Upcoming Training: "Digital Forensics and Investigations." Date : 4th to 8th Feb 2019 , 10 AM to 6 PM. Click Here for Registration.

Disk Duplication Device

Ditto DX Forensic FieldStation

The Ditto® DX is a powerful, high performance drive imager and digital forensics device that's perfect for digital investigation, eDiscovery, and data capture and analysis.

Next-generation imaging: The Ditto® DX Forensic FieldStation is the latest addition to the Ditto Forensic FieldStation family, with the same great usability features as the original Ditto device.

Ditto DX performance has been optimized for various forms of media, including SSDs, NVMe/PCIe, hard drives, SD and CF cards, and others.

Time-saving Logical Imaging: With hard drives and networked file shares exploding in size, Logical Imaging is more important than ever. Ditto DX Logical Imaging performance is twice that of the Ditto device. And with automatic, pre-selected search and acquire capability, Ditto DX slashes the time it takes to capture needed evidence.

Remote operation: An easy-to-use web browser interface supports remote operation via network or VPN, providing access to Ditto configuration, user administration and user rights, as well as direct operation of Ditto cloning and imaging operations. Ditto DX improves on Ditto with separate Ethernet and USB 2.0 ports so Ditto DX can be managed without impacting imaging performance.

Create logical and physical images in the field: The built-in menu system makes it easy to configure and perform forensic captures without an attached computer. Optionally, attach a computer for additional options such as generating complete listings of drive or file system contents to facilitate discovery, or automatically capture specific file types.

Suspect Inputs (write-blocked): Ditto natively supports many write-blocked inputs: SATA, eSATA, PATA, USB3.0/2.0. Additional acquisition interfaces are available via expansion modules, such as the Ditto SAS Expansion Module and Ditto FireWire Expansion Module.

Destination Outputs: Use dual SATA outputs simultaneously with same performance as one eSATA (single, dual and mirrored). Images can also be output to large volumes, including NAS and other network destinations, as well as portable RAID enclosures.

Data Acquisition Modes: Clone, DD, E01, L01 with MD5, SHA-1, or SHA-256 hashing. Ditto DX also offers a combined mode that captures a clone and DD or E01 (to different destination drives) in a single pass reading of the suspect drive.

Complete and Secure Erasure: Ditto DX is capable of sanitizing drives with preset erase modes or a user configurable pattern.

Water-resistant, dust-proof Pelican® custom carrying case available. Convenient, customized field kits are available for Ditto and accessories.

Additional Features:

  • 2x Logical Imaging performance
  • Native USB 3.0 connectivity
  • Rugged, all-metal, silent fan-free construction
  • Free 3-year warranty and no annual fees

Image MASSter Solo-4

The Image MASSter Solo-4 Forensic Super Kit enhances the versatility of Image MASSter Solo-4 Forensic hard drive data acquisition unit that offers investigators the ability to capture simultaneously at SATA-2 speed from one "Suspect" hard drive to two "Evidence" hard drives. It can also capture from two separate "Suspect" hard drives to two individual "Evidence" hard drives. The Image MASSter Solo-4 Forensic hard drive data acquisition unit features built-in native support for SAS, SATA and USB 2.0 drives. It authenticates the drive copies with SHA-1, SHA-2 and MD5. It also supports IDE, RAID, e-SATA drives as well as a variety of Micro Media flash drives. All "Evidence" drives can be encrypted "on-the-fly" during the acquisition process to protect sensitive data during transportation or storage.

All "Evidence" images can be saved as 100% copies, Linux DD images or E01 image files. This forensic hard drive data acquisition unit also offers a built-in Gigabit Ethernet connection allowing users to upload images to Storage Area Networks (SAN) for the purpose of processing and archiving.The Image MASSter Solo-4 Forensic hard drive data acquisition Kit includes the Expansion Box that brings extra connectivity to the data acquisition unit including fast SCSI, FireWire 1394A/B. Also offers USB 3.0 and Fiber Channel supports with purchase of additional hardware. It also includes the LinkMASSter Option which allows a user to seize data from unopened Computers or Laptops.


  • Extreme Speed Built for Today's and Tomorrow's Hard Drive Technology,designed to work with the fastest hard drives available, the Image MASSter Solo-4 Forensic hard drive data acquisition unit, authenticates and sanitizes at SATA-3 speed (32 GB/min top capability).
  • Write-Protected Ports: All Drive and USB ports are Write-Protected, eliminating the possibility of overwriting valuable data.
  • Multiple "Suspect" and "Evidence" Ports: The unit provides 4 native SATA/SAS ports for 2 Suspect and 2 Evidence drives and 4 native USB 3.0 ports.
  • Expansion Box: The Expansion box is configured with the following hardware:
    1. FireWire 1394 PCI-Express card for connecting 1394A(1 Port) or 1394B(2 Ports) mass storage devices.
    2. SCSI Ultra320 PCI-Express card for connecting SCSI mass storage devices.
    3. PCI-Express to ExpressCard 34 Reader for connecting a broad range of Express Card compliant cards.
  • “On the fly” Drive Image Encryption*
  • Windows 7 Operating System
  • Drive Wiping: Supports single pass or full DoD drive "Sanitizing".
  • Multiple Hash Verifications: SHA-1, SHA-2, MD-5
  • Uploads "Suspect" Images to Network Storage
  • Preview Data directly on the Image MASSter Solo-4

Image MASSter Solo-5

The new Image MASSter™ Solo 5 Enterprise IT takes the IM Solo-4 G3 Slim to a whole new level. Faster by far and more flexible than any other unit on the market, the new Solo 5 Enterprise IT is also less expensive. Without compromising any of the IMSolo-4 G3 Slim’s features, the Solo 5 Enterprise IT offers two additional, unique 4-lane PCIe Expansion Ports, allowing it to copy data at validated Speeds of 69GB/min from a PCIe M.2 storage device to another PCIe M.2. With a total of 17 I/O ports, the Solo 5 Enterprise IT has the capability of supporting the simultaneous duplication of up to 16 storage devices, providing the user with maximum cost/performance flexibility for Hard Drive Duplication Operations

The new Solo 5 Enterprise IT is configured with an Intel i7™ processor. The new Solo 5 Enterprise IT shares the same footprint of the successful and established IMSolo-4 G3 Slim.


