.2 NVMe)
SHA-1 132.00
SHA-1 + MD5 132.00
Erase Drives using 1TB WD Black M.2 NVMe SSD
Read Verify 202.00
Single Pass – User Erase Mode 153.00
Forensic Imaging
100% bit by bit Imaging 1 TB WD Black to 1 TB WD black M.2 NVMe SSD
no HASH 187.00
with SHA1 HASH 137.00
DD Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD (2GB Files Chunks and NTFS)
with SHA-1 + MD5 HASH 30.1
DD Imaging SanDisk Extreme II SSD to Samsung 850 EVO SSD 2 GB file Chunks and NTFS)
with SHA-1 + MD5 HASH on 28.5
E01 Imaging Samsung 850 EVO SSD to Samsung 850 EVO SSD (2GB Files Chunks and NTFS)
with SHA-1 + MD5 HASH on 24.2

 

Technical Specs

 

Main Hardware Features:

Case: Portable, lightweight, small, and easy to carry.

CPU: i7 Latest Generation Multi Core CPU

Display: color LCD display, 8” (800×600), LED back-light, with resistivity touchscreen.

OS: Linux Ubuntu 64 bit and Win 10 Professional 64 Bit in a dual boot. The open Ubuntu OS allows for easy application modification to include new features, easy adaptation to new hardware, and ease of adding third-party Ubuntu applications.

Dual Boot Ubuntu/Win10 (Built-in):

Data Capture Under Linux: Performs Forensic Imaging under Linux for a faster, more efficient, and more secure operation.

Analyze the Captured Data under Windows 10: Reboot the unit to Windows and use third-party applications to perform data analysis, cellphone capture and other tasks.

Security: Linux OS (Linux OS is less targeted by malware).

Hardware Upgrade: The unit can be upgraded at the time of purchasing for additional cost to a larger internal SSD

Application Updates: The application can easily be updated by using any of the unit’s USB ports and by a simple tap on the “update software” icon from the unit’ main menu.

 

Hardware Specifications:

RAM: 32GB DDR4 internal memory.

Internal storage: 1TB SSD SATA HDD.

Storage controller: PCI Express SAS/SATA controller.

 

Hardware Supports:

Source Ports: 1 SAS/SATA ports, and two USB3.0/USB3.1 ports are set as source ports (the user cannot change the role of these ports).

Target Ports: 3 SAS/SATA ports, one e-SATA port, and 6 USB3.0/USB3.1 ports, 1 M.2 NVMe port. In addition, the 4 SAS ports on the expansion box are set as target ports as well. (Any target port can be reconfigured to be source port)

Supports Storage Protocols and Interfaces: SAS, SATA, e-SATA enclosures, IDE, USB2.0, USB3.0 USB3.1, MMC, M.2 (SATA or PCIE/NVMe base), Mac via Thunderbolt 2.0, Mac via Thunderbolt 3.0, 1394A/B, SCSI*, FC*

PCIE Supports: Supports M.2 and 2.5” PCIE SSD, NVMe PCIE storage controller, PCIE Express cards, and PCIE express Memory using the unit’s T3 port and the TB3.0 to PCIE Expansion Box with some hardware options.

Supports Form Factors: 3.5”, 2.5”, ZIF, 1.8”, Micro-SATA, Mini-SATA, Slim SATA, Ultra Slim SATA, M.2 SATA, NVMe M.2, NVMe U.2*, Mini PCIE*, and CF-30.

*With Optional controllers plugged into the Expansion Box.

 

Application Settings:

HPA/DCO Automatic Supports: The application has the ability to automatically open HPA and DCO areas and resize the “Suspect” hard drive to its full native capacity in order to capture any “hidden data: (HPA/DCO are special areas on the drive that support this feature).

Bad Sectors Handling: The user can select to skip bad sectors, skip bad blocks, or abort the operations. The skipped, bad sectors will be reported in the log file in detailed or in summary.

48bit LBA Addressing: Supports drives with sizes up to 256TB.

