Mediaimager GM4 SuperKIT Manuel utilisateur
Users’ Guide
Version 1.7
Mediarecovery
Nowogrodzka 56A
00-695 Warszawa, Poland
+48 22 719 97 00
Technical Support:
Phone: +48 22 719 97 00
E-Mail: [email protected]m
Home Page: http://www.mediaimager.com
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 2 of 63
Table of Contents
About Mediarecovery ............................................................................................................................. 4
Production of hardware and software ................................................................................................ 4
Business partners ................................................................................................................................ 4
Certifications ....................................................................................................................................... 4
Educational activities .......................................................................................................................... 4
About this Guide ................................................................................................................................. 5
Mediaimager ........................................................................................................................................... 6
Kit contents ......................................................................................................................................... 8
The features and capabilities .............................................................................................................. 9
List of accessories included in Mediaimager SuperKIT ..................................................................... 10
Technical specifications .................................................................................................................... 13
Setting up the Mediaimager ................................................................................................................. 14
Using the Mediaimager ......................................................................................................................... 18
Home Screen ..................................................................................................................................... 18
New Case ........................................................................................................................................... 20
Open Case ......................................................................................................................................... 21
Connecting drives ............................................................................................................................. 21
Duplication ........................................................................................................................................ 22
Mediaimager allows to create multiple type of a disk images, such as: ...................................... 22
Disk to disk (cloning 1:1) ............................................................................................................... 22
Disk to disk (cloning 1:1) with marker .......................................................................................... 26
Disk to file ..................................................................................................................................... 27
Disk to file with span function ...................................................................................................... 31
Disk to file – network share .......................................................................................................... 32
Disk to file – image allocated data ................................................................................................ 33
Disk to file – image data manual ................................................................................................... 34
Restoring image ................................................................................................................................ 37
Restoring image ............................................................................................................................ 37
Hashing.............................................................................................................................................. 40
Disk hashing .................................................................................................................................. 40
Image hashing ............................................................................................................................... 42
Disk hashing with marker .............................................................................................................. 44
Remote access .................................................................................................................................. 45
Erasing ............................................................................................................................................... 46
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 3 of 63
Processes list ..................................................................................................................................... 48
Logs ................................................................................................................................................... 52
Diagnostics ........................................................................................................................................ 55
Settings.............................................................................................................................................. 56
Calibrate touchscreen ................................................................................................................... 58
Uncalibrated device (medium) ..................................................................................................... 59
Exit menu .......................................................................................................................................... 60
Definitions ......................................................................................................................................... 61
Troubleshooting .................................................................................................................................... 62
Crash recovery .................................................................................................................................. 62
Black screen issues ............................................................................................................................ 62
Service and repairs ............................................................................................................................ 62
Frequently asked questions .................................................................................................................. 62
Does the Mediaimager write-protect the source drive? .................................................................. 62
How fast is MI at duplicating hard drives? ........................................................................................ 62
Does MI duplicator work with USB memory card readers? ............................................................. 62
I recalculated hash value from the SSD drive and it is different from the original one. Have I done
something wrong? ............................................................................................................................ 62
Are there any software updates for MI? If so, how could I know there is one. ............................... 63
Is the set of adapters only available in the SuperKIT version of MediaImager? Can I buy it
separately? ........................................................................................................................................ 63
Is my language supported? ............................................................................................................... 63
Can I setup the time zone? ............................................................................................................... 63
What operating system does Mediaimager use? ............................................................................. 63
What file system does Mediaimager use when formatting target drives? ...................................... 63
Does Mediaimager go with a carrying case? .................................................................................... 63
Do you have representatives in my local area? ................................................................................ 63
Do I need to work in Law Enforcement in order to buy the Mediaimager? ..................................... 63
Which ports are available on the expansion cable? ......................................................................... 63
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 4 of 63
About Mediarecovery
Mediarecovery is a leading centre for research and development in the field of computer forensics
and data security. The company owns one of the biggest Computer Forensics laboratories in
Europe, where search and analysis of digital evidence are conducted, including the analysis of
information security infringement, hacking, data leaks, frauds and malpractices are processed.
Moreover, the laboratory specializes in data recovery and data erase. The specialists of
Mediarecovery are the most experienced ones on the Polish market in analysing digital information,
including incident information, network intrusion, unethical or illegal activities of employees. More
than 7,000 expertise have been performed so far. The company implements advanced IT security
solutions in the largest banks, insurance companies and the government sector.
Production of hardware and software
Mediarecovery specialists, based on many years of experience, have designed a series of data
duplicators – Mediaimager. For several years, the company has been a manufacturer of equipment
for irreversible data erasure – Mediaeraser. At the beginning of 2015 Mediarecovery launched
another model of degausser – Mediaeraser MD 205.
Business partners
Mediarecovery Computer Forensics Laboratory is among leading companies in the area of
computer forensics such as: Guidance Software, AccessData, Belkasoft, Oxygen
Forensic, Microsystemation, Tableau, X-Ways Forensics Magnet, Passware, ICS, ACE Laboratory etc.
Certifications
In 2008 Mediarecovery Computer Forensics Laboratory was certified by the Polish Internal
Security Agency (ABW) that confirms that process of classifying information is safe. In 2013
the company implemented Information Security Management System based on the standard CEI /
IEC ISO 27001:2013. The system guarantees that the company fulfils all the legal requirements and
gives maximum protection of the processed and stored information.
Educational activities
Mediarecovery has published “Magazine of Computer Forensics” since 2008. The authors of the
magazine are experienced specialists in the field of computer forensics. The company also operates
an educational project – Academy of Computer Forensics. At the end of the trainings, participants
take an exam certifying their competence and knowledge. Mediarecovery also leads advanced
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 5 of 63
collaboration with the Computer Forensic Institute Association. The members of association are
forensic experts, IT security experts and lawyers who specialize in new technologies.
