Cypher PUMA User manual

PUMA
Portable Universal Media Archive
User Manual V 2.1
October 2008
Cypher Technology Ltd
Leatherhead, UK
cyphertechnology.co.uk

Cypher Technology Ltd 2008 2
1 Table of Contents
1 Table of Contents...................................................................................................2
2 Description.............................................................................................................4
3 Quick Start Guide...................................................................................................6
3.1 Turning On..........................................................................................................6
3.2 Transferring Flash Card Data .............................................................................6
3.3 Turning Off..........................................................................................................6
4 Detailed Operation .................................................................................................7
4.1 Setting up and Powering Puma ..........................................................................7
4.2 Turning Off (Display Software Revision and serial Number)...............................7
4.3 Automated Transfer Operation ...........................................................................7
4.4 Menu System......................................................................................................9
4.5 Make Working Copy ...........................................................................................9
4.6 Make Master Copy............................................................................................10
4.7 Verify Master Copy against Flash Card ............................................................10
4.8 Restore the Master Copy to a Flash Card ........................................................10
4.9 Wipe Flash Card...............................................................................................10
4.10 Calculate the Checksum of the Flash Card ...................................................11
4.11 Format Flash card .........................................................................................11
4.12 Calculate the Checksum of the Master Disk Image.......................................11
4.13 Enable JPEG creation on Working Copies....................................................12
4.14 Software Installation Procedure.....................................................................12
4.15 Adjust the Internal Time and Date .................................................................12
4.16 How is the Master Copy used?......................................................................13
4.17 Accessing the Master Copy with WinImage ..................................................13
4.18 ImageMaker – Combining Multiple Disk Images ...........................................14
5 Technical Background .........................................................................................16
5.1 Master Copy (bit for bit copy)............................................................................16
5.2 Disk Verify Read...............................................................................................17
5.3 Working Copy (file copy)...................................................................................17
5.4 Card and Disk Checksum .................................................................................18
5.5 Flash Card Wipe (Erasing) ...............................................................................18
5.6 System Architecture .........................................................................................18

Cypher Technology Ltd 2008 3
5.7 Transfer Times .................................................................................................18
5.8 RAW File handling............................................................................................19
6 Technical Support ................................................................................................20
6.1 System re-starting in the event of failure ..........................................................20
6.2 Contact .............................................................................................................20
6.3 Software Updates .............................................................................................20
7 Specifications.......................................................................................................21
8 Disclaimer ............................................................................................................21
9 Appendix 1...........................................................................................................22
9.1 Supported Camera Types.................................................................................22

Cypher Technology Ltd 2008 4
2 Description
Puma is a rugged and evidentially secure system for archiving Flash card data to
CDROM/DVD media. Its automated backup procedure make it simple to use. It is aimed
primarily at backing up digital cameras and Flash based audio and video recorders and
includes a RAW to JPEG image converter. Puma will back up any type of file data and
can be used to archive USB pen drives and other USB disk drives. The main features
are as follows:
•Simple operation. Single, dedicated “Transfer” button initiates entire archive
sequence. This eliminates the chance of the operator omitting part of the
procedure.
•Any size of card can be archived up using multiple DVDs or CDs (new in V2.1).
•Rugged construction and no hard drive increases reliability and evidential
security.
•Unique bit for bit copy of Flash card provides ultimate evidential audit trail and
reduces possibility of legal challenges.
•Three automated steps in transfer procedure: Transfer, data verify, and Flash
media overwrite/erase/format.
•Flash card, forensic wipe process ensures that deleted data cannot be recovered
and removes any viruses.
•Fast transfer rates reduces back-up time. Up to four times faster than laptop for
transferring files. 20Mbyte /sec transfer rate.
•Self contained unit with premium quality, full height DVD/CDROM R/W drive.
•Re-mounts and verifies disk after writing to ensure maximum reliability of backup.
•Supports wide range of DVD +/- R, +R/W, +R DL and CD -R media.
•Will back up USB Flash sticks.
•Proprietary software tailored precisely to the needs of law enforcement and
evidence gathering. Closed nature of operating system increases evidential
security
•Produces two media outputs: a Master Copy which is a bit-for-bit copy of the
entire Flash memory card and a Working Copy which contains only the files from
the Flash card. Where these are image files in RAW format, the system will
generate JPEG versions of these files which will also be stored on the Working
Copy. A list of supported RAW camera formats is given in APPENDIX 1
•Can be powered from mains, vehicle power or external batteries.
•Supports all common Flash media (see Specification).