Forensic Images – Destination: The user can save Forensic Images to any storage device attached to the SuperImager unit, or to any connected network (using the unit’s 1Gigabit/s port or the Thunderbolt 3.0 to 10 Gigabit/s optional adapter), any external USB3.0/e-SATA RAID (encryption is optional), or an external NAS storage all at a very good speed.

Cross Copy from any Ports and any Interfaces: The user can choose to capture from one port, with one type of storage protocol and interface, and save the forensic image onto a different storage protocol and interface using destination ports. The cross copy of data can be done between any of the supported storage interfaces.

Audit trail and operation Log Files: Generated automatically by the application and saves it on the Evidence/Target drive (PDF, XML)

 

Application Features:

GUI: The application is built with large and very simple and easy to navigate icons. In a few clicks the user can set an operation and it will quickly be up and running.

Speed: Very fast – one of the fastest Forensic Imaging solutions available on the market today, achieving a speed of above 32GB/min with SATA SSD and 187GB/min with NVMe SSD. Read speed up to 202GB/min.

 

Application’s Main Operations:

Forensic Imaging Mode

Forensic Platform

Data Eraser and Format

HASH Calculation Authentication and Verification

Network

 

Forensic Imaging Mode:

Mirror imaging bit by bit (100% or any % of the drive), DD, E01/Ex01 – with optional compression, Selective Capture (Capture Partitions, Files and Folders, and with the use of file extension filters), Mix-Format of DD/E01/Ex01, selecting one partition capture.

Targeted Imaging: Sometimes the forensic investigator does not have the time to do a full data capture of the Suspect drive. Now the user can use the Selective Imaging feature to select only partitions, files, or folders (like the Windows User-Folders or Windows User-Documents and User-Pictures). With the use of preset file extension filters or adding its own filters, the Forensic Investigator can narrow their capture scope and shorten its acquisition time.

Forensic Restore: Back up the data that was captured to another drive in the original format.

Forensic Images Formats:

a) Mirror Image Formats 100% Bit by Bit Mirror copy.

b) Linux-DD Format.

c) Encase E01/Ex01 Formats (includes options for optimizing the compression by adjusting the compression level and the number of compression parallel engines) and Mix-Format of E01/Ex01/Linux-DD.

d) Mix-Format is where the user can capture from one source drive and save the images onto multiple destination ports; each target port can be selected to be one of the 3 E01/Ex01/Linux-DD.

e) In addition, the user can use a file-based copy to copy files and folders by using selective imaging with file extension filters.

f) Single partition capture.

g) VHD capture

Imaging and Verify: The user can select to run forensic imaging with 3 HASH engines and also enable the “HASH the target and compare HASH” feature. That is kind of a stand operation to make sure the captured image is not altered or corrupted.Reading speed from a source drive (32GB/min SATA, 202GB/min NVMe).

– Drive Spanning: Supports spanning the captured data onto many “Evidence” drives when the Evidence drives are not large enough (also supports restore images that are spanned over multiple drives). Also support parallel drive spanning when the source drive is much faster than the target (source is NVMe for example).

Encryption: On-the-fly AES256 encryption of the “Suspect” drive, saving the encrypted data on the “Evidence” drive in 100%, DD, E01/Ex01 formats.

Decryption: The user can perform decryption on a drive that has been previously encrypted by any of the SuperImager units. Alternatively, the user can use a standalone MediaClone Linux decryption utility application to perform decryption on an encrypted drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the MediaClone Linux decryption utility application, where the encrypted drive and a blank destination drive are attached to the PC (the user needs to supply to the utility application the saved encryption key). MediaClone developed its own decryption utility application in order to make sure that the user can always decrypt the drive was were once encrypted via a MediaClone unit and not to rely on TruCrypt or other third-party applications that might not be supported in the future.

