MSI Plus T3 Portable Forensic Imaging Unit with i7 Thunderbolt and NVMe Ports

MSI Plus T3 Portable Forensic Imaging Unit with i7 Thunderbolt and NVMe Ports

The MSI Plus T3 Portable Forensic NVMe + SATS/SATA unit is a forensic imager with the ability to perform in the field multiple Forensic tasks, allowing the Forensic investigator to capture data from multiple source drives, with supports to many kinds of storage interfaces, to multiple target drives simultaneously and extremely fast. It also enables the user to perform a full Forensic analysis in the field by using EnCase, Nuix, or any other analysis application for Windows 10, perform extraction and analysis of data from multiple cellphones, or use and run any third-party Windows 10 application. The unit is compact and easy to carry, with built-in 4 ports of SAS/SATA (with a secure connector), 1 port of e-SATA, 8 ports of USB3.0/3.1, 1 port of Thunderbolt 3.0 (40Gigabit/s), and it is supplied with a Thunderbolt 3.0 Expansion box with 1394A/B and NVMe M.2 controllers that plug inside the TB 3.0 box and provides supports to those interfaces. Additionally, the Thunderbolt port and the Thunderbolt 3.0 Expansion box allows the user to capture data from Mac, save captured images to a network via 10Gigabit/s Ethernet, or, with the use of other storage controllers such as SCSI, FC, add-on more SAS, and more, to capture data from almost any type of storage interface.

The MSI’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, and Linux-DD. Here are some of the tasks that the unit can be used for:

1. Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only parts. Add more capture capabilities with the use of fast USB3.1 to SATA adapters.
2. Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extensions filters.
3. Erase data from Evidence drive - using DoD (ECE, E), Security Erase, Enhanced Security, or Sanitize erase protocols.
4. View the captured data directly on the Ubuntu Desktop screen or the Windows screen.
5. Encrypt the data while capturing (using the AES256 engine).
6. HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.
7. Run a quick Keyword Search on the Suspect drive prior to capture.
8. Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
9. Run Forensic Triage application using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.
10. Run a full Forensic Analysis application like Encase/Nuix/FTK (Windows side).
11. Run Virtual Drive Emulator prior to the data being captured on the Linux side (this option is enabled on this unit).
12. Run Remote Capture from unopened laptops (Intel based CPU). Supplied with this unit.
13. Use the Thunderbolt 3.0 port to capture data from USB3.1 Gen2 storage devices, Mac via Thunderbolt 2/3 port or 1394 port.
14. New feature - Use the MSI unit as a “Write Blocker” device: This new feature enables the MSI unit to function as a secure bridge between workstations on a network to Suspect drives attached to the MSI unit by using the iSCSI protocol over a network connection.
    A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode.
    The MSI unit will be connected to the same network and the Suspect drives will be attached to the MSI unit in read-only mode. The MSI unit will act as a “write blocker” for any of the unit’s attached storages, such as: SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

Additional operations that are available include HASH a drive, drive diagnostics, and scripting.
The application supports forensic imaging of multiple drives, in multiple sessions, in simultaneous forensic imaging runs.

The unit is supplied with 2 NVMe U.2 to M.2 adapters, 2.5” NVMe cables, and a TB3.0 to PCIE Expansion Box with NVMe M.2 controller, 1394A/B, Remote capture KIT, and Virtual Emulators option is enabled.

Application Features

• Captures data from storage devices with many types of form factors and interfaces (2.5”, 3.5”, ZIF, M.2, MSATA, Micro SATA, Ultra-slim SATA)
• USB3.0/3.1 ports can be converted to SATA ports with the use of USB3.0 to SATA adapters (4 ports USB KIT)
• Preview data on the “Suspect” drive in a secure environment
• Captures and saves images across many ports and interfaces
• Basic Captures modes 1:1, 1:2, 2:2 SAS/SATA and same with USB
• Supports capture modes: % (adjustable) bit by bit Mirror copy, Linux-DD files, E01, EX01 with up to 16 compression engines
• Targeted Imaging: Select Files and Folders to capture data very quick
• Forensic image from multiple “Suspect” drives to one large “Evidence” drive
• Simultaneously calculates HASH values: MD5/SHA1/SHA2
• The application is flexible in assigning role of Source for Evidence port
• Automatic supports for DCO/HPA areas and Supports bad sector handling
• Encryption AES256 on-the-fly and decrypt at remote location
• Supports save Forensic Images (E01/DD) to a Network (NFS, CIFS, SAMBA), and capture from a Network via iSCSI storage protocols
• Evidence drive can be formatted: ExFAT/FAT/NTFS/EX2-4
• Remote-Capture data from an Un-Open Laptop/PC Via USB or Ethernet ports
• Use the unit as a “write blocker” bridge uploading or preview a storage attached to the unit, when connecting to the network
• Remote Capture from un open laptops/PC Via USB or Ethernet ports

The user can perform in a single run:

• Ex01/E01 formats with full compression
• Simultaneously calculate 3 Hash values: MD5, SHA-1, SHA-2
• Encryption/Decryption with AES256

The unit Operates as a Platform:

• Load and use a third-party Cell phone data extraction and analysis tools
• Triage data collection tool
• Full Analysis sucj as an Encase, Nuix, FTK, P2 Commander 

MSI Plus 8" T3 unit with i7 CPU, 16GB Memory, and S/W Version 1.6.73