MSI Desktop 40 Drives Standalone Forensic Imaging Solution

MSI Desktop with 40 drives Forensic Imaging device:

40 SAS/SATA ports - Imaging 20 to 20 at the same time
Dual boot for Linux& Windows 10
Full Forensic Suite – Bit by bit Imaging, Encase & DD Imaging, 3 Hashing, Diagnostics

Call us for pricing

(No reviews yet) Write a Review

SKU:: MSI-0008-00A

Overview
Tech Specs
Reviews

MSI Desktop 40 Drives Standalone Forensic Imaging Solution

The MSI Desktop 40 Drives Standalone Forensic Imaging Solution is a standalone forensic imaging with the ability to perform multiple Forensic tasks, allowing the Forensic investigator to capture data in the Lab from multiple source drives to multiple target drives simultaneously. It also enables the user to perform a full Forensic analysis using encase, Nuix Windows 10 application, or capture data from multiple cellphones and run cellphone analyses, or use any third-party Windows application. The unit is industrial and durably built, using a desktop-style, with easy to use touchscreen icons. The solution consist of the main unit with 8 SAS/SATA ports in open tray plus 10 USB3.1 ports, In addition it includes 2 cable-less Expansion Box each with 16 ports of SAS/SATA. The MSI’s main application (the unit’s software) supports many imaging methods like Mirror Image, Encase E01/Ex01, and Linux-DD.

Forensic Lab Unit (Linux) Features

Captures data from digital storages devices with many types of form factors and interfaces(2.5”, 3.5”, ZIF, MSATA, MicroSATA, M.2 SATA Ultra SATA, Slim SATA)
USB3.1 ports can be converted to SATA ports with the use of USB3.0 to SATA adapters (with the use of 4 ports USB KIT)
Previews data on the “Suspect” drive in secure environment
Captures and copy across many ports and interfaces
Simultaneously calculates HASH values with all the 3 MD5/SHA1/SHA2 at the same run
Automatic support for DCO/HPA special areas
Supports Bad Sector Handling (with 3 types of reporting)
Encryption/Decryption with AES256 on-the-fly
Supports capture mode of: 100% bit by bit mirror copy, Linux-DD files, E01, EX01 with full compression, Mix mode where the target drives can be mix of DD/E01, Selective Imaging of Files and Folders, Partition imaging, Keyword Search before the capture or while the capture
Supports Scripting to automate some operations
Supports SAS/SATA/e-SATA/USB/IDE/mSATA/MicroSATA/M.2 SATA

Here are some of the tasks the unit can be used for:

Multiple Parallel Forensic Capture: Mirror (bit by bit), Linux-DD, E01/Ex01 (with full compression) formats, Mixed-Format DD/E01, copy the whole drive or only parts
Run a Selective Imaging (Targeted Imaging) of files, folders, and partitions with file extensions filters (for example, run 8 independent sessions of E01 capture with 16 native SAS/SATA ports and 16 E01 compression engines simultaneously).
Perform Forensic Imaging from many Suspect drives to one large Evidence drive; in append mode (can perform forensic imaging from 15 Suspect drives to one large Evidence drive).
Upload many Forensic images to a network (SMB, CIFS, NFS).
Erase data from Evidence drive - using DoD (ECE, E), Security Erase, Enhanced Security, or Sanitize erase protocols.
View the data directly on the Ubuntu Desktop screen.
Encrypt the data while capturing (using the AES256 engine).
HASH the data while capturing – run all the three, SHA-1, SHA-2, and MD5 HASH engines, at the same time.
Run a quick Keyword Search on the Suspect drive prior to capture.
Run Multiple Cellphone/Tablets data Extraction and Analysis using a third-party application on the Windows 10 side.
Run Forensic Triage application using a third-party application on the Windows 10 side, prepare Forensic Triage keys, and view the captured targeted data.
Run a full Forensic Analysis application like Encase/Nuix/FTK.
Run Virtual Drive Emulator prior to the data being captured on the Linux side (this option is enabled on this unit).
Encryption and Decryption on the fly of drives that contain sensitive information.
Easily reconfigure the unit’s ports, where each of the target port can be configured as source or target for running 8:8 sessions, or to run an upload of 16 storages to a network.
Convert the unit’s 10 USB3.1 ports to SATA ports and run more parallel sessions (with the use of some USB3.0 to SATA adapters).
New feature - Use the MSI unit as a “Write Blocker” device: This new feature enables the MSI unit to function as a secure bridge between workstations on a network to Suspect drives attached to the MSI unit by using the iSCSI protocol over a network connection.

A forensic investigator using a workstation or laptop in one location can access a Suspect drive in different locations in the Write block mode. The unit is not expandable.

The MSI unit will be connected to the same network and the Suspect drives will be attached to the MSI unit in read-only mode. The MSI unit will act as a “write blocker” for any of the unit’s attached storages, such as: SAS, SATA, USB, 1394, FC, SCSI, and NVMe.

The unit is designed to help expedite the forensic imaging process, especially in facilities where there is a large backlog in imaging drives, by performing many parallel forensic imaging in a true optimized multiple session's application. The advantage of this unit is that it supports imaging from mix media of SAS/SATA/USB.