Cypher Technology Ltd 2008 5
Fig 1. Front Panel
Fig 2. Rear Panel

Cypher Technology Ltd 2008 6
3 Quick Start Guide
3.1 Turning On
1. Connect the supplied 12V 5A power supply (PSU) lead to rear panel power inlet and
screw up the connector. Connect the PSU to a mains supply using the supplied
cable.
2. Remove any Flash card.
3. Switch on the Power Switch on the rear panel (switch up). The display panel will
light up and show “Press I/O”. The green front panel LED will flash.
4. Press the I/O (On/Off) switch below the green Flashing LED. “On..” will be displayed
and the green LED will be on constantly.
5. After a few seconds, a growing line of dots will appear on the display and the system
will be ready for use after about 20 seconds.
3.2 Transferring Flash Card Data
1. Check that the displayed time and date are correct.
2. Insert the Flash card into the appropriate front panel slot. The display will show the
card’s size and number of files. A USB stick may be plugged into the rear panel.
3. Press the Disk button to open the DVD/CD draw. Place a DVD/CD in the tray and
press the Disk button once more to close the tray.
4. Press the TRANSFER button to start the transfer.
a) A Master copy is produced first. This consists of the transfer of the data from the
card to the disk and a verification read of the disk image file and the card. On
successful completion the Master disk will be ejected and the checksum of the Flash
card will be shown. This can be noted down for future reference. (where multiple disks are
produced, there are separate disk checksums also).
b) Remove the Master Copy disk and place a new DVD on the tray. Press the lower
soft key Marked “Continue” to proceed. The Working copy is now produced. On
successful completion the disk will be automatically ejected.
c) The Flash card may now be wiped and re-formatted. Press “N” when prompted if
this is NOT required.
The Transfer is complete.
Note: If further copies are required, do not wipe the card, and use the appropriate
functions available in the “Menu”. Press “Menu” soft key and the Up/Down cursor keys.
3.3 Turning Off
Press the I/O button below the green LED to shutdown. When “Switch Off” is displayed,
turn off the rear panel Power Switch.

Cypher Technology Ltd 2008 7
4 Detailed Operation
4.1 Setting up and Powering Puma
1. Connect the supplied 12V 5A power supply (PSU) lead to rear panel power inlet and
screw up the connector. Connect the PSU to a mains supply using the supplied
cable.
2. Remove any Flash card.
3. Switch on the Power Switch on the rear panel (switch up). The display panel will
light up and show “Press I/O”. The green front panel LED will flash.
4. Press the I/O (On/Off) switch below the green Flashing LED. “On..” will be displayed
and the green LED will be on constantly.
5. After a few, a growing line of dots will appear. This line will extend to the full width of
the screen and then “Wait” will be displayed. A few seconds after that “Ready” will
be displayed and the system is ready for use. The whole boot up procedure, from
switch on, takes about 20 seconds.
6. When PUMA makes a Working Copy of RAW image files, it creates JPEG versions
of these files for ease of viewing across a wide range of platforms. Where this
feature is required, it must be enabled from the menu. This is done by selecting the
“Enable JPEGs” function in the Menu (Section 4.13 ).
7. Check that the displayed time and date are correct. If not, use the “Adjust Time”
menu function to adjust the time and date (Section 4.15).
4.2 Turning Off (Display Software Revision and Serial Number)
Press the I/O button below the green LED to shutdown. Press {Y} to confirm. When
“Switch Off” is displayed, turn off the rear panel Power Switch.
If {N} is pressed the Software Revision and Serial Number (where appropriate) will be
displayed and Puma will resume operation.
4.3 Automated Transfer Operation
1. Place the Flash card in appropriate slot. If a USB drive is to be archived, plug this
into either of the USB slots in the rear panel. An extension lead may be required for
bulky USB flash drives
2. Place a blank CD-R or DVD +/- R in the drive. The Master Copy is generated first.
The size of the Flash card is shown on the display when it is inserted. A CD will hold
730Mbytes and a standard DVD 4,700 Mbytes. Where the flash card is larger than
the disk size, multiple disks will be produced. These disks will be automatically
numbered as Master Disk #1, Master Disk #2 etc. A Windows utility program is
supplied, which combines the multiple disks into one master image file for ease of
access. This utility program, called ImageMaker, is copied to the first disk of the set.

