MSI Mini Portable Drive Imaging Unit

Computer Forensic Imaging & Cellphone Data Extraction:

Very small form factor, portable, easy to carry
3 SATA ports for Forensic Imaging 1:2
Dual boot Linux/Win10
multiple cellphone data extraction using Win10 and multiple USB ports

Call us for pricing

(No reviews yet) Write a Review

SKU:: MSI-0004-00A-1

Overview
Tech Specs
Reviews

MSI Mini Portable Drive Imaging Unit

The MSI Plus Mini Forensic unit is a Portable forensic imager with the ability to perform multiple Forensic tasks, allowing the Forensic investigator to capture data in the field from multiple source drives to multiple target drives simultaneously and extremely fast. It also enables the user capture data from multiple cellphones and run cellphone analyses, or any third-party application. The unit is compact and easy to carry, with built-in 3 SATA (with a secure and keyed SATA power connector) and 4 USB3.0 ports, 1 port of 1Gigabit/s Ethernet, and 1 port of HDMI.
The MSI’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, and Linux-DD. Here are some of the tasks that the unit can be used for:

Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, and Selective Capture (files and folders with the use of file extension filters). Select a single partition to capture.
Erase data from Evidence drive - using DoD (ECE, E), Security Erase, Enhanced Security, or Sanitize erase protocols.
View the data directly on the Ubuntu Desktop screen.
Encrypt the data while capturing (using the AES256 engine).
HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.
Run a quick Keyword Search on the Suspect drive prior to capture.
Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
Run Forensic Triage application using a third-party application on the Windows 10 side.
Run Virtual Drive Emulator prior to the data being captured on the Linux side.
Run Remote Capture from unopened laptops (Intel ased CPU).

Additional operations that are available include HASH a drive, drive diagnostics, and scripting.
The application supports forensic imaging of multiple drives, in multiple sessions, in simultaneous forensic imaging runs.

Dual Boot

For Data Capture: Perform Forensic Imaging under Linux for a faster, more efficient and a more secure operation
To Analyze the Data Captured:Reboot the unit to Windows
Use third-party applications to perform data analysis, or cellphone extraction

Fast & Affordable

Aquire data from:

HDD: SATA/IDE
Multi-Media Cards
SSD
USB Storage devices
M.2 NVMe (via USB)
Network

Application Features

Captures data from digital storages devices with many types of form factors and interfaces
Previews data from “Suspect” HDD in a secure environment
Captures and saves across many ports and interfaces
Includes easy navigation, and display of the multiple sessions
Forensic Imaging SATA 1:1, 1:2
Forensic Imaging USB3.0 1:1 up to 2:2
The application is flexible in assigning role of Source/Target for Evidence port
Simultaneously calculate three authentication Hash values: MD5/SHA1/ SHA2
Encryption/Decryption with AES 256 on-the-fly
Forensic Imaging modes: bit by bit, Linux-DD files, E01, EX01
Remote Capture Data from an un-open Laptop Via USB or Network ports
Supports “Evidence” drive formats: NTFS/exFAT/EXT4/HFS+
Save Forensic Images to Network, or Capture from Network via iSCSI storage protocols
Supports SATA, e-SATA, USB, IDE, Micro-SATA, Mini-SATA, M.2( NGFF) storage devices
Use USB3.0 to SATA adapters to converts

The user can perform in a single run:

Forensic Imaging with DD/Ex01/E01 formats, and with E01 full compression
Simultaneously calculate 3 Hash values: MD5, SHA-1, SHA-2
Encryption/Decryption with AES256

The unit Operates as a Platform:

Load and use a third-party Cell phone data extraction and analysis tools
Triage data collection tool
Writes Protects CF cards and Multi-Media Cards
Use the unit as a “Write Blockers” bridge, for any attached storage to the unit.

