|
ImageMASSter
Solo-4 Forensic
Image MASSter
Solo-4 offers investigators the ability to image one "Suspect"
to two "Evidence" drives or two separate "Suspect" drives to
individual "Evidence" copies simultaneously.
At SATA-2
speed, the Image MASSter Solo-4 offers investigators the ability
to image one "Suspect" to two "Evidence" drives or two separate
"Suspect" drives to individual "Evidence" copies
simultaneously. The
Image MASSter Solo-4 features built-in support for SAS, SATA and
USB drives. It authenticates with SHA-1, SHA-2 and MD5. It also
supports IDE, RAID, e-SATA drives as well as a variety of Micro
Media cards. All "Evidence" can be saved as 100% copies, Linux
DD images or E01 image files. All "Evidence" drives can be
encrypted "on-the-fly" during the acquisition process to protect
sensitive data during transportation or storage. The unit also
offers a built-in Gigabit Ethernet connection allowing users to
upload images to Storage Area Networks (SAN) for the purpose of
processing and archiving images.
|
Features |
|
.: Extreme Speed Built for Today's and
Tomorrow's Hard Drive Technology: Built to work
with the fastest hard drives available, Solo-4
captures, authenticates and sanitizes at SATA-2 speed
(18 GB/min top capability). This technology not only
allows the unit to take advantage of today's fastest
hard drive speeds but also allows the user to be
prepared for tomorrow's future hard drive speed
improvements.
.: Multiple "Suspect" Side Connections: 2
SATA/SAS connections and 2 USB 2.0 connections (Operator
can choose to use either the SAS/SATA connection or the
USB connection for each of the two
"Suspect" positions) Unit features built-in support for
imaging of a RAID drive pair (0,1,JBOD).
IDE drive adapter included. Optional drive adapters for
1.8", 2.5" ZIF, and proprietary interface/Laptop drives,
and Micro Media Cards including Compact Flash,
Memory Sticks, SD, Micro SD, MultiMedia cards, etc.Cross
Copy support allows user to image any "Suspect" Drive
interface to any "Evidence" Drive Interface. ( ie. IDE
"Suspect" drive to a SATA "Evidence" drive)
All "Suspect" Drive connections are permanently
write-protected at all times to prevent changing of
"Suspect" Data (cannot be disabled)
.: Multiple "Evidence" Side Connections:
2 SATA/SAS connections and 2 USB 2.0 connections.
Optional Drive Adapters will allow imaging to many other
drive formats including external RAID devices.
.: Multiple Operational Modes:
Captures "Suspect" drives to one "Evidence" Drive
(Single Copy Mode), Captures "Suspect" drive to two
"Evidence" drives (Multi Copy Mode), Captures
two "Suspect" Drives to two "Evidence Drives (Parallel
Copy), Drive Wiping and Sanitization, Drive Hashing
(SHA-1, SHA-2). All processes are done simultaneously
with no speed degradation.
.: Multiple Imaging Formats: 100% Copy
(bit-by-bit), Linux DD images (industry standard), and
E01 imaging files (EnCase forensic file format) on
a "Evidence" Hard Drive or USB storage device. User can
define the size of the Linux DD segments.
.: Multiple File Format Support: Seize
Data using Raw Mirror Capture Format, Raw Segment File
Format or Encase (E01) File Format.
.: "On the fly" Drive Image Encryption: Built-in
DiskCypher technology allows the full encryption (AES
192/256) of Forensic Images. The process is done without
speed degradation during the acquisition process.
.: Windows XP Operating System: Solo-4
runs on the highly stable and proven Windows XP
Operating System. Unit can be customized to individual
organization needs upon request.
.: Drive Spanning: Solo-4 allows for
the imaging from one large "Suspect" Drive to multiple
smaller "Evidence" Drives.
.: Image Restore: Restore a previously
captured DD or E01 Image to a fully bootable 100%
working copy.
.: Drive Wiping: Supports single pass
or full DoD Sanitization.
.: Multiple Hash Verifications: SHA-1,
SHA-2, MD-5 of the Suspect Hard Drive and DD Images
.: Uploads "Suspect" Images to Network Storage:
Solo-4 forensically uploads "Suspect" Data Images to
Networked Storage Area using 1 Gigabit Ethernet
Connection for the purpose of processing and archiving
forensic images.