  • High-end Processing Power: The Image MASSter™ Solo 5 Enterprise units are supplied with a powerful INTEL™ CPU to handle today’s most demanding Forensic Acquisition and Analysis tasks.
  • Advanced SATA-3 Technology: Implements support for 6Gb/s SAS-2 and SATA-3 drives using 6Gb/s SATA-3 SAS Controller technology. The unit is designed to acquire today’s High Performance drives and prepares the user with the hardware necessary to take advantage of tomorrow’s hard drive speed improvements. The unit’s advanced Duplication Technology provides the capability of performing multiple operations simultaneously. Capture and Wipe drives with speeds up to 32 GB/min, and M.2 drives with speeds up to 70GB/min.
  • Multiple "Suspect" and "Evidence" Ports: The unit provides 4 native SATA/SAS ports for 2 Suspect and 2 Evidence drives and 4 native USB 3.0 ports.
  • PCIe Expansion Port: Allows expanding the unit’s capabilities to support M.2 storage devices, using the M.2 Adapter Module, SCSI drives using the optional SCSI Expansion Box, and allowing for future performance enhancement options.
  • PCIe M.2 support: Two 4-lane PCIe Expansion Ports allows for data acquisition from one PCIe M.2 storage device to another at speeds up to 70 GB/Min. The unit’s M.2 Adapter Module supports varying M.2 form factor lengths of 30, 42, 60, 80 and 110 mm and is designed for easy and safe insertion and release of M.2 storage devices. The M.2 Adapter Module also supports U.2 SSD drives with optional 3rd Party Adapters.
  • Hard Drive Support: Offers native support for SAS, SATA, Firewire, PCIe M.2 and USB 3.0 drives. Optional adapters are available to support IDE Drives*, Micro SATA*, e-SATA Drives*, 2.5”, 1.8” IDE Notebook Drives*, ZIF drives*, SATA M.2* and Flash media*.
  • Multiple I/O Ports: The Solo 5 Enterprise offers a total of 17 I/O external ports for data acquisition. These include 4 SAS/SATA, 6 USB 3.0, 2 eSATA, 2 Firewire 800, 1 Firewire 400, and 2 PCIE expansion ports. Two SATA/SAS ports and 2 USB 3.0 ports are dedicated for the Suspect Drive Positions. Mixed Drive Interface support allows seizing data between different drive interface types (ie. Use IDE "Suspect" drive with a SATA "Evidence" drive). All "Suspect" Drive ports are permanently write-protected to prevent altering “Suspect" Drive Data. The Write-Protect properties of the Suspect ports cannot be disabled.
  • Multi-Session Capability: Capture multiple Source drives simultaneously or run multiple operations simultaneously. With a total of 17 I/O ports, the Solo 5 Enterprise family has the capability of supporting the simultaneous acquisition of up to 16 storage devices.
  • Multiple Operational Modes: - Single Capture: Creates “Mirror” image of the Suspect’s drive. - LinuxDD Capture: Supports storing one or multiple Suspect drive images on a single “Evidence” drive using the standard Linux DD Segmented File Format. - E01 Capture: Supports storing one or multiple Suspect drive images on a single “Evidence” drive using the Encase® Forensics Segmented File Formats E01 and EX01. - IQ Copy*: Optional Non-Forensic Format used to capture only the allocated data of a Suspect’s drive, greatly reducing the time required to capture data. In addition, it can be used to duplicate drives for IT purposes such as backup, deploy and upgrade to larger capacity drives. - WipeOut: Sanitize drives using Single Pass, DoD Standard, or Secure Erase. The unit has the ability to capture and wipe hidden HPA or DCO areas which may exist on hard drives.
  • Multi-Op Mode: Allows seizing in LinuxDD or E01 and Single Capture formats in one operation using the same Suspect drive.
  • Multiple Hash Verification Methods: The Image MASSter™ Solo 5 Enterprise Forensic supports SHA-1 and SHA-2 Hash Acceleration and Software based MD5 Hashing.
  • Slide-Out System Drive: The unit offers an External, Slide-Out System drive for easy removal.
  • External Storage: Images can be stored externally to a Shared Network folder, PCIe M.2 drive, e-SATA drive, USB drive or an ICS DFSS External Storage Module.
  • Upload and Download Images to Network Storage Area: Images files can be uploaded and downloaded to a Network Storage Area allowing the user to take advantage of large storage platforms for the purpose of processing and archiving images. With the use of the Optional 10 Gigabit Ethernet connection, units can copy and upload at speeds exceeding 4GB/min.
  • “On the fly” Drive Image Encryption*: Utilizing the built- in AES 256 Encryption Technology the Image MASSter™ Solo 5 Enterprise Forensic encrypts with minimal speed degradation all digital data during the Cloning Process for the purpose of safe guarding sensitive information. The Image MASSter™ Solo 5 Enterprise Forensic creates a secure key with a user-chosen pass phrase. An AES 256 encryption key is then generated by the unit and can be saved to any USB thumb drive. The encrypted drive can be decrypted on the fly utilizing the Image MASSter™ Solo 5 Enterprise Forensic or with any PC loaded with the free ICS Decryption utility and USB thumb drive containing the saved key.