Wo Paul Sir
Thank you so much for your kind help.
I am sure it will help to many peoples in this forum.
So you suggest to go ahead with superimager from media-clone ?
It has dual boot option ( Linux and windows ) so besides imaging on site analysis also can be performed. A cell phone can be imaged and analysed using this device.
On the other hand Tableu which is been purchased by guidance is a heavy weight contender due to guidance software .
Interestingly NIST has validated a)forensic falcon 2) Tabelu only.
bytethese - I have more budget ( US $ 6000) so price is not a barrier.
I just want to ensure that I purchase right product as this will be costly purchase.
I don't want to end up with substandard product .
I am more confused now so as which product to be purchased finally.
While not typically marketed as a "forensic imager" you might consider something like PC-3000 Portable. It's generally considered a data recovery tool, but their DE software can image in forensic mode, generate checksums, even create Encase image files to work with if you'd like. And, it can do a heck of a lot more. Remove ATA passwords, fix firmware malfunctions, etc., etc., etc. You'll have 10x more success with it, compared to those other tools, when it comes to any failing media that's for sure.
I my opinion, most forensic imagers do little more than you could do with a Linux computer. They're just sold for outrageous prices because most law enforcement agencies have deep pockets full of tax dollars and will pay whatever price for a solution that makes things simple (aka idiot proof).
I guess the only thing it wouldn't have for you is any features for "on site analysis" since the software isn't forensics oriented. You'd still need to use other software for that. But, if you're in forensics already you've probably already got Encase or some other software you can run on a laptop which you'd be hooking up the PC-3000 portable.
Hi Jared Good Morning
Thank you for sharing your thoughts on this subject.
Yes I know awesome capabilities of ace products as I own acelab PC3000 UDMA (Red card)
. This particular requirement is for a portable device having multiple ports so in case needed I can make 1 2 /13 or even more copies simultaneously . I can even image multiple drives simultaneously . I can erase large no. of disks on site.
all this is possible with least efforts using a standalone imager. Pc3000 lineup though powerful will lack flexibility for quick movement and multifunctionality of standalone imager.
Though portable also can do all these tasks most efficiently .
Typical drives to be cloned will be healthy. Those having defects will be operated in lab.
Those who are looking for a portable device having firmware level capability to deal with failing / ATA encrypted , WD smartware encrypted drives portable is the only choice.
Thank you.
Wishing all fruitful day ahead.
So you suggest to go ahead with superimager from media-clone ?
It has dual boot option ( Linux and windows ) so besides imaging on site analysis also can be performed. A cell phone can be imaged and analysed using this device.
On the other hand Tableu which is been purchased by guidance is a heavy weight contender due to guidance software .
Interestingly NIST has validated a)forensic falcon 2) Tabelu only.
Keep in mind that validation results are valid not for a specific product, but for a specific firmware version of the product and its hardware. NIST doesn't always revalidate a product after a firmware update is made available by a vendor.
If you don't have any legal reason to stick with validated products only, then [external] validation isn't a key factor for you.
It's rather sad that NIST validation efforts miss issues with the forensic soundness. Tableau TD3 is not an exception here. Also, since software products were mentioned in this thread, the same is applied to them.
Vendors may provide inaccurate information about write blocking in their products. They may include a software write blocker in a certain version of a tool, but later they silently exclude it (this is what happened to PALADIN). They may claim that a product contains a write blocker, but in fact it doesn't. And so on.
I just want to ensure that I purchase right product as this will be costly purchase.
I don't want to end up with substandard product .
I am more confused now so as which product to be purchased finally.
Try to contact a local reseller and ask him to provide a product for testing before purchasing.
Thanks a ton thefuf.
I have learned valuable lesson , vendors cant be trusted by there claims.
NIST ceritification is not gold standard.
I think Tabelu TD2 plain simple imager is best as it is tested and proven by many experts.
definetly tableau td2u
definetly tableau td2u
Hi nightworker
Thanks for your affirmative words. They are filled with confidence . There was only two contenders left - Logicube Forensic Falcon & Tabelu .
But with your suggestion I am putting final stamp on td2u.
Thank you so much.
Unfortunately there is no reply to emails from both IXImager and media-clone superimager.
I am wondering if no response from sales then what to expect for support.
besides I haven't found anyone using superimager
Hello,
We use the MediaBox units from Trinity in the UK.
They are simple to use (plug-and-play) and can handle 4 imaging tasks at once. There's a couple of variations of the unit available, and they are releasing one soon with some forensic capability, which might be worth a look if you need to do on-site forensics.
For us, we image everything on site, and worry about the analysis once we're back at the lab.
Hope this helps,
Hi Mark1975
Thank you so much for your valuable suggestion.
Yes trinity makes powerful yet simple to operate devices. They are suited for acquiring USB media mostly.( Pen Drives ,Memory Cards ,USB hard disks etc.)
I am looking for hard disk imager , with native SATA /IDE support.
In a typical Raid , our task is to make multiple copies of single disk or capture multiple disks at a time. For this Logicube falcon is ideal .Multiple disk images can be stored on a large hard disk using falcon ( typically from a single site , this reduces no. of disks.)
Thanks again.