Cypher Technology Ltd 2008 8
The Master Copy has the current time and date stamp as displayed on the front of
the machine.
3. Press the Transfer button.
(The “Cancel” soft key allows the transfer to be aborted)
Please note: The first time a new disk type is used, there may be a delay before writing occurs
as the drive calibrates itself to the disk.
Action Display (See front panel layout)
Transfer Master begins Make Master Copy 05:23
32% @ 8.4MB/S Cancel>
Verifying Master begins Verify Master 00:23
10% @ 8.5MB/s Cancel>
4. Puma then ejects the verified Master Disk and displays the Checksum. This should
be noted down.
(Multiple disk transfer - If the flash card is bigger than the disk size, further disks will be
requested. Each disk has its own checksum, which is displayed at the end of each disk
transfer. When all the data has been transferred, no new disks will be requested. Press
{Continue} and the checksum of the whole Master Image will be shown. This should be
noted down. This final checksum is the same value as the checksum produced for the card.)
5.
Puma then prompts for another blank disk to be inserted. If the process was not
successful the disk will not be ejected and an error message will be displayed (the
disk can be ejected manually using the [Disk] button.
Mster is ejected Insert Blank Disk..
Continue>
Press the {Continue} soft key to proceed with the Working Copy
Transfer Working begins dcn0004.jpg 04:34
19% @ 8.3MB/s Cancel>
If the size of the files on the flash card is bigger than the disk size, further disks will
be requested.
Is Flash erase required? Wipe Card Y>
N>
Press {Y} to wipe Flash card or {N} to proceed without wiping card. After the card is
wiped it is automatically partitioned and re-formatted with a FAT32 file system. If
successful the display will show :
Wipe Completed Wipe Complete.. 00:00
Formatted Continue>
The Transfer process is now complete. A new Flash card may be inserted.

Cypher Technology Ltd 2008 9
4.4 Menu System
When the system powers up, or after a full Transfer has completed, the display shows
11:32:15 Wed Nov 10 2008
Insert card... Menu>
or if a card is already inserted:
Card Size 3.89 GB
6 Files 69.2MB Menu>
Pressing the {Menu} soft key enters the Menu system.
The name of the current function is displayed on the top line of the display. The
Up/down arrow keys are used to select the desired menu function. The {Exit} soft key is
used to exit the Menu and return to the Top Level.
Possible operations are:
Menu Item Description
1 Make Working Creates Working Copy disk from Flash
2 Make Master Creates Master Copy
3 Verify Master Verifies card against Master Copy
4 Restore Master Creates clone Flash card from Master Copy
5 Wipe Card Overwrites Flash card with “0”s
6 Checksum Card Calculates checksum of card
7 Format Card Formats card as FAT32
8 Checksum Disk Calculates checksum of Image file on Master Copy
9 Enable JPEGs Allows Jpeg creation to be controlled
Press Up/Down Arrow keys to select Yes Or No
10 Install Software Install new software from DVD/CD
11 Adjust Time Adjusts Puma internal time and date
4.5 Make Working Copy
This function will copy all the files from the Flash card to the CD or DVD. This is a
Working Copy. It will also make JPEG copies of any RAW image files. The JPEG
creation can be enabled (see “Enable JPEGs” below).
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Make Working Copy is at the top of the list of possible
functions. If it not already displayed, press [Up Arrow] until “Make Working” is shown in
the display. Insert a blank DVD or CD and press the [Go] soft key to execute the
function.
On successful completion the disk is ejected. Where the total size of the files is greater
than the disk size, Puma will prompt for further blank disks to be inserted as required.