Main Hardware Features:
Case:	Desktop, Industrial
CPU:	i9 Latest Generation Quad Core Mobile CPU
Display:	10”, LED back-light, touchscreen, color LCD display.
8 Channel HDD Open Tray:	Easy to insert and plug tray that accommodates any size and shape of SAS/SATA drives or storage devices; contains power status LED indicators.
Hardware:	Very high-quality, high performing components; some with military specifications
Dual Boot (included):	Data Capture Under Linux: Performs Forensic Imaging under Linux for a faster, more efficient, and more secure operation. Analyze the Captured Data under Windows 10: Reboot the unit to Windows and use third-party applications to perform data analysis and other tasks.
Security:	Linux OS (Linux is less targeted by malware).
Application Updates:	The application can easily be updated via USB thumb drive and displays a special update application screen.
Hardware Upgrade:	The unit can be upgraded at the time of purchasing for additional cost to a larger internal SSD.
Hardware Specifications:
RAM:	32GB DDR4 internal memory
Storage controller:	LSI Controller
Internal Storage:	250GB SSD
Hardware Supports:
Source Ports:	One SAS/SATA port, and one USB3.0/USB3.1 ports are set as source ports (the user cannot change the role of these ports).
Supports Storage Protocols and Interfaces:	SATA, e-SATA enclosures, IDE, USB2.0, USB3.0/3.1, MMC, and M.2 (SATA)
Supports Form Factors:	3.5", 2.5", ZIF, 1.8", Micro-SATA, Mini-SATA, Slim SATA, Ultra Slim SATA, M.2 NGFF, and CF-30.
Target Ports:	39 SAS/SATA ports, one e-SATA port, and 9 USB3.0/USB3.1 ports.
Application Settings:
HPA/DCO Automatic Supports:	The application has the ability to automatically open HPA and DCO areas and re-size the drive to its full native capacity in order to erase any “hidden data” (HPA/DCO are special areas on the drive that support this feature).
Bad Sectors Handling:	The user can select to skip bad sectors/blocks or abort the operation when it encounters bad sectors/blocks on the source drive.
48bit LBA Addressing:	Supports drives with sizes up to 256TB.
Application Features:
GUI:	The application is built with large, very simple, and easy-to-navigate icons. In a few clicks, the user can set the operation, and it will quickly start up and run.
Speed:	Extremely fast operation Tested with a single erase pass operation, the speed for 8 WD Blue 1TB drives, in 8 separate sessions running simultaneously, was 8.2GB/min. Tested with a single erase pass, the speed of 8 120GB SanDisk Extreme II, in 8 separate sessions running simultaneously, was 29GB/min.
Application Main Operation:
Forensic Imaging Mode Forensic Platform Data Eraser and Format HASH Calculation Authentication and Verification Network Forensic Imaging Mode: Mirror imaging bit by bit (100% or any % of the drive), DD, E01/Ex01 – with optional compression, Selective Capture (Capture Partitions, Files and Folders, and with the use of file extension filters), Mix-Format of DD/E01/Ex01, selecting one partition capture. Targeted Imaging: Sometimes the forensic investigator does not have the time to do a full data capture of the Suspect drive. Now the user can use the Selective Imaging feature to select only partitions, files, or folders (like the Windows User-Folders or Windows User-Documents and User-Pictures). With the use of preset file extension filters or adding its own filters, the Forensic Investigator can narrow their capture scope and shorten its acquisition time. Forensic Restore: Back up the data that was captured to another drive in the original format. Forensic Images Formats: Mirror Image Formats 100% Bit by Bit Mirror copy. Linux-DD Format. Encase E01/Ex01 Formats (includes options for optimizing the compression by adjusting the compression level and the number of compression parallel engines) and Mix-Format of E01/Ex01/Linux-DD. Mix-Format is where the user can capture from one source drive and save the images onto multiple destination ports; each target port can be selected to be one of the 3 E01/Ex01/Linux-DD. In addition, the user can use a file-based copy to copy files and folders by using selective imaging with file extension filters. Single partition capture. Drive Spanning: Supports spanning the captured data onto many “Evidence” drives when the Evidence drives are not large enough (also supports restore images that are spanned over multiple drives). Encryption: On-the-fly AES256 encryption of the “Suspect” drive, saving the encrypted data on the “Evidence” drive in 100%, DD, E01/Ex01 formats. Decryption: The user can perform decryption on a drive that has been previously encrypted by any of the MSI units. Alternatively, the user can use a standalone Linux decryption utility application to perform decryptions on an encrypted drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the Linux decryption utility application, where the encrypted drive and a blank destination drive are attached to the PC (the user needs to supply to the utility application the saved encryption key). Forensic Imaging Tool: In one read-pass from the “Suspect” drive, the MSI Plus application can run the following operations simultaneously: Forensic imaging with E01 format and full compression, Encryption with AES256, calculate 3 HASH Verification and Authentication values (MD5, SHA1, SHA2), save the captured Forensic Images to 2 “Evidence” drives to a