MSI Plus Forensic Portable Unit NVMe and SATA mix ports

• Data Capture Under Linux: Performs Forensic Imaging under Linux for a faster, more efficient, and more secure operation. 
• Analyze the Captured Data under Windows 10: Reboot the unit to Windows and use third-party applications to perform data analysis and other tasks.

• Forensic Imaging Mode
• Complete Forensic Platform
• Data Eraser and Format
• HASH Calculation Authentication and Verification
• Network

Forensic Imaging Mode:

• Mirror imaging bit by bit (100% or any % of the drive), DD, E01/Ex01 – with optional compression, Selective Capture (Capture Partitions, Files and Folders, and with the use of file extension filters), Mix-Format of DD/E01/Ex01, selecting one partition capture.
• Targeted Imaging: Sometimes the forensic investigator does not have the time to do a full data capture of the Suspect drive. Now the user can use the Selective Imaging feature to select only partitions, files, or folders (like the Windows User-Folders or Windows User-Documents and User-Pictures). With the use of preset file extension filters or adding its own filters, the Forensic Investigator can narrow their capture scope and shorten its acquisition time.
• Forensic Restore: Back up the data that was captured to another drive in the original format.
• Forensic Images Formats:
• Mirror Image Formats 100% Bit by Bit Mirror copy.
• Linux-DD Format.
• Encase E01/Ex01 Formats (includes options for optimizing the compression by adjusting the compression level and the number of compression parallel engines) and Mix-Format of E01/Ex01/Linux-DD.
• Mix-Format is where the user can capture from one source drive and save the images onto multiple destination ports; each target port can be selected to be one of the 3 E01/Ex01/Linux-DD.
• In addition, the user can use a file-based copy to copy files and folders by using selective imaging with file extension filters.
• Single partition capture.
• Drive Spanning: Supports spanning the captured data onto many “Evidence” drives when the Evidence drives are not large enough (also supports restore images that are spanned over multiple drives).
• Encryption: On-the-fly AES256 encryption of the “Suspect” drive, saving the encrypted data on the “Evidence” drive in 100%, DD, E01/Ex01 formats.
• Decryption: The user can perform decryption on a drive that has been previously encrypted by any of the MSI units. Alternatively, the user can use a standalone Linux decryption utility application to perform decryptions on an encrypted drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the Linux decryption utility application, where the encrypted drive and a blank destination drive are attached to the PC (the user needs to supply to the utility application the saved encryption key).
• Forensic Imaging Tool: In one read-pass from the “Suspect” drive, the MSI Plus application can run the following operations simultaneously: Forensic imaging with E01 format and full compression, Encryption with AES256, calculate 3 HASH Verification and Authentication values (MD5, SHA1, SHA2), save the captured Forensic Images to 2 “Evidence” drives to a local network, and external compact USB3.0/e-SATA TB RAID encrypted storage. The basic Forensic Imaging mode can be 1:1, 1:2, 1:3, 1:4, 2:2, 2:3 and up to 3:3 for SATA, 2:4 for USB3.0 storage devices, and 1:1 for NVMe.
• Extreme Speeds when performing Forensic capture with E01/Ex01 formats and full Compression:
• The new Linux-based MSI Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations while also performing at incredibly high speeds with E01/Ex01 formats and full compression. The application allows the user to manually select and adjust the number of hyper-threads and the level of compression used during each session.
• Forensic data captured with Encase E01/Ex01 formats with full compression is widely used for operations in the forensic industry and generally requires a trade-off between speed, space, and time of decompression by the Encase application.
• Comparative tests show a 20% increase in speed when using the MSI Plus Linux-based application over the MSI Windows-based application. The tests were performed with the same hardware, the same hard disk drives (filled 43% of the drive with random data), and the same level 1 compression. The Linux-based application was set to use 16 compression threads.