Cypher Technology Ltd 2008 10
Pressing the {Exit} soft key to returns to the top level.
4.6 Make Master Copy
This function will make a bit for bit copy of the whole of the Flash card to a DVD or CD.
This is a Master Copy.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Make Master is number 2 in the list of possible functions.
If it not already displayed, press the [Up Arrow] or [Down Arrow] until “Make Master” is
shown in the display. Insert a blank DVD or CD and press the [Go] soft key to execute
the function. Note that the whole card is backed up (see below) and therefore if DVD or
CD size is smaller than the Card size, multiple disks will be created. On successful
completion the disk is ejected.
Pressing the {Exit} soft key returns to the top level.
4.7 Verify Master Copy against Flash Card
This function will check that the contents of the Master Disk are identical to the inserted
Flash card.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Verify Master is number 3 in the list of possible functions.
If it not already displayed, press the [Up Arrow] or [Down Arrow] until “Verify Master” is
shown in the display. Insert the Master DVD or CD and the Flash card in the appropriate
Flash slot. Press the [Go] soft key to execute the function. When completed the
checksum of the Flash card (and the disk) is displayed.
Pressing the {Exit} soft key to returns to the top level.
4.8 Restore the Master Copy to a Flash Card
This function will copy the contents of the Master Disk to the inserted Flash card. This
Flash card will become a precise clone of the original card.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Restore Master is number 4 in the list of possible
functions. If it not already displayed, press the [Up Arrow] or [Down Arrow] until “Restore
Master” is shown in the display. Insert the Master DVD or CD and a Flash card that is
the same size or bigger than the original. Press the [Go] soft key to execute the
function. When completed the checksum of the Flash card (and the disk) is displayed.
This card is functionally identical to the original. It may be inserted back into the camera
or may be read on a computer and the images viewed or the files accessed.
Pressing the {Exit} soft key to returns to the top level.
4.9 Wipe Flash Card
This function will perform a forensic wipe of the Flash card. No data will be recoverable
from the card after this operation (see below).

Cypher Technology Ltd 2008 11
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Wipe Card is number 5 in the list of possible functions. If it
not already displayed, press [Up Arrow] or [Down Arrow] until “Wipe Card” is shown in
the display. Press the {Go} soft key to execute the function. This function writes “0”s to
the card. After the card is wiped, it is formatted as FAT32 and is ready for use. Pressing
the {Exit} soft key to returns to the top level.
4.10 Calculate the Checksum of the Flash Card
This function will generate a unique number from the contents of the Flash card. This is
called a checksum (see below). This number provides a useful and secure identification
for the card and the Master Copy. The checksum of the card will be the same as the
checksum of the Master image file for that card.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Checksum Card is number 6 in the list of possible
functions. If it not already displayed, press [Up Arrow] or [Down Arrow] until “Checksum
Card” is shown in the display. Press the {Go} soft key to execute the function. When the
process is complete, the checksum is displayed.
Pressing the {Exit} soft key to returns to the top level.
4.11 Format Flash card
This function first overwrites the Master Boot Record of the card with binary “0”s thereby
removing any boot sector viruses. It then re-partitions the card with a single primary
partition of the maximum size and then formats this with a FAT32 file system. Note this
function does not wipe the data area of the card. The Wipe card function must be used
if this is required. See Section 4.9.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Checksum Master is number 7 in the list of possible
functions. If it not already displayed, press [Up Arrow] or [Down Arrow] until “Format
Card” is shown in the display. Press the {Go} soft key to execute the function. When
complete “Formatted” is displayed.
Pressing the {Exit} soft key to returns to the top level.
4.12 Calculate the Checksum of the Master Disk Image
This function will generate a unique number from the contents of the Master Copy disk.
This is called a checksum (see below). This number provides a useful and secure
identification for the Master Copy and the Flash card.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Checksum Master is number 8 in the list of possible
functions. If it not already displayed, press [Up Arrow] or [Down Arrow] until “Checksum
Master” is shown in the display. Press the {Go} soft key to execute the function. When
complete the checksum is displayed.
Pressing the {Exit} soft key to returns to the top level.