** Optional External Lithium-Polymer Battery

Main Hardware Features:
Case:	Desktop, Industrial
CPU:	i7 Latest Generation Quad Core Mobile CPU
Display:	10”, LED back-light, touchscreen, color LCD display.
8 Channel HDD Open Tray:	Easy to insert and plug tray that accommodates any size and shape of SAS/SATA drives or storage devices; contains power status LED indicators.
Hardware:	Very high-quality, high performing components; some with military specifications
Dual Boot (included):	Data Capture Under Linux: Performs Forensic Imaging under Linux for a faster, more efficient, and more secure operation. Analyze the Captured Data under Windows 10: Reboot the unit to Windows and use third-party applications to perform data analysis and other tasks.
Security:	Linux OS (Linux is less targeted by malware).
Application Updates:	The application can easily be updated via USB thumb drive and displays a special update application screen.
Hardware Upgrade:	The unit can be upgraded at the time of purchasing for additional cost to a larger internal SSD.
Hardware Specifications:
RAM:	32GB DDR4 internal memory
Storage controller:	SATA controller on the main board with a maximum data rate of 37GB/min.
Internal Storage:	250GB SSD
Hardware Supports:
Source Ports:	One NVMe port, and two USB3.0/USB3.1 ports are set as source ports (the user cannot change the role of these ports).
Supports Storage Protocols and Interfaces:	NVMe (M.2 U.2, PCIE), SATA, e-SATA enclosures, IDE, USB2.0, USB3.0/3.1, MMC, and M.2 SATA.
Supports Form Factors:	3.5”, 2.5”, ZIF, 1.8”, Micro-SATA, Mini-SATA, Slim SATA, Ultra Slim SATA, M.2 SATA, CF-30, NVMe U.2 2.5” and M.2. *With Optional controllers plugged into the Expansion Box.
Target Ports:	4 SATA ports, 3 NVMe ports, one e-SATA port, and 6 USB3.0/USB3.1 ports. In addition, the 4 e-SATA ports on the expansion box are set as target ports as well.
Application Settings:
HPA/DCO Automatic Supports:	The application has the ability to automatically open HPA and DCO areas and re-size the drive to its full native capacity in order to erase any “hidden data” (HPA/DCO are special areas on the drive that support this feature).
Bad Sectors Handling:	The user can select to skip bad sectors/blocks or abort the operation when it encounters bad sectors/blocks on the source drive.
48bit LBA Addressing:	Supports drives with sizes up to 256TB.
Forensic Images - Destination:	The user can save Forensic Images to any storage device attached to the SuperImager unit, or to any connected network, using the unit’s 1Gigabit/s port, the 10Gigabit Option, any external USB3.0 RAID (encryption is optional), or an external NAS storage at a very good speed.
Cross Copy from any Ports and any Interfaces:	The user can choose to capture from one port, with one type of storage protocol and interface, and save the forensic image onto a different storage protocol and interface using destination ports. The cross copy of data can be done between any of these interfaces – NVMe/SATA/IDE/USB3.0/3.1.
Application Features:
GUI:	The application is built with large, very simple, and easy-to-navigate icons. In a few clicks, the user can set the operation, and it will quickly start up and run.
Speed:	Very fast – one of the fastest Forensic Imaging solutions available on the market today, achieving a speed of above 30GB/min. Tested with HASH verification operation with SHA-1, the top recorded speed was 30GB/min with SSD and 10GB/min with 1 TB WD Blue SATA-3 Hard Disk Drives. Tested with Forensic Imaging operation of 1 to 2 with SHA-1, the top recorded speed was 29GB/min with 3 SSD of SanDisk 120GB Extreme II. Tested with Forensic Imaging NVMe 1:1 with Samsung MZVPV512HDGL SSD, the top recorded speed was 93.7GB/min.
Application Main Operation:
Forensic Imaging Mode Forensic Platform Data Eraser and Format HASH Calculation Authentication and Verification Network Forensic Imaging Mode: Mirror imaging bit by bit (100% or any % of the drive), DD, E01/Ex01 – with optional compression, Selective Capture (Capture Partitions, Files and Folders, and with the use of file extension filters), Mix-Format of DD/E01/Ex01, selecting one partition capture. Targeted Imaging: Sometimes the forensic investigator does not have the time to do a full data capture of the Suspect drive. Now the user can use the Selective Imaging feature to select only partitions, files, or folders (like the Windows User-Folders or Windows User-Documents and User-Pictures). With the use of preset file extension filters or adding its own filters, the Forensic Investigator can narrow their capture scope and shorten its acquisition time. Forensic Restore: Back up the data that was captured to another drive in the original format. Forensic Images Formats: Mirror Image Formats 100% Bit by Bit Mirror copy. Linux-DD Format. Encase E01/Ex01 Formats (includes options for optimizing the compression by adjusting the compression level and the number of compression parallel engines) and Mix-Format of E01/Ex01/Linux-DD. Mix-Format is where the user can capture from one source drive and save the images onto multiple destination ports; each target port can be selected to be one of the 3 E01/Ex01/Linux-DD. In addition, the user can use a file-based copy to copy files and folders by using selective imaging with file extension filters. Single partition capture. Drive Spanning: Supports spanning the captured data onto many “Evidence” drives when the Evidence drives are not large enough (also supports restore images that are spanned over multiple drives). Encryption: On-the-fly AES256 encryption of the “Suspect” drive, saving the encrypted data on the “Evidence” drive in 