The Image MASSter Solo 2 Forensic Kit

Capture an image anywhere with this economical and versatile forensics tool kit!

The Ultimate Tool kit for Investigating Computer Crime! The Solo 2 Forensic system is a handheld software duplication device made for computer disk drive data seizure. Image capture operations can be performed from a suspect's drive to another hard drive with duplication speeds up to 1.8 GB/Min.

The Solo 2 Forensic Kit contains all the capabilities of the Solo 2 Forensic system with these additional features:

Hard Case

To help you carry and protected our product. Can accommodate the Solo-2 unit, Forensic Printer, Slim Scsi, Drive-Lock.

Solo Forensics Thermal Serial Printer

Serial thermal printer provides output for audit trail.

STANDARD FEATURES OF THE FORENSICS KIT INCLUDE:

Copy 100% of the suspect's hard drive as physical or logical images

System transfers data between IDE, EIDE, and Ultra-DMA IDE hard disk drives. Also transfers from SCSI hard drives to IDE drives via the optional PCMCIA SCSI adapter kit.

Data transfer rate exceeds 1.8 GB/minute!

The Solo 2 is powered by our patented ImageMASSter technology. The system operates in true Ultra-DMA mode, complete with built-in CRC error-checking on the fly - with no sacrifice in speed!

CRC32 Signature Generator

The Image MASSter Solo-2 Forensic provides the capability of generating a CRC32-CCITT Standard signature value during the Single Capture operation.
CRC (Cyclic Redundancy Check) 32 (32 bit value) Generator is a data verification tool that aids corporate and government specialists with computer crime investigation during evidence seizure. The CRC32 Generator helps ensure reliable data transfer and provides a method of verifying and comparing seized data. The CRC32 generates a 32-bit value and is displayed as an 8-digit, 4-byte hexadecimal value. When duplicating and storing data captured from a suspect's computer, the authenticity of the original data must be retained (for example, as evidence in court), and a proven method must be used to ensure that the copied data is identical to the original. CRC32 mathematically creates a "signature" value for the seized data.

Host Protected Area (HPA)

HPA is defined as a reserved area for data storage outside the normal operating file system. This area is hidden from the operating system and file system, and is normally used for specialized applications.
Systems may wish to store configuration data or save memory to the hard disk drive device in a location that the operating systems cannot change. If an HPA area exists on a suspect's drive, the Image MASSter Solo-2 Forensic seizure operation will detect this area and copy all the contents of the suspect's hard disk drive sectors, including all the HPA hidden sectors, to the evidence drive.

Device Configuration Overlay (DCO)

DCO allows systems to modify the apparent features provided by a hard disk drive device. It provides a set of commands that allow a utility program to modify some of the commands, modes, and feature sets reported as supported by the hard disk drive. It can be used to hide a portion of the hard disk drive's capacity from being viewed by the operating system and the file system.
If DCO is detected on a suspect's drive, the Image MASSter Solo-2 Forensic seizure operation will copy all the contents of the suspect's hard disk drive sectors including all the DCO hidden sectors to the evidence drive.

LINUX-DD format

Added LINUX-DD format duplication support. In this mode the image of the suspect drive will be written as 640MB files into a FAT32 partition on the evidence drive. If the FAT32 partition does not exist it will be created and scaled for the whole drive. By selecting the LINUX-DD Seize method using the 'Single Capture' copy mode it is also possible to store multiple LINUX-DD captured images on a single evidence drive. Each image will be stored in a separate subdirectory on the evidence
drive referenced by case name. In addition, a text file will be created in each individual
subdirectory containing information about the operation performed.

Bad Sectors

Improved bad sector handling by providing operator with the option to skip entire block of sectors if a bad sector exists within the block of sectors read. Enabling this feature reduces the copy time required to copy a drive containing many bad sectors in comparison to the default operation in which individual bad sectors within the block of sectors are skipped.. The option to skip the entire block is enable by selecting 'Skip block' from the 'Bad Sector' menu item.

48-Bit Support

Provides 48-bit drive support to handle drives larger than 137GB.

Drive Lock Detection

Provides enhanced Drive Lock detection handling. The result log records the presence of the Drive Lock device and records the Drive Lock firmware version.

PrintOur Unit Setting and more onfo.

Audit hard copy prints out additional information, such as unit's settings and Drive Lock information if device is attached.

New Speed Menu

A 'Speed' selection feature has been added to the SET menu to address issues in which the unit may duplicate at lower than expected transfer rates or if the operation fails during the benchmark or copy process.

Parallel transfer rate at 40 MB/minute

What about when there are ''accessibility'' problems? Seizure of the PC is not possible; occasionally the workstation is jammed into a corner or perhaps it's a warranty sealed laptop chassis. The Solo 2 Forensic system allows you to plug into a parallel port and download the image from the PC's hard drive directly to the hard drive in the Solo 2, so you can download from either IDE or SCSI drives without removing the cover of the PC. Perfect for hard to reach PC's and laptop hard drives!

PCMCIA Interface

1. SCSI interface to allow capture of suspect SCSI devices to an IDE drive
contained in the Solo 2 Forensic system (requires optional SCSI kit). Also
enables the use of SCSI Magneto Optical and tape drives for the CD Backup
and CD Restore features. Maximum speed achieved 60MB/min! (Requires purchasing the "SCSI" option).

2. Flash Memory interface for saving error log information during technical
support cycles, and for loading new application software as it becomes
available on the ICS web-site. (Requires purchasing the "Flash Memory" option).

Soft-Sided Carrying Case

Your Solo comes to you in a lightweight, padded carrying case with extra pockets to hold cables, power plug adapters, and drives. We also include a screwdriver and MAGlite for those hard to reach places

Solo Forensics Thermal Serial Printer

Serial thermal printer provides output for audit trail. The audit trail, printed on very high quality durable thermal paper, will provide irrefutable evidence of the capture event.

One year standard warranty includes parts and labor .

BUILT-IN SOFTWARE FEATURES

The Solo 2 Forensic system includes Single and Multi-Capture modes:

Single Capture - copies an exact image from the suspect's hard drive to the drive attached to the Solo 2 Forensics unit.

Multi-Capture - allows user to seize multiple hard drive images to a single target drive.

WipeOut

Sanitizes the drive being copied to before capturing the seized image. Written to Department of Defense specification 5220-22M, this feature completely erases the drive you are copying to.

Audit Trail

Using the optional serial thermal printer, the Solo prints an audit trail that captures the date, time, image size and drive information for both drives, plus verifies that all partitions are successfully copied. The audit trail, printed on very high quality durable thermal paper, will provide irrefutable evidence of the capture event.

DTRANS

Drive Translation Inspector (DTRANS) inspects all IDE hard drives in the system for proper drive parameters prior to capture.

Bad Sector Prompt

This feature allows the user to stop and prompt when bad sectors are encountered on the suspect drive; bad sectors may be "padded" with zeros to allow the capture process to continue.