The SuperImager® Plus Desktop XL 12 NVMe PCIe4.0 Ports Digital Forensic imaging unit is a standalone unit dedicated to supporting multiple NVMe SSD with the ability to perform various Forensic tasks like simultaneously capturing data from numerous source NVMe SSD to multiple target NVMe SSD and upload them to a network. It also enables the user to perform a full Forensic analysis using EnCase, Nuix, and Axiom applications or extract data from multiple cell phones using Cellebrite/MSAB/Oxygen applications. The unit is industrial built with a metallic desktop style that lasts for years. The SuperImager application is designed with easy-to-use touchscreen icons. The unit has built-in 12 NVMe U.2 ports, 10 USB3.2 ports, 2 Thunderbolt 4.0 ports. The unit is very fast, where each NVMe port has 4 dedicated lanes of PCIe 4.0 with a max bandwidth of 480GB/min per port.

Here are some of the tasks the unit can be used for:

1) Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only part of it.

2) Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extension filters, include metadata and HASH for each file (for example, run E01 capture of 6 parallel simultaneous sessions using 12 NVMe SSD and 16 CPU compression engines). Run simultaneously logical data extraction from multiple smartphones.

3) Perform Forensic Imaging from many Suspect drives to one large Evidence drive; in append mode.

4) Upload many Forensic images to a network (SMB, CIFS, NFS).

5) Erase data from Evidence drive – using DoD (ECE, E), Security Erase, Enhanced Security, Sanitize Erase protocols, NVMe-Format Secure Erase.

6) View the captured data directly on the Ubuntu Desktop screen.

7) Encrypt the data while capturing (using the AES256 XTS engine).

8) HASH the data while capturing – run all the four MD5, SHA-1, SHA-2, and SHA-512 HASH engines simultaneously.

9) Run a quick Keyword Search on the Suspect drive before capture.

10) Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 11 side.

11) Run a Forensic Triage application to capture and view targeted data.

12) Run a full Forensic Analysis application like Encase/Nuix/FTK/Axion.

13) Run Virtual Drive Emulator.

14) Encryption and Decryption on the fly of drives that contain sensitive information.

15) Easily reconfigure the unit’s ports, where each target port can be configured as a source or target, enabling the user to run 6:6 sessions or upload 12 images to a network.

16) Convert the unit’s 10 USB3.2 ports to SATA ports and run more parallel sessions (with the use of some USB3.0 to SATA adapters).

17) Use the SuperImager unit as a “Write Blocker” device: This feature enables the SuperImager unit to function as a secure bridge between workstations on a network to Suspect drives attached to the SuperImager unit by using the iSCSI protocol over a network connection.

A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different places in the Writes-block mode.

The SuperImager unit will be connected to the same network of the user, and the Suspect drives will be attached to the SuperImager unit in read-only mode. The SuperImager unit will act as a “write blocker” for any of the unit’s attached storage, such as SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

The unit is designed to help expedite the forensic imaging process, especially in facilities with a large backlog in imaging drives, by performing parallel forensic imaging in a true optimized multiple session’s application.

Some additional operations: HASH Authentication, drive diagnostics, and automation of process using scripting.