Cypher Technology Ltd 2008 12
4.13 Enable JPEG creation on Working Copies
This function will turn on the automatic creation of JPEG files on Working Copy disks.
This will slow down the creation of the Working Copy where RAW image files are
present.
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Enable JPEGs is number 9 in the list of possible
functions. If it not already displayed, press [Up Arrow] or [Down Arrow] until “Enable
JPEGs” is shown in the display. Press the {Go} soft key to execute the function. Press
the {Change} soft key to toggle between enabling JPEG creation or disabling JPEG
creation.
Press the {Exit} soft key to return to the Menu and press {Exit} once more to return to
the Top Level.
4.14 Software Installation Procedure
This function installs new versions of the operating software. It is accessed from the
Menu as function 10. The procedure from a “cold” start is as follows:
1. Boot up Puma.
2. Press the {Menu} soft key to enter the menu.
3. Press the [Down Arrow] key until “10 Install Software” appears.
Either:
Press the [Disk] button to eject tray.
Place an upgrade disk on the tray and press [Disk] button once more to load the disk.
The disk will take a few seconds to be recognised. Please wait.
Or:
Plug in a USB drive to the rear panel of the Puma. This should have the install file and
the data files copied to the root directory of the drive as described in the download
instructions.
5. Press the {Go} soft key to start the software upgrade. The installation progress will be
shown on the screen. DO NOT SWITCH OFF DURING THIS PROCESS OR THE
SYSTEM MAY BE UNUSABLE.
6. When complete the system will display “Installation complete” or it will restart the new
version of the program.
7. Switch off and reboot.
8. Check the Version number (displayed at boot up) is the same as that labelled on the
Install CD or DVD.
4.15 Adjust the Internal Time and Date
This function allows the internal real-time clock to be adjusted. This clock is used to time
and date stamp the flash.img file on the Master disk.

Cypher Technology Ltd 2008 13
Press the {Menu} soft key to enter the Menu system. The Up/down arrow keys are used
to select the desired function. Adjust time is number 11 in the list of possible functions. If
it not already displayed, press [Down Arrow] until “Adjust Time” is shown in the
display. Press the {Go} soft key to execute the function. The time and date is displayed
in the top line of the display. E.g.
Adjust Time display 15:03:21 Tue Jan 9 2007
Sel <> Adj Up Dn Exit>
The hours number will flash and the [Up] and [Down] cursor keys can be used to adjust
the value. The [<] and [>] cursor keys can be used to select other fields. When the
correct time and date has been displayed, press the {Exit} soft key to exit back to the
Menu list.
Pressing the {Exit} soft key once more returns to the top level.
4.16 How is the Master Copy used?
4.16.1 Master Copy – The ultimate evidential exhibit
The Master Copy contains a single file called “flash.img” which is a bit for bit copy of the
whole of the Flash card. This includes the files, deleted files, the file system, partition
information and all historical file data. As such it provides the most secure, evidential
backup and allows the most complete evidential audit trail. It contains everything that
was on the Flash card and is the same size (in Kbytes) as the Flash card. The flash.img
file has its time created, modified and accessed values set to the time of the start of the
transfer. This time is taken from the system time as displayed on the front panel of the
machine at start-up.
When the flash card is bigger than the disk size, multiple disks are needed and each
disk will contain part of the image. The first disk will contain a file called flash1.img , the
second disk, flash2.img etc. These part images may be combined to form a single,
complete image file (see Section 4.18 ).
The Master Copy can be used in two ways. On a PC with an Image Viewer program or
by restoring the image back to a Flash card or USB disk.
4.17 Accessing the Master Copy with WinImage
Firstly, the flash.img file on the Master Copy disk can be opened with a disk image
viewer program. Such a program is WinImage, a trial version of which may be
downloaded from: http://www.winimage.com/download.htm

Cypher Technology Ltd 2008 14
Fig 3. Winimage screen display under Windows XP
The viewer programs allow the user to open the flash.img file as if they were opening a
disk in Windows explorer. Individual directories can be viewed and opened and their
files accessed or copied.
4.18 ImageMaker – Combining Multiple Disk Images
If the Master is split across several disks, the ImageMaker utility, on Master Disk #1
must be run to combine the images on the different Master Disks into one file. To run
ImageMaker, place Master Disk #1 in the PC drive. Double click on the ImageMaker
icon and run the program.
Fig 4. ImageMaker screen display under Windows XP
Select the destination folder with the Browse tab and then click {Start} to start
conversion. When the first disk is complete, then load disk #2. Follow the on screen
instructions until all disks have been transferred. After each disk is completed the

Cypher Technology Ltd 2008 15
following dialogue box is shown. After the last disk, press the {Finish} button to close the
image file.
Fig 5. ImageMaker dialogue
The name of the new, combined image file is shown in the message window and is
generated from the original image file name and the current date and time.
Fig 6. ImageMaker final screen
The Checksum shown at the end should be the same as the checksum noted down
during the making of the Master. Restore the Master Image to a Flash Card
This single .img file can be accessed by WinImage in the normal way.
Restore the Image Back to a Card
Secondly, the disk image can be copied back to a flash card of equal or greater size
than the flash.img file (and therefore the original Flash card). This copied flash card will
behave as an exact clone of the original allowing, for example, the un-erasing of files
and the forensic examination of file allocation addresses and access dates. On Puma
this task is performed by the Restore Master function (see Section 4.8).