Forensic Imaging Tool: In one read-pass from the “Suspect” drive, the SuperImager Plus application can run the following operations simultaneously: Forensic imaging with E01 format and full compression, Encryption with AES256, calculate 3 HASH Verification and Authentication values (MD5, SHA1, SHA2), save the captured Forensic Images to 2 “Evidence” drives to a local network, and external compact USB3.0/e-SATA TB RAID encrypted storage. The basic Forensic Imaging mode can be 1:1, 1:2, 1:3, 2:2 for SAS/SATA and 2:6 for USB3.0/3.1 storage devices, or 5:8 SATA with USB3.0 adapters, and more possibilities with the use of the supplied Thunderbolt 3.0 Expansion box with additional 4 SAS ports.

Extreme Speeds when performing Forensic capture with E01/Ex01 formats and full Compression:

– The new Linux-based SuperImager Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations while also performing at incredibly high speeds with E01/Ex01 formats and full compression. The application allows the user to manually select and adjust the number of hyper-threads and the level of compression used during each session.

– Forensic data captured with Encase E01/Ex01 formats with full compression is widely used for operations in the forensic industry and generally requires a trade-off between speed, space, and time of decompression by the Encase application.

– Comparative tests show a 20% increase in speed when using the SuperImager Plus Linux-based application over the SuperImager Windows-based application. The tests were performed with the same hardware, the same hard disk drives (filled 43% of the drive with random data), and the same level 1 compression. The Linux-based application was set to use 16 compression threads.

 

Complete Forensic Platform:

– In addition, the unit can serve as a platform for a Forensic Investigator to run a complete investigation and to perform:

– The Forensic investigator can load and run third-party applications such as Cellebrite, Oxygen, DART, Paraben, and BlackBag. The user can also run third-party Triage applications under Windows on the attached Suspect or Evidence drives. The MediaClone Windows Drive Power Utility application allows the user to mount drives safely, either as read-only or read-write (depending on the unit’s port) in a secure way. The application also allows the user to dismount and remove drives in a safe way. The Suspect port is automatically assigned to be read-only.

Virtual Drive Emulator: Enables the user to run a drive, or image of a drive emulator, on the unit (for Suspect Drives that were extracted previously from a Windows unit) and allows the user to share folders and copy important files (bypass the user Windows password). Mount a Suspect drive or it’s DD/E01 images, simulate it in its native Windows Environment, and extract important files (This function performs on the Linux side).

Secure Write Blocked File Preview: Browse and preview the captured data on the Internal Display. The user should connect the drive to the unit’s Suspect port to protect the drive via the port’s write-blocking mechanisms, turn on the power to the drive using the application’s power icon, and mount the drive using Ubuntu. The drive Doc files, including XLS, can be viewed using the Ubuntu Open Office package. Alternatively, the user can boot the unit to Windows (if this option was purchased) and view the drive on Windows.

High Performances: As a platform, a forensic investigator can, in addition to imaging and capturing data, load and run third-party applications to analyze the captured data:

Cellphone/Tablet data extraction and analysis – Cellebrite, Oxygen, BlackBag, MPE+, Paraben applications, and more (the user can also use all of the 8 USB3.0 ports to run cellphone extractions)

Triage data collection – Nuix/Encase/ADF portable applications.

Full Computer Forensic Analysis – Encase, Nuix, Axiom, and FTK applications – data is already captured, and the hardware can support a full analysis.

 

Data Eraser and Format:

– The user can erase drives and USB3.0 storage devices by using the unit’s 4 SATA ports and 8 USB3.1 ports. The application supports DoD erase (Full, Lite), Security Erase, Enhanced Security Erase, and Sanitize erase protocols. DoD (Full and Lite) are NIST 800-88 compliant. The rest of the erase protocols need to be run with verify pass in order for them to be NIST 800-88 compliant. The application also supports the user erase mode with verification pass and the erase verification mode for drives that were previously erase by a third-party application or tool.

– Erase the remainder of the drive after the copy.

Drive Erase Protocols: DoD 5220-22M, Security Erase, Enhanced Security Erase, Sanitize, NVMe Secure Erase, or a User-erase mode where the user can define the final data filling pattern and the number of iterations (Security Erase, Enhanced Security Erase, Sanitize, and DoD erase protocols are all NIST 800-88 compliant).

Format: NTFS, FAT, HFS+, EXT4, and exFAT.

