Reseda, CA 91335, Dec 10, 2018
MediaClone announced today the release of a new NVMe line of products that support NVMe SSDs for the digital forensic, IT and drive sanitization/recycling markets. The new line of products preform extremely fast when cloning, imaging or erasing NVMe SSD. NVMe SSD are the next generation of digital storage devices, they are PCIE base with solid state technology. For example, imaging speed of 93.7GB/min was achieved with the use of a Samsung NVMe SSD (Model MZVPV512HDGL).
The new products release includes three basic models:
1) Lab Unit dedicated to NVMe SSDs, with multiple NVMe ports for a heavy usage. The NVMe Desktop unit with eight NVMe ports allows forensic and IT users to clone or capture from one NVMe SSD to multiple NVMe SSDs, or clone from four NVMe SSDs to four other NVMe SSDs in four separate parallel independent sessions, using the full SuperImager Forensic application or SuperCopier IT application. The NVMe drive eraser unit allows the user to erase data simultaneously from eight NVMe SSDs in eight separate parallel erase sessions using the SuperWiper application. The unit is designed for a high volume of NVMe SSD tasks. http://www.media-clone.net/SuperImager-Plus-Desktop-NVMe-Forensic-lab-p/sil-0005-00a.htm
2) Lab Unit with mixed NVMe and SATA ports for supporting imaging, cloning and erase from mixed media utilizing the same unit. It is an NVMe Desktop unit with four NVMe and four SATA ports. The best use of this model is when the user has the need to copy data across different digital storage media. http://www.media-clone.net/SuperWiper-Desktop-NVMe-SATA-mix-drive-erase-p/swp-0008-00a.htm
3) Portable Unit with NVMe and SATA ports. It is the NVMe 8” unit with two NVMe ports, two SATA ports, five e-SATA ports, and a Thunderbolt 3.0 port. The unit is portable and easy to carry and is designed to be used in the field for imaging, copy or erase of NVMe SSDs, SATA and USB storage devices. The unit is supplied with a Thunderbolt 3.0 to PCIe expansion box that allows the user to add many other PCIe storage controllers to support various other digital storage media like SAS, SCSI, 1394, FC, etc. http://www.media-clone.net/SuperCopier-8-NVMe-SATA-drive-duplicator-p/scr-0019.htm
In recent years, there has been an increase in the usage of NVMe SSDs as in MacBook laptops. NVMe is a non-volatile storage media that is attached to a PC or laptop via the fast PCIe bus. It uses PCIe communication and storage protocols to reduce the I/O overhead and brings various improved performances and reduced latency in comparison to SATA SSDs. Using the PCIe 3.0 bus enables NVMe SSDs to achieve even a higher performance, and can run at incredible speeds.
Building a solution to support NVMe SSD is a challenge for a PC design or for an embedded system design. Here are some of the challenges:
• The PCIe bus on a PC motherboard that is utilized by the NVMe SSDs is not hot-pluggable by default and some add-on hardware/firmware/software solutions are needed.
• In order to connect externally M.2 NVMe SSDs to any unit, an M.2 NVMe to SFF-8639 adapters and SFF-8639 Extension cables are needed, but those adapters and cables are not designed for external heavy use and an additional locking mechanism to keep them in place is needed.
• NVMe SSDs become very hot when they are used continuously in a read or write operation and external cooling is needed.
Here is the summary of the features and benefits of the three applications:
SuperImager Forensic Application: Forensic Imaging process is the first step of collecting digital evidence and it is crucial that the process is fast, reliable and preferably is using parallel imaging.
When capturing data in the field, speed is essential, some of the operations are done covertly and the goal is to accomplish as many data captures as the time allows. Sometimes because of the lack of time, the forensic investigator can just preview the suspect’s drive to copy only a few files, or run a quick triage for acquisition of some critical data.
In some cases, the data cannot leave the crime scene and in addition to data collection, there are needs to perform a full forensic analysis and investigation on-site.
A forensic investigator carries many tools in his toolbox to be ready for every situation, since there are many kinds of storage devices and supporting them all can be a challenge.
For a lab use, there are needs to process many evidence drives and catch up with the backlog, so some of the needed operations are imaging evidence drives for backup and storage, generating a hash value for authentication, uploading the image to a network and analyzing the data. So here the important point is to be able to image and process many drives at the same time.
MediaClone hardware is the only tool in the market that gives the forensic investigator the ability to connect and capture from many different kinds of storage devices from IDE to the latest Thunderbolt 3.0.
The SuperImager application supports multiple forensic imaging modes in a very efficient multiple parallel session way, including Hashing and AES encryption for security.
For a quick operation the application supports a virtual emulator to view and share crucial files from the suspect’s drive, a keyword search for finding incriminating evidence before the imaging or while imaging, selective imaging of some files and folders.
For analyzing the data, the units are configured as Linux/Windows dual-boot. Windows allows the user to install and run various third-party applications, especially Encase for analysis. Also third-party applications from vendors like Cellebrite allow the user to run multiple cellphone data collections, and more.
SuperCopier IT application: supports one of the most efficient and complete IT imaging and deployment applications with automatic detection of partitions, automatic partition scaling, one of the best scale up or down especially for NTFS file system, and supports many File Systems like NTFS, FAT, exFAT, EXT4 with MBR and GPT partitioning schemes.
In addition, the application supports Copy-to-Folder mode which allows the user to copy all the files from a source drive, into one large folder on the target drive.
Also, the application supports VHD copy when the source drive contains multiple VHD (virtual hard drive) images. The application also supports scripting that allows the user to create custom scripts to automate a sequence of operations that are used most often. Scripts also allow to program parallel sessions utilizing all the ports of the unit to copy one source to multiple targets, or copy from multiple sources to multiple targets.
SuperWiper Erase application is designed to help electronic recycling centers that need to erase drives for resale purposes, also any midsize corporation that needs to sanitize drives for security reason before they are reused or destroyed. The SuperWiper application supports many NIST 800-88 approved erase processes, depending on the user needs including erase protocols DoD 5520.22, Security Erase (regular mode and enhanced mode),Sanitize for SAS drives, and User Erase mode all with verification to ensure that data has been wiped. The application also supports running S.M.A.R.T. diagnostics and Read-Verify. The application generates erase log files, NIST erase certificates and saves all the information in a local SQL database for convenience.
MediaClone products are all standalone and not license based which make it a very economical solution.
“A quick adaptation of our tools to support the new NVMe SSD storage devices is crucial to supply a good solid and fast solution in a timely manner for our customer needs. It all started when one of our large customers which is a very well-known corporation requested us to look into a quick implementation of NVMe in our line of products”, says Ezra Kohavi, CEO of MediaClone Inc.“