MediaClone new product release: A portable powerful multi ports Forensic Imager and a Complete Forensic Field Investigation unit, running Linux/Win open OS in a dual boot, that supports many different kinds of digital storage devices includes the latest of NVMe SSD.
The unit has two built-in NVMe ports which enable the user to image from one Suspect NVMe SSD to one Evidence NVMe SSD at a high-speed of 93.7GB/min. The unit is supplied with two PCIE U.2 external cables plus two external NVMe to M.2 adapters with mounting and locking brackets. The external PCIE U.2 cables provide a flexible solution to cover both NVMe M.2 and 2.5” U.2 SSD form factors.
In addition, the unit has two built-in SATA ports, one e-SATA port (4 via the supplied TB Expansion Box), eight USB3.0 ports and a high-speed Thunderbolt 3.0 port with 40Gb/s bandwidth.
The SuperImager application allows the user to image drives across ports and interfaces, for example, image an NVMe SSD to a SATA drive or image an NVMe SSD to a USB flash drive, and so on.In the recent years, there has been an increase in the use of NVMe SSDs in MacBook laptops. NVMe is a non-volatile storage media that is attached via the PCIe bus. It uses PCIe communication and storage protocols to reduce the I/O overhead and brings various improved performances and reduced latency in comparison to SATA SSDs. Using the PCIe 3.0 bus enables NVMe SSDs to achieve even a higher performance, and can run at incredible speeds.
When running a full forensic data capture at a blazing speed (93.7GB/min*), or running SHA-1 HASH on a NVMe SSD at extreme speed (73.5GB/min*), heat dissipation is another design consideration, which affects the performances of the SSD.
M.2 NVMe adapters are not designed for external use and an additional locking mechanism is needed.
The SuperImager NVMe + SATA combo unit is designed to address some of those challenges to become an effective and usable tool among Forensic users.
The SuperImager application enables the user to power-on the plugged NVMe SSDs, scan the PCIe bus for the attached storage devices, and run the desired operation. For a continued operation, the user can power off the drives, then plug a new set of SSDs and run another operation.
The unit is configured with a dual boot capability to run under Linux and Win8.1. The Windows side is mostly used with third-party applications, such as Cellebrite for cellphone data extraction; Encase, Nuix, FTK, and Paraben for Forensic analysis; ADF for Forensic triage; Wireshark for network packet analysis, and more.
This solution is also supplied with a Thunderbolt 3.0 to PCIE compact Expansion Box with a PCIE SATA controller having four eSATA ports. Each of the eSATA ports can run at up to 30GB/min, which brings the complete solution to a total of seven SATA ports. The user also can plug various PCIE controllers in the Thunderbolt 3.0 box to support SAS, FC, SCSI, or more NVMe storage devices, or plug a 10Gb/s Ethernet card to connect to a fast network.
The SuperImager forensic application that runs under Linux supports the following operation: Selective Imaging (files and folders), Complete Imaging (Mirror Image, DD, E01/Ex01 with compression and multiple compression engines, Mixed Capture Mode of DD and E01), Virtual Drive Emulator, Encryption/Decryption on the fly, simultaneous HASH calculation (can run all the 3 HASH engines MD5, SHA-1/SHA-256 at the same time), Drive Sanitizing, File Viewing, Remote Capture from un-opened laptops and tablets (for Intel-based CPUs), Save or Capture to or from Network, Keyword Search and some user features such as remote access, scripting, and loading/saving unit settings.
*A speed test was performed using one source drive of Samsung 128HB MZVPW128HEGM and one Target drive of Samsung MZVPV512HDGL