Erase Verify: Run Erase Verify to verify that the drive was erased before use

Erase Logs and Erase Certification: The application generates extensive erase logs and files with an NIST 800-88 erase certification (also runs S.M.A.R.T. tests before and after the erase operation and is saved to XML file format) which can be exported to a USB thumb drive. The application also has a built-in erase database that can easily be exported to XLS.

Evidence Drive Formats: exFAT/FAT/NTFS/HFS+/EXT4.

 

HASH Calculation Authentication and Verification:

HASH Authentication: Simultaneously calculated on-the-fly up to 3 HASH Authentication values MD5/SHA-1/SHA-2 during the same session.

HASH while Capture: MD5, SHA-1, SHA-2 (all the 3 HASH protocols can be selected to run simultaneously).

 

Network:

Network Capture: Data from a network folder can be captured and saved into “Evidence” drives via the use of the iSCSI storage protocols. The SuperImager application (for both capture from a network and save to a network) supports SMB, NFS, and CIFS networks protocols. The capture can run with HASH authentication and HASH verification.

Saves Forensic Images to Network: Upload multiple Forensic images to a network (DD, E01) simultaneously by using 1 Gigabit/s port/ Thunderbolt 3.0 to 10 Gigabit/s optional adapter, or any of the unit’s USB ports to upload up to 8 parallel 1 Gigabit/s network streams.

Disable Network process and protocols for security reasons: Those network protocols are easy to disable using Ubuntu Preferences Tools.

Copy loose files from/to the network: The user can copy files from/to a network with HASH authentication for better data integrity.

Remote Capture (Intel based CPU)- Capture data from the Internal Drives of an un-opened Laptop or Computer: Using USB or 1 Gigabit Ethernet ports on the laptop/computer enables the user to use the Remote capture application via a USB stick, without the need to remove the drive from the laptop/computer or boot the laptop from its own OS (the capture speed is restricted to the performance of the Laptop/PC CPU and the 1 Gigabit/s connection). The capture application can run using HASH authentication. The Remote Capture Option Kit includes the USB flash drive, 1 Gigabit/s to USB3.0 Adapter, and a crossover network cable. The Remote capture application supports capture via USB/1394/TB/R45 network ports).

 

Parallel Operations:

Parallel Forensic Imaging – Multiple Session Operations: Improves the efficiency of the evidence data collection process by using multitasking and using a parallel imaging process. The user can take advantage of the SuperImager unit’s multiple available ports and run multiple, efficient, simultaneous parallel operations. The user can mix different types of operations, and each operation can be set as a new independent session. An example of an operation: erase data from a drive connected to one port and HASH verify a different drive connected to the second port, all while performing forensic imagining of 1 to 1 on drives connected to the remaining ports.
– Port’s rule increase possibilities: The application is very flexible in running multiple sources to multiple destinations, all in simultaneous operations. The user has the flexibility to change a port’s role from “Evidence” to “Suspect” port. The session control application screen provides the user with comprehensive information and direct control over the running sessions, including all the settings of the session and the ability to abort the session.

Detection Application Screen: All drives and storage devices that are connected to the unit will be “scanned” and displayed in one application screen called “The Detection Screen”. The user can tap on each drive to get its detailed info and run some specific utilities regarding that drive (as long as it is a target drive) – like a quick S.M.A.R.T. test (only using the “Target” port), run a Virtual Emulator (“Source” port), safely preview the contents of the drive (“Source” port), as well as select it for any desired operation they are planning to use.

Basic Parallel Forensic Imaging: The supported modes are:

Native SAS/SATA: 2:2, 1:3 and many more possibilities using the e-SATA port, 4 SAS ports on the Expansion Box, and USB to SATA adapters

USB3.0/3.1: 1 to 1, 1 to 2, 2 to 2, and up to 4:4.

More Ports for Forensic Imaging:

SATA: with the use of USB3.0 to SATA fast adapters and in combination with the unit’s e-SATA port, the unit can support many more Forensic Imaging of SATA drives.

