Ditto DX Forensic | Digital Forensics Device

Ditto DX Forensic FieldStation

The Ditto® DX is a powerful, high performance drive imager and digital forensics device that's perfect for digital investigation, eDiscovery, and data capture and analysis.

Next-generation imaging: The Ditto® DX Forensic FieldStation is the latest addition to the Ditto Forensic FieldStation family, with the same great usability features as the original Ditto device.

Ditto DX performance has been optimized for various forms of media, including SSDs, NVMe/PCIe, hard drives, SD and CF cards, and others.

Time-saving Logical Imaging: With hard drives and networked file shares exploding in size, Logical Imaging is more important than ever. Ditto DX Logical Imaging performance is twice that of the Ditto device. And with automatic, pre-selected search and acquire capability, Ditto DX slashes the time it takes to capture needed evidence.

Remote operation: An easy-to-use web browser interface supports remote operation via network or VPN, providing access to Ditto configuration, user administration and user rights, as well as direct operation of Ditto cloning and imaging operations. Ditto DX improves on Ditto with separate Ethernet and USB 2.0 ports so Ditto DX can be managed without impacting imaging performance.

Create logical and physical images in the field: The built-in menu system makes it easy to configure and perform forensic captures without an attached computer. Optionally, attach a computer for additional options such as generating complete listings of drive or file system contents to facilitate discovery, or automatically capture specific file types.

Suspect Inputs (write-blocked): Ditto natively supports many write-blocked inputs: SATA, eSATA, PATA, USB3.0/2.0. Additional acquisition interfaces are available via expansion modules, such as the Ditto SAS Expansion Module and Ditto FireWire Expansion Module.

Destination Outputs: Use dual SATA outputs simultaneously with same performance as one eSATA (single, dual and mirrored). Images can also be output to large volumes, including NAS and other network destinations, as well as portable RAID enclosures.

Data Acquisition Modes: Clone, DD, E01, L01 with MD5, SHA-1, or SHA-256 hashing. Ditto DX also offers a combined mode that captures a clone and DD or E01 (to different destination drives) in a single pass reading of the suspect drive.

Complete and Secure Erasure: Ditto DX is capable of sanitizing drives with preset erase modes or a user configurable pattern.

Water-resistant, dust-proof Pelican® custom carrying case available. Convenient, customized field kits are available for Ditto and accessories.

Additional Features:

2x Logical Imaging performance
Native USB 3.0 connectivity
Rugged, all-metal, silent fan-free construction
Free 3-year warranty and no annual fees

SUPERIMAGER PLUS 8" T3 FORENSIC FIELD UNIT

SuperImager Plus 8" T3 Forensic Field unit with 4 SAS/SATA3 ports, 8 USB3.1 ports, and Thunderbolt 3.0 port: The unit includes Thunderbolt 3.0 to PCIe 3.0 Expansion Box and with M.2 NVMe controller that enables capturing NVMe SSD at 65GB/min. It is a top performance Field Computer Forensic Imaging tool and Complete Digital Forensic Investigation platform. The user can run multiple parallel simultaneous forensic imaging from many devices, with 3 HASH values, and with encryption on the fly.

The SuperImager® Plus 8” T3 Forensic Field Unit - is a mobile, compact, easy to carry, versatile, and extremely fast Forensic Imaging unit that can serve as a complete Field Computer Forensic Investigation platform. The unit is running under Linux Ubuntu OS with a dual boot to Windows 8.1. The unit has a built-in extremely fast Thunderbolt 3.0 port (40 Gigabit/s), and it supplied with Thunderbolt 3.0 PCIE 3.0 Expansion Box and with 1394A/B and NVMe M.2 controllers that plugged inside the TB box and provided supports to those interfaces. The TB3.0 Expansion box also allows the user to plug any other storage controller (10Gigabit/s Ethernet, SCSI, add-on more SAS..) and capture data from almost any type of source.