• The user can erase drives and USB3.0 storage devices by using the unit’s 2 SATA ports and 8 USB3.0 ports. The application supports DoD erase (Full, Lite), Security Erase, Enhanced Security Erase, and Sanitize erase protocols. DoD (Full and Lite) are NIST 800-88 compliant. The rest of the erase protocols need to be run with verify pass in order for them to be NIST 800-88 compliant. The application also supports the user erase mode with verification pass and the erase verification mode for drives that were previously erase by a third-party application or tool.
• Erase the Evidence drive prior to use (with extremely fast speed of up to 28GB/min with the use of SSD and up to 11GB/min with the use of HDD).
• Erase the remainder of the drive after the copy.
• Drive Erase Protocols:DoD 5220-22M, Security Erase, Enhanced Security Erase, Sanitize, NVMe Secure Erase, or a User-erase mode where the user can define the final data filling pattern and the number of iterations (Security Erase, Enhanced Security Erase, Sanitize, and DoD erase protocols are all NIST 800-88 compliant).
• Format: NTFS, FAT, HFS+, EXT4, and exFAT.
• Erase Logs and Erase Certification: The application generates extensive erase logs and files with an NIST 800-88 erase certification (also runs S.M.A.R.T. tests before and after the erase operation and is saved to XML file format) which can be exported to a USB thumb drive. The application also has a built-in erase database that can easily be exported to XLS.
• Evidence Drive Formats: exFAT/FAT/NTFS/HFS+/EXT4.
• Audit trail and operation Log Files: Generated automatically by the application and saves it on the Evidence/Target drive (PDF).

• Detection Application Screen: All drives and storage devices that are connected to the unit will be “scanned” and displayed in one application screen called “The Detection Screen”. The user can tap on each drive to get its detailed info and run some specific utilities regarding that drive (as long as it is a target drive) – like a quick S.M.A.R.T. test (only using the “Target” port), run a Virtual Emulator (“Source” port), safely preview the contents of the drive (“Source” port), as well as select it for any desired operation they are planning to use.
• Parallel Forensic Imaging: This depends on the number and kind of ports that each model has. The application is very flexible in running multiple sources to multiple destinations, all in simultaneous operations. The user has the flexibility to change a port’s role from “Evidence” to “Suspect” port. The session control application screen provides the user with comprehensive information and direct control over the running sessions, including all the settings of the session and the ability to abort the session.

• Thunderbolt 3.0 to PCIE Expansion Box Option Included: Since the unit has a fast Thunderbolt port that can run up to 40Gigabit/s, an important feature is the Thunderbolt 3.0 to PCIE Expansion Box. The Expansion Box enables the user to add different storage controllers and capture data from other storage protocols, such as SAS, SCSI, and FC. In addition, the user can add 10Gigabit/s Ethernet for faster network connection in order to upload forensic images to a network.
• USB3.0 to SATA Adapters and Kits Option: Today USB3.0 technology is extremely fast and can run read data from SSD drives up to 20GB/min. With the use of the USB3.0 to SATA 4 channel Kit, the user can convert 4 USB3.0 ports to 4 SATA ports.
• M.2 SATA to SATA Adapter
• Macbook Memory and SSD adapters

• SCSI KIT Option: The SCSI Kit includes the low profile PCIE X1 SCSI controller with single port, 2 channel SCSI LVDS cables (68pin connectors), SCSI terminator, VHDCI to SCSI 2 adapter, and supports 2 SCSI Hard Disk Drives.
• 1394 KIT Option: The 1394 Kit includes the controller with dual 1394B and one 1394 ports and cables. 1394 storage devices can easily be daisy chained.
• NVMe M.2 to PCIE Card: Add one more M.2 NVMe port.
• NVMe Complete KIT: Includes supports to NVMe M.2, U.2, and PCIE NVMe cards.
• 10Gigabit/s: Network card.
• Built in the US: The units are built and tested in the US.
• Warranty: One-year free warranty on the main unit (does not include warranty on accessories, adapters, and cables).

• A built-in, universal, auto switching 300W UL/CE/PSE external power supply adapter with a key and lock-in mechanism to avoid accidental disconnection.
• Input Voltage: 100-240V/50-60Hz.

• Unit net weight: 5.50 lbs
• Unit dimensions: 10.6”L x 7.70"W x 3.15"D (270 x 194 x 80 mm).