Forensic Imager & Uploader
Designed for digital forensic labs, the ZXi-Forensic’s blazing fast imaging speeds of over 50GB*/min and three Gigabit Ethernet ports streamline forensic imaging processes. The solution provides a network “Push” feature that allows users to upload images from up to 3 evidence drives directly to a network repository simultaneously. Add the optional 3 drive expansion kit to push up to a total of 5 evidence drives.
- Extreme speed, imaging at over 50GB/min*
- Designed for digital forensic labs
- Three Gigabit Ethernet ports
- Network “Push” feature to upload images to a network repository from 3 evidence drives simultaneously
- Image from 3 suspect drives to a network repository or to 3 evidence drives simultaneously
- Optional expansion kit adds 3 additional destination drives
Features :
High Speed Imaging
The ZXi-Forensic can achieve imaging speeds of over 50GB/min*.
Multi-Target, Volume Imaging
Image from 3 suspect drives simultaneously to network repositories using 3 Gigabit Ethernet connections; image from 3 source drives directly to 3 destination drives; image from 3 source drives to network repositories and simultaneously image to 3 destination hard drives. Use the optional expansion kit to add 3 additional destinations
Multiple Imaging Ports
Write-protected source ports include:
3 SAS/SATA
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
Destination ports include:
3 SAS/SATA
2 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
Imaging Formats
Supports dd, ex01, e01 or native imaging formats. The ZXi-Forensic supports SHA1, SHA256 or MD5 authentication. Dual hash ( SHA1+MD5) is planned for a future software release
Parallel Imaging
Simultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01 format.
Web Browser/Remote Operation
An easy to use and intuitive interface allows you to connect to the ZXi-Forensic from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.
Broad Interface Support
Built-in support for SAS/SATA/USB storage devices, including SSDs. Supports 1.8″/2.5″/3.5″ IDE and 1.8″ IDE ZIF, eSATA, mSATA, flash drives and microSATA interfaces with optional adapters.
Wipe
Wipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min.
Image From Desktop/Laptop PCs
Users have the ability to image from a desktop or laptop computer without removing the hard drive from the computer. Create a forensic bootable USB flash drive using software that allows the user to image a source drive from a computer on the same network without booting the native Operating System on the computer. It also allows drives connected to the networked computer (or directly connected to each other using a network cable) to appear as a destination drive without removing the drive from the computer.
Error Granularity Setting
Drive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found the ZXi-Forensic will, by default skip that sector. Changing the granularity allows more sectors to be skipped. There are 3 options ( 512 Bytes, 4096 Bytes, 64 KIB,). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the ZXi-F will skip the entire cluster (or 4096 bytes or 8 sectors).
Removable Storage Drive
O/S and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations
7″ Touch Screen
Uses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.
HPA And DCO Capture
Detect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.
Drive Spanning
Capture from one large capacity drive to two smaller capacity drives.
Blank Disk Check
Verifies if the source or destination disk is empty or has been wiped. This feature is planned for a future software release
Removable Drive Stations
Easy to remove drive stations are field replaceable
Network Push Feature
Push/upload evidence drive images (previously captured using Forensic Falcon or ZXi-Forensic) to a network repository. Push from up to 3 evidence drives simultaneously on the base unit or add the optional expansion kit and push from up to 5 evidence drives. An MD5 or SHA-1 hash is performed during the process and a log file is generated for each push task.
Image to or from a Network Location
Use the ZXi-Forensic to image to a network location using CIFS protocol and/or image from a network location using iSCSI. The ZXi-Forensic uses CIFS protocol to provide file system access and the highest level of security and control. Users can also use iSCSI as a source or destination drive.
Network Services
Users can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI Iperf and Ping, for security purposes
Forensic, Filter-Based File Copy
Users can filter and then image by the file extension (such as .PDF,.xls, .JPEG, .mov etc.).
Write-Blocked Drive Preview
Preview/ triage the drive contents directly on the ZXi-Forensic. The file browser feature provides logical access to source or destination drives connected to ZXi-Forensic. Users can view the drive’s partitions and contents, and view text files, jpeg, PDF, XML, HTML files. Other file types (such as .doc and .xls) can be viewed by connecting the ZXi-Forensic to a network and via a workstation, download and view. Users can use the iSCSI or SMB protocol to preview source drives via the network
Image Restore
File to drive mode restores dd, e01, ex01 images created by the ZXi-Forensic to another drive. This feature is planned for a future software release
Concurrent Image+Verify
Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.
User Profiles/Configurations
Administrators can save configuration settings and set password-protected user profiles.
Audit Trail Reporting/Log Files
Provides detailed information on each operation. Log files can be viewed on ZXi-Forensic or via a web browser, exported to XML, HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when connected to ZXi-Forensic via a web browser
Encryption
Secure sensitive evidence data with the whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using the ZXi-Forensic or by using a free open source decryption software such as TrueCrypt or FreeOTFE.
Drive Trim
Allows the ZXi-Forensic to manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive.
Tasks Macro
Allows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive. Set up to five Macros with up to 9 operations/tasks for each macro.
Drive “Time-Out” Feature
Users can set a specific “time-out” for hard drives connected to the ZXi-Forensic. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives
USB Host Ports
The ZXi-Forensic features two USB 2.0 host ports for keyboard, mouse or printer connectivity
HDMI Port
An HDMI port is located on the back of the ZXi-Forensic. This port can be used to connect the ZXi-Forensic to a projector.
*The ZXi-Forensic achieves speeds of over 50GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.
Specifications :
Power Requirements : 110-240V, 7.5A-3.5A 50-60Hz
Operating Temperature : 0-40c (32-122F)
Relative Humidity: Operating: 85% RH, non-condensing. Storage: 95% RH, non-condensing
Net Weight : 14lbs (6.4kg)
Dimensions : 3.7”H X 19”D X 17.2”W (9.39cm X 48.26cm X 43.68cm)
Agency Approvals : RoHs compliant