100%, DD, E01/Ex01 formats. Decryption: The user can perform decryption on a drive that has been previously encrypted by any of the SuperImager units. Alternatively, the user can use a standalone MediaClone Linux decryption utility application to perform decryptions on an encrypted drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the MediaClone Linux decryption utility application, where the encrypted drive and a blank destination drive are attached to the PC (the user needs to supply to the utility application the saved encryption key). MediaClone developed its own decryption utility application in order to make sure that the user can always decrypt the drive was were once encrypted via a MediaClone unit and not to rely on TruCrypt or other third-party applications that might not be supported in the future. Forensic Imaging Tool: In one read-pass from the “Suspect” drive, the SuperImager Plus application can run the following operations simultaneously: Forensic imaging with E01 format and full compression, Encryption with AES256, calculate 3 HASH Verification and Authentication values (MD5, SHA1, SHA2), save the captured Forensic Images to 2 “Evidence” drives to a local network, and external compact USB3.0/e-SATA TB RAID encrypted storage. The basic Forensic Imaging mode can be 1:1, 1:2, 1:3, 1:4, 2:2, 2:3 and up to 3:3 for SATA, 2:4 for USB3.0 storage devices, and 1:1 for NVMe. Extreme Speeds when performing Forensic capture with E01/Ex01 formats and full Compression: The new Linux-based SuperImager Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations while also performing at incredibly high speeds with E01/Ex01 formats and full compression. The application allows the user to manually select and adjust the number of hyperthreads and the level of compression used during each session. Forensic data captured with Encase E01/Ex01 formats with full compression is widely used for operations in the forensic industry and generally requires a trade-off between speed, space, and time of decompression by the Encase application. Comparative tests show a 20% increase in speed when using the MSI Plus Linux-based application over the SuperImager Windows-based application. The tests were performed with the same hardware, the same hard disk drives (filled 43% of the drive with random data), and the same level 1 compression. The Linux-based application was set to use 16 compression threads.
Parallel Operations:
Parallel Forensic Imaging – Multiple Session Operations: Improves the efficiency of the evidence data collection process by using multitasking and using a parallel imaging process. The user can take advantage of the SuperImager unit’s multiple available ports and run multiple, efficient, parallel operations. The user can mix different types of operations, and each operation can be set as a new independent session. An example of an operation: erase data from a drive connected to one port and HASH verify a different drive connected to the second port, all while performing forensic imagining of 1 to 1 on drives connected to the remaining ports. Basic Parallel Forensic Imaging: The supported modes are: NVMe: up to 2:2. SATA: up to 2:2. e-SATA: for the use of the e-SATA port, the user will need to supply external power to the e-SATA plugged device. USB3.0/3.1: up to 4:4. The user can mix any NVMe, USB3.0/3.1, and SATA ports. More Ports for Forensic Imaging: with the use of USB3.0 to SATA fast adapters and in combination with the unit’s e-SATA port, the unit can support more combinations of Forensic Imaging of SATA drives.
Expansion Capabilities and Main Hardware Options:	USB3.0 to SATA Adapters and Kits Option: Today USB3.0 technology is extremely fast and can run read data from SSD drives up to 20GB/min. With the use of USB3.0 to SATA 4 channel Kit, the user can convert 4 USB3.0 ports to 4 SATA ports. M.2 SATA to SATA adapter Macbook Memory and SSD adapters NVMe U.2 to PCIE adapters Built-in the US: The units are built and tested in the US. Warranty: One-year free warranty on the main unit (this does not include warranty or accessories, adapters, and cables).
Ports:	Native SAS/SATA: 4 Ports (2.5" SFF-8639). Native NVMe: 4 Ports Native USB3.0/3.1: 8 Ports (all these ports can also be used as hosts to plug in and use a keyboard, mouse, or other peripherals). e-SATA: 1 Port (connected directly to the motherboard). 1Gigabit/s Ethernet: 2 Ports HDMI: 1 Port DP: 1 Port Location of the Ports: Front Panel: 4 USB3.0/3.0 ports, 1 e-SATA port, 1 USB2.0 port. Back Panel: 4 USB ports, 1 HDMI port, 1 DP, and 1 Gigabit ports.
Power Characteristics	A built-in universal auto switching 700W UL/CE/PSE power supply with a key and lock-in mechanism to avoid accidental disconnection. Input voltage: 100-240V/50-60HZ.
Operating Environment:	Temperature: 5°C - 55°C (40°F-130°F) Relative humidity: 20-60% non-condensing.
Mechanical Characteristics	Unit: Dimensions: 16.0” x 15.0" x 4.0" (400 x 380 x 100 mm). 8-channel open tray dimensions: 11” x 6" x 2" (the user will have to attach the display pad to the main unit). net weight: 5.50 lbs Shipping Box Dimensions: 124” x 20” x 16”. Box weight: 35 lbs
Included Items:	4 NVMe 68 Pins male to female power and data combo cables with secure brackets, with secure locking connection, and M.2 NVMe External adapters with secure brackets. 4 SATA external cables with locking mechanism.

Custom Field

Computer Forensic Imaging & Cellphone Data Extraction

Very small form factor, portable, easy to carry
3 SATA ports for Forensic Imaging 1:2
Dual boot Linux/Win10
multiple cellphone data extraction using Win10 and multiple USB ports

Product Reviews

Write a Review