SAS: with the use of the supplied 4 ports SAS controller(plugged inside the Thunderbolt 3.0 Expansion Box), the user can image from/to more SAS/SATA ports (Since the TB3.0 port has a high bandwidth of 40 Gigabit/s, the 4 add-on SAS drives can run at a max speed of 32GB/min without any speed degradation)

*With the use of the supplied TB 3.0 Expansion Box, the user can add the optional U.2 NVMe Kit, SCSI, Kit, and FC Kit.

 

More Features:

Drive Trim: Allows the user to manipulate the HPA/DCO area on the drive to create an Evidence/Target drive with the same capacity of the Suspect/Source drive.

– Application Audio Notification: The user can enable some audio notification features, like end of a session.

Unit’s User Configuration: This feature allows the administrator of the unit to set specific operations with specific settings, and allows the user to secure it with a lock password (This feature needs to be requested at the time of purchasing the main unit – it is needed for security purposes).

Tasks Scripting: The user can create a script to run sequential operations and parallel operations. There are no limitations on the number of scripts and operations one can run. Be aware that if the operation requires the use of an input it will stop and wait for the user to input (like when the user is running a drive scanning and a user’s response is needed).

Language Supports: Easy to implement translations for new languages. Now supporting Korean and Chinese languages.

Keyword search before Imaging: Gives the user the ability to perform a quick keyword search on the Suspect drive’s files and folders, with filters on the files extension types and with a few important keywords (this is a quick keyword search to determine if a Suspect drive needs to be captured).

Keyword search while imaging: Gives the user the ability to perform a quick keyword search on the Suspect drive’s files and folders, with filters on the files extension types and with a few important keywords included in the search images.

Cloud Storage connection: With the use of Insync paid services the user can sync to Microsoft OneDrive, Google Cloud, and others cloud storage

Partition imaging: Gives the user the ability to select only one partition (per sessions) to perform forensic imaging and save it into the Evidence drive in DD/E01/Ex01 format.

Network Multiple Forensic Image “Loader”: Besides the ability of the application to upload forensic images (DD, E01) to the network via the 1 Gigabit/s network port, there is also a unique feature/solution that can solve the streaming bottleneck issue by using a single port. With this solution the user can upload many Forensic images directly to a local network using 7 equivalent 1 Gigabit/s network streams. Alternatively, the user can use the Thunderbolt 3.0 port to connect to a 10 Gigabit/s network.

 

Expansion Capabilities and Main Hardware Options:

USB3.0 to SATA Adapters and Kits Option: Today USB3.0 technology is extremely fast and can run read data from SSD drives up to 20GB/min. With the use of the USB3.0 to SATA 4 channel Kit, the user can convert 4 USB3.0 ports to 4 SATA ports.

– 10GbE port option: Thunderbolt 3.0 to 10 GbE adapter plugged into the unit’s fats thunderbolt port

Thunderbolt 3.0 KIT: Include 1394 to TB2 adapter, TB2 to TB3 adapter, and TB3 Extension cables – all to capture data from un- opened Mac using the unit’s fast Thunderbolt 3.0 port

 

Options using the Thunderbolt 3.0 to PCIE 3.0 Expansion Box:

SCSI KIT Option: This option includes SCSI PCIE X1 single port controller, 2 channel SCSI LVDS cables (68 pins connectors), SCSI terminator, and VHDCI to 68 pins SCSI adapter.

NVMe External KIT: This optional kit is supplied with NVMe PCIe controller with U.2 external port plugged inside the TB3.0 Expansion Box, U.2 external extension cables (support external U.2 NVMe or PCIE NVMe storage controllers*), and NVMe M.2 to U.2 adapter. This option is different from the M.2 NVMe solution that supplied with the unit and by using this optional kit, the NVMe port is outside of the TB3.0 Expansion Box allows connection of U.2 NVMe and NVMe PCIE storage controller*

Express Card Option: Add-on support for Express and PCIE memory such as Sony SxS.

1394 Option: This option is supplied with 1394A/B PCIE 1x controller and cables.

FC Option Kit: Controller, drive adapter with transceivers.