The unit can be used to perform:

Multiple parallel simultaneous Forensic Capture using bit by bit, DD, E01/Ex01(with full compression), Mix DD/E01 formats, copy the whole drive or one partition. Copy up to 5:10 for SATA drives with use of USB3.0 to SATA adapters
Run a Selective Imaging (Targeted Imaging) of files, folders, partitions with file extension filters
Erase data from Evidence drive using DoD (ECE, E), Security Erase, Enhanced Security Erase, Sanitize erase protocols
View the CAPTURED data directly on Ubuntu Desktop screen or the Windows screen
Encrypt the data while capturing (AES256)
HASH the data while capturing (run all the 3 HASH engines at the same session SHA-1, SHA-2, MD5)
Run Cellphone/Tablets data Extraction and Analysis(Windows side)
Prepare Forensic Triage keys and view the captured targeted data
Run a Keyword Search on the Suspect drive, before the capture, or while the capture
Run a full Forensic Analysis application like Encase/Nuix/FTK(Windows side)
Run a Virtual Drive Emulator (This option is enabled on this unit)
Use the Remote Capture application to capture data from unopened Laptops with Intel-based CPU, Tablets and PC (Supplied with this unit)
Use the Thunderbolt port to capture data from USB3.1 Gen2 storage devices, Mac via Thunderbolt 2/3 port or 1394 port
Use the unit as "Writes Blocker Bridge" over the network, remotly access any storage attached to the unit in a writes' blocked environment, and run a third-party application such as Forensic Explorer, Encase via the network (that is a good feature when you have a 10Giga/s network (use this link to get one the unit's configuration we provides with 10Giga/s)

SuperImager T3 with Thunderbolt 3.0 Port

SUPERIMAGER PLUS 7" MINI UNIT

SuperImager Plus 7" Mini Field Forensic unit with i7 4th generaion mobile cpu and with 3 SATA ports and 3 USB3.0 ports. The perfect tool to run Triage data collection application, Fast Forensic Imaging, virtual drive emulator, and Cellphone data extraction & analysis application. The unit can be powered with external Li-Polymer battery.

Also, can support NVMe SSD with M.2 NVMe to USB3.0 adapter

The SuperImager Plus 7" Mini with i7 4th generation Forensic field unit is very compact, lightweight, and easy to carry, and it is the perfect tool to perform Forensic Imaging out in the field. It built with 7" Touchscreen color high-resolution LCD display, 3 SATA ports (with secure and keyed SATA power connector), 3 USB3.0 ports, 1 Gigabit/s Ethernet port, and a HDMI port. It is affordable and capable of performing extremely fast Forensic Imaging (Run a 100% bit by bit imaging at 21GB/min on SSD) and fast Hash Authentication (Run SHA-1 at 26GB/min on SSD and 8GB/min on 1TB WD Blue Drive).

The SuperImager Plus application has the capabilities to perform in one read pass from the "Suspect" drive:

The unit can be used to perform:

Forensic Imaging with E01/Ex01 format and full compression
Encryption with AES256
Parallel HASH authentication (Run all the 3 HASH engines MD5, SHA1, SHA2 in the same session), it is also capable of saving Forensic Images to three destinations in the same time:
1. 2 external SATA Evidence Drives
2. External compact USB3.0/eSATA RAID encrypted storage device
3. Network.
Also, with the use of the USB3.0 to SATA optional KIT, the user can convert the unit's 3 USB3.0 ports to 3 SATA ports, and have a total of 6 SATA ports available to be used. Using the 6 ports, the user can perform Forensic Imaging from 3 "Suspect" drives to 3 "Evidence" drives in 3 separate sessions
Ability to run a Quick Keyword Search on the Suspect drive, prior to capture or during the capture (with filters on the file extension)

Disk Duplication Device

Ditto DX Forensic FieldStation

Additional Features:

SUPERIMAGER PLUS 8" T3 FORENSIC FIELD UNIT

The unit can be used to perform:

SUPERIMAGER PLUS 7" MINI UNIT

The unit can be used to perform:

TESTIMONIALS