local network, and external compact USB3.0/e-SATA TB RAID encrypted storage. The basic Forensic Imaging mode can be 1:1, 1:2, 1:3, 1:4, 2:2, 2:3 and up to 3:3 for SATA, 2:4 for USB3.0 storage devices, and 1:1 for NVMe. Extreme Speeds when performing Forensic capture with E01/Ex01 formats and full Compression: The new Linux-based MSI Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations while also performing at incredibly high speeds with E01/Ex01 formats and full compression. The application allows the user to manually select and adjust the number of hyper-threads and the level of compression used during each session. Forensic data captured with Encase E01/Ex01 formats with full compression is widely used for operations in the forensic industry and generally requires a trade-off between speed, space, and time of decompression by the Encase application. Comparative tests show a 20% increase in speed when using the MSI Plus Linux-based application over the MSI Windows-based application. The tests were performed with the same hardware, the same hard disk drives (filled 43% of the drive with random data), and the same level 1 compression. The Linux-based application was set to use 16 compression threads.
Parallel Operations:
Multiple Session Operation: Versatility with Multiple Cloning Sessions: The user can assign and select one source and many target ports into one session of cloning. Also, the user can have many sessions of cloning; each will have one source drive and at least one target drive. This gives the user more possibilities to use the unit in a very efficient way. The user can run multiple, simultaneous, parallel operations using any available ports. Also, the user can combine more than one port/storage device to run in the same sessions. In addition, the user can mix different types of operations, and each operation is set as a new independent session. An example of operations: Erase data from a drive that is connected to the first port, quick copy using drives connected to ports 2 and 3, and so on. Multiple Sessions Application Screen: All running sessions are displayed in one “Application Screen”. The “Application Screen” shows the name of the session, the operation of the session, the error or abortion flag, the progress completion bar, and the successful completion flag. The user can abort a session, tap on a session to monitor its real-time running progress, and get the specific detailed setting for that run. It is a very easy way to view, navigate, and control the sessions. Drive Detection Application Screen: All drives and storage devices that are connected to the unit will be scanned and displayed in one application screen called “The Detection Screen”. The user can tap on each drive to get the drives detailed info, perform a specific operation on that drive, like resizing it, as well as select it for the desired operation they are planning to use.
Options:	USB3.0 to SATA Adapters and Kits Option: Today USB3.0 technology is extremely fast and can run read data from SSD drives up to 20GB/min. With the use of USB3.0 to SATA 4 channel Kit, the user can convert 4 USB3.0 ports to 4 SATA ports. The optional Kit is supplied with one external PS and it includes all the cabling to power and connect the 4 USB3.0 ports to SATA adapters. The tested performance of the unit, when running 4 adapters in parallel, was measured at a very high speed and with very little speed degradation. Built-in the US: The units are built and tested in the US. Warranty: One-year free warranty on the main unit (this does not include warranty or accessories, adapters, and cables).
Ports:	Native SAS/SATA: 40 Ports (8 ports on the main unit and additional two of 16 SAS/SATA cable-less ports on the Expansion Box, allowing for a total of 40 SAS/SATA ports). Native USB3.1: 10 Ports (all these ports can also be used as hosts to plug in and use a keyboard, mouse, or other peripherals; 1 USB3.1 Gen2 Type-C port with double the speed). e-SATA: 1 Port (connected directly to the motherboard). Generic USB2.0: 1 Port 1Gigabit/s Ethernet: 1 Port HDMI: 1 Port DP: 1 Port Location of the Ports: Front Panel: 4 USB3.0/3.1 Type-A ports, 1 e-SATA port, 8 SAS/SATA ports, and 1 USB2.0 port. Back Panel: 1 HDMI port, 1 DP, 1 USB3.1 Type-C Gen2 port, 5 USB3.0/3.1 Type-A ports, and 1 RJ45 1 Gigabit/s Ethernet. Add-on: the 8 SAS/SATA Expansion box with cableless ports.
Power Characteristics	A built-in universal auto switching 700W UL/CE/PSE power supply with an Input voltage:of 100-240V/50-60HZ.
Operating Environment:	Temperature: 5°C - 55°C (40°F-130°F) Relative humidity: 20-60% non-condensing.
Mechanical Characteristics	Total Solution Net Weight: 75 lbs 8-ports open tray dimensions: 11” x 6” x 2” (the user will have to attach the display pad to the main unit). Main unit open tray dimensions: 16.0” x 15.0" x 4.0" (400 x 380 x 100 mm) Each 16 drive Expansion Box dimensions: 17” x 14” x 6.5” (the user will have to attach the display pad to the main unit).
Included Items:	8 SAS/SATA 29 Pins male to female power and data combo cables with secure locking connection.

Custom Field

MSI Desktop with 40 drives Forensic Imaging device

40 SAS/SATA ports - Imaging 20 to 20 at the same time
Dual boot for Linux& Windows 10
Full Forensic Suite – Bit by bit Imaging, Encase & DD Imaging, 3 Hashing, Diagnostics

Product Reviews

Write a Review