*Optional Adapter U.2 to NVMe PCIE storage controller adapter board

Built in the US: The units are built and tested in the US.

Warranty: One-year free warranty on the main unit (does not include warranty on accessories, adapters, and cables).

 

Ports:

Native SAS/SATA: 4 Ports (2 source and 2 target ports).

USB3.1: 8 Ports Type A (2 source and 6 target ports – all these ports can also be used as a host to plug in and use a keyboard, mouse, and other peripherals).

Thunderbolt 3.0: 1 Port Type C – can be used for USB3.1 Gen2 storage, TB monitor,10 GbE network, Capture data from Mac TB2/TB3/1394, or plug the Thunderbolt Expansion Box (40 Gigabit/s).

e-SATA: 1 Port (connected directly to the motherboard).

1 Gigabit/s: 1 Port

DP: 1 Port

HDMI: 1 Port – shared between the internal display and an external use.

Location of the Ports:

Front Panel: 4 SAS/SATA power and data combo parts (two “Suspect” and two “Evidence”) and 2 USB3.0/3.1 ports (for “Suspect1” and “Suspect2”).

Back Panel: 1 GbE port for network connectivity and remote data acquisition from an unopened PC or laptop, Audio 3.5mm connectors that supports the plug in of speakers, earphones, and/or microphones, 6 USB3.0/3.1 ports (can be configured and used as “Suspect” ports or for generic use like Codemeter Dongle and Input Devices), one e-SATA 6 Gbit/s port for external storage (“hot” plugged) or for DVD, Thunderbolt 3.0 ports (40 Gigabit/s), and DP ports.

 

Power Characteristics:

– A built-in, universal, auto switching 192W UL/CE/PSE external power supply adapter with a key and lock-in mechanism to avoid accidental disconnection.

Input Voltage: 100-240V/50-60Hz with OVP- over voltage protection, SCP- short circuit protection, OCP- over current protection, OTP- over temperature protection

 

Operating Environment:

Temperature: 5°C – 55°C (40°F-130°F).

Relative Humidity: 20-60% non-condensing.

 

Mechanical Characteristics:

Unit Net Weight: 8.5 lbs

– Unit Dimensions: 10.6”L x 7.70″W x 3.15″D (270 x 200 x 100 mm).

 

Extended Information

 

Included items:

  • One SATA to IDE adapter (3.5″ and 2.5″)•
  • One Micro SATA adapter
  • One Mini SATA adapter
  • One M.2 to SATA adapter
  • Four 29-pin SAS/SATA data and power combo cables
  • Thunderbolt 3.0 PCIE Expansion Box with PCIE 3.0 4x (with 16x socket)
  • One M.2 NVMe controller (Installed inside the TB 3.0 Expansion Box)
  • One 1394A/B controller (Can be installed inside the Expansion Box- need to be swapped with the NVMe M.2)
  • 4 ports SAS controller
  • Remote Capture Kit via USB and 1 Gigabit Ethernet ports
  • Options:
  • ZIF to SATA Adapter
  • SATA to 1.8Inch IDE Adapter
  • SATA to USB3.0 Adapter (user can transform every USB3.0 port into SATA port with the use of external PS)
  • Hard Case with Foam
  • Express Card
  • Thunderbolt 3.0 KIT: include 1394 to Thunderbolt 2 adapter, and TB3 to TB2 adapter (to capture data from un-open Mac)
  • NVMe External KIT (support external M.2 and 2.5″ NVMe and also it include external PS to power 2.5″ NVMe SSD)
  • U.2 to NVMe PCIE adapter (to be used with the NVMe External KIT)
  • SCSI KIT
  • Thunderbolt to PCIE 3.0 with 2 PCIE x4 slots (half size)
  • 10Gigabit/s KIT
  • USB3.0 to SATA 4 Channel Kit. User can convert 4 USB3.0 ports to 4 SATA ports at high speed up to 20GB/min. (The Kit includes 4 USB3.0 to SATA drive caddies with 1 external PS to power the 4 SATA hard disk drives)