.: Preview "Suspect" Data directly on the unit: Preview
active files on the "Suspect" Drive utilizing Windows XP
file viewers. |
|
Software |
|
The
following Software features come standard with the IM
Solo-4 Forensic unit:
.: Device Configuration Overlay (DCO) :
DCO can be used to hide and protect a portion of the
drive’s area from the operating system and file system.
If DCO is detected on a Suspect’s drive, the IM Solo-3 Forensic's
seizure operation will capture the DCO hidden sectors.
.: Host Protected Area (HPA) :
An HPA area may exist on a drive, hiding a certain
portion of the drive’s contents from the operating
system and file system. If an HPA area exists on a
Suspect’s drive, the IM Solo-3 Forensic's seizure
operation will detect and capture data from the HPA
area.
.: WipeOut DoD :
WipeOut was designed to meet the U.S. Department of
Defense specification DOD 5220-22M regarding the
sanitization of hard disk drive data. Three iterations
are performed to completely erase data and the contents
of a hard disk drive. Each iteration makes two write
passes over the entire drive.
.: WipeOut Fast :
The WipeOut Fast option provides a quick non-DoD method
of sanitizing a drive of all previously stored data.
.: Linux-DD Capture :
The LinuxDD Capture option captures data as individual
“LinuxDD” segmented files. This option also allows
multiple data capture to be performed using the same
Evidence drive.
.: E01 Capture : Supports imaging
to EnCase forensic image file
.: Image Restore:
Restore a previously captured DD Image or E01 imaging
files to a fully bootable 100% working copy.
.: Linux DD Hashing:
Hashes DD Images
.: 100% Copy:
Bit-by-bit Copy
.: "On the fly" Drive Image
Encryption: Built-in
DiskCypher software allows the encryption of "Evidence"
Images during the acquisiton phase.
.: Multiple File Format
Support: Seize Data using
Raw Mirror Capture Format, Raw Segment File Format or
Encase (E01) File Format. The Mirror Capture Format
transfers data to the Destination drive using the same
LBA location which was read from the Source Drive. The
Raw Segment File Format creates an NTFS partition on the
Destination Drive and transfers data as Raw Segment
files to a Destination folder. The Encase (E01) Segment
file format creates an NTFS partition on the Destination
drive and transfers data using the Encase Segment file
format, to a destination folder. The Segment files size
can be defined as 640 MB, 1GB, 2GB, 4.7GB, Whole Drive
or Custom Size. |
|
Network Connectivity Disclaimer |
|
Image
MASSter™ Solo-4 Internet/Network Connection Disclaimer
Intelligent Computer
Solutions, Inc. (ICS) assumes no liability for the
security of the customer’s computer/network systems. ICS
assumes no liability for the security of the Image
MASSter™ Solo-4 when it is connected to either the
Internet or another Network. Utilizing the Image
MASSter™ Solo-4 for to upload data to a network requires
the unit to be connected to the network and this may
cause a risk of the system being compromised. The user
is responsible for taking the necessary steps to ensure
the safety of both the Image MASSter™ Solo-4 and the
network in use when the unit is utilized to upload data
to a network.
The security of the
Image MASSter Solo-4™ when connected to the Internet or
a network relies on the user’s discretion; however, ICS
recommends, at a minimum, to the user to take the
following steps:
The Image MASSter™
Solo-4 is set to have Internet Connection and Automatic
Windows Updates disabled as default. Users will need to
enable Internet Connection when uploading data to a
network. It is highly recommended that the user install
anti-virus and firewall Hardware Device protection prior
to connecting the Image MASSter™ Solo-4 to either the
Internet or a network. A lesser protection can be
achieved with personal firewall software. Continuously
running an updated version of anti-virus software with
the Image MASSter™ Solo-4 may help prevent an intrusion
into the unit or network. ICS recommends updating the
anti-virus software program every time the Image
MASSter™ Solo-4 is connected to the Internet or a
network.
Users should always
utilize a clean (scanned for viruses)
USB Thumb Drive when updating
the Image MASSter™ Solo-4 unit Software or Firmware.
Users should ONLY
connect the Image MASSter™ Solo-4 to a network when
uploading data. It is imperative for users to REMOVE the
Image MASSter™ Solo-4 connection when not actively
performing these tasks.
These recommendations
are provided to the user as a reference; however ICS
cannot assure that the Image MASSter™ Solo-4 will not
become compromised when connected to the Internet or a
network. User assumes all responsibility for the data
and security of the Network. |
|