About this Guide
This guide is designed to assist users when working on the Mediaimager device. It consists of
technical specification of the Mediaimager, its features, interface and functionality information.
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 6 of 63
Mediaimager
Mediaimager is a powerful forensic duplicator that allows making binary copies of media storage in a
fast and safe way, capable of making 2 copies simultaneously in the Basic version, up to even 6
copies in the same time in the Pro and SuperKIT versions.
It is a portable device, working in compliance with best forensic practises where the source disks are
connected to write-blocking ports, and copies are 100% true images of the original drive. At the
moment of development, Mediaimager is the most powerful forensic duplicator on the market with
features and functions needed for the most demanding specialists:
High speed operation – data transfers up to 25 GB/min.
High numbers of parallel captures:
o 1:1 x4
o 1:2 x4
o 1:3 x3
o 1:4 x2.
Expansion cable – extending device capabilities with another 4 ports (configurable when
buying, with a possibility of editing by a user: 4 additional sources or 2 additional sources
and 2 additional targets).
Supported interfaces:
o Native support for SATA, USB 3.0 devices.
o Set of adapters allow investigator to connect drives with interfaces such as:
X1 Carbon Ultrabook SSD to SATA adapter
UX21, UX31, UX31, Adata, Sandisk XM11 SSD to SATA adapter
Mac Book Air SSD to SATA adapter
micro SATA to SATA adapter
M.2 SSD (NGFF) to SATA adapter
Lenovo Yoga SSD adapter
ATA (1,8” | 2,5” | 3,5”)
LIF and ZIF HDD to SATA adapter
ASUS ZenBook SSD to SATA adapter
mSata to SATA adapter
USB to SATA adapter
Card reader SD (USB 3.0)
Molex to SATA cable
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 7 of 63
eSATA to SATA (cable)
USB 3.0 to eSATA Adapter
SATA 29P Male to Male Cables with secure screws
Detailed log and processes information with an option to export outside the device.
Multi operational mode: Image, hash, wipe and restore in the same time.
Multiple hash mode – device is capable of hashing drives and images using MD5, SHA1 and
SHA2 (SHA256, SHA384, SHA512).
Multiple imaging formats support – images can be done to a file in DD or E01 formats or can
be mirrored (cloned 1:1) - disk to disk.
Restore function – created images can be restored to another drive.
Erase function – data can be erased in a irreversibly way by choosing from 1 to 35 passes of
data .
10’’ colour touch screen user interface making its usage easy and comfortable.
Highly secure environment – capability to encrypt the binary copy (AES256).
100% of Mediaimager software is created by Mediarecovery specialists.
Parts used to assembly the device are the highest quality.
Ability to connect external displays by using DVI or HDMI port.
High mobility due to the small size of the device (276 x 202 x 103 mm).
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 8 of 63
Kit contents
Mediaimager SuperKIT is the highest of all three duplicator versions and it comes together with:
Mediaimager duplicator
Power supply + power cord
SATA/SAS cable x 4
Case pack
Set of adapters
Expansion cable
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 9 of 63
The features and capabilities
Processing power: i7 processor and 8 GB of RAM memory (extendable to 16 GB).
Process management based on case.
Copying sessions: 6.
Maximum of 18 disks connected at the same time.
Write-protected source ports.
Capture Modes:
o E01
o LinuxDD
o Mirror Image Capture
o Data fragments copy (targeted triage)
o Capture to Network Storage
6 source locations (2x SAS/SATA + 2x USB 3.0) + 2x SAS/SATA on extension cable.
12 destination locations:
o 4 dedicated (2x SAS/SATA + 2x USB 3.0)
o 6 additional (6x USB 3.0)
o 2 additional by extension cable (2x SAS/SATA)
Hash calculation:
o MD5
o SHA1
o SHA2 (SHA-256, SHA-384, SHA-512)
Encryption support (image file) AES256.
Wiping standards:
o DoD
o Single Pass
o Secure Erase
o Full Gutmann
o From 1 to 35 passes
Restore function.
Browsing the files structure (FAT, NTFS).
Reporting and logging function for all activities.
o Different report formats (PDF)
o Export option
HDD S.M.A.R.T. Analysis.
MEDIAIMAGER – Users’ Guide, Version 1.7
Page 10 of 63
Advanced acquisition options (Read Step, Skip Count, Retry Count).
Formatting target drives (NTFS - MBR or GPT).
10,4” colour touch screen.
Interfaces to connect external display (DVI, HDMI, DisplayPort).
Operating system: Windows 8 Embedded or Windows 10 Embedded.
Gigabit Ethernet.
Case pack.
Adapters and accessories (listed below - pictorial images, the supplied adapters may look a
bit different).
List of accessories included in Mediaimager SuperKIT
X1 Carbon Ultrabook SSD to SATA adapter
UX21, UX31, UX31, Adata, Sandisk XM11 SSD to SATA adapter
Mac Book Air SSD to SATA adapter
micro SATA to SATA adapter
Ce manuel convient aux modèles suivants
1
Table des matières
Manuels duplicateur de disques populaires d'autres marques
Kanguru
Kanguru U2-DVDDUPE-S Manuel utilisateur
StarTech.com
StarTech.com 8STSATDUP11 Manuel utilisateur
DUPLO SEIKO CORPORATION
DUPLO SEIKO CORPORATION Duprinter DP-460 Manuel utilisateur
Addonics Technologies
Addonics Technologies UDFH7 Manuel utilisateur
Vinpower Digital
Vinpower Digital MiniLoader VDX-1 Manuel utilisateur
Addonics Technologies
Addonics Technologies CFASTD5 Manuel utilisateur