Cypher Technology Ltd 2008 16
5 Technical Background
5.1 Master Copy (bit for bit copy)
The Master Copy contains a single file called “flash.img” which is a bit for bit copy of the
whole of the Flash card. Because the whole of the card is copied, the Master includes
hidden files, deleted files, historical file data fragments, original time-accessed and time-
modified data, the filing system (FAT), and the boot sector and partition information.
As such it provides the most secure, evidential backup and allows the most complete
evidential audit trail. It contains everything that was on the Flash card and is the same
size (in Kbytes) as the Flash card.
Simple card copiers only copy the undeleted, non-hidden files. This leaves the exhibit
open to legal challenge.
5.1.1 Why archive the file system?
First some technical background on how files (such as pictures in a digital camera) are
stored on a Flash card.
A file is a digital container for digital data. As an example, one digital still image is
normally stored in one file. The file has a name and this is how it is referenced and
accessed (e.g. DSC_0001.JPG).
A filing system on a disk or Flash card is used to show where all data in the files is
located on that disk or Flash card.
A filing system (such as the FAT16 or FAT32 system ) consists of two parts: a file
allocation table and the file data itself.
5.1.2 Partition Table
Sometimes it is useful to divide one physical disk (e.g. a hard disk) into multiple drives
(c: drive, e: drive etc.). A partition table describes how the drive is divided into different
virtual disks. Flash cards and USB pen drives consist normally of one partition, but still
normally contain a partition table. Strictly speaking they don’t need a partition table and
some flash cards don’t have one. Also, Windows XP will format a wiped, blank flash
card with no partition table.
The partition table is not updated after it is created but the way the partition table is
written will vary from system to system and thus can give some knowledge of the history
of the card.
5.1.3 File Allocation Information
Most Flash media cards use the FAT16 or FAT32 file system. When a file (e.g. a JPEG
picture file in a camera) is created, two things happen. Firstly the file data is written to
the data area of the card and secondly the file allocation table is updated. The file
allocation table contains such information as the file name, the file creation/modification
times and dates and of course where the file data lives on the card.

Cypher Technology Ltd 2008 17
5.1.4 File un-deletion
When a file is deleted the actual file data is normally left unchanged on the storage
device. The deletion involves marking the file name in the file table to show that the file
is no longer required and that the data space that was being used on the card can be
used for new files. Because of this, if no further data is written to the card, the original
deleted file may be retrieved or “un-deleted”. The Master Copy allows for un-deletion of
files where it was possible on the Flash card. (See “How is the Master Copy used?”
above). The Working Copy, of course, will not contain deleted files.
5.1.5 Historical file data
When a file is copied from the Flash card to another storage device (as with the
Working Copy) information about its creation may be lost. Most obviously this may
include the original modification and creation times from the Flash file table but also
more subtle historical information may be lost relating to the media history.
5.1.6 Media History
When a file is created on a blank piece of media, the storage space is generally
allocated from the beginning of the data area. Once several files have been created and
then a few have been deleted “holes” appear on the file data area where the old file
data resided. These holes will eventually be overwritten with new file data as new files
are created, but because these new files may be of different sizes to the old files, one
new file may have its data spread across the disk at various locations. The more a
Flash card or drive is used, the more fragmented it becomes. This gives valuable
information about the use of the media and the time of creation or modification of a file.
The Master Copy preserves all this information as it provides an exact snapshot
of the state of the card when the copy is taken and because it leaves all the card
data unchanged within the backup. The Master Copy is therefore the most
important evidential backup.
5.2 Disk Verify Read
Most backup programs simply copy the data to the backup medium and assume it has
been written correctly and can be re-read. With optical disks this is particularly
dangerous. PUMA dramatically reduces the chance of producing unreadable disks by
performing a verify read of the disk after it has been written. The verify pass itself,
involves re-reading every data bit from the Flash card and checking it against every bit
in the flash.img file.
5.3 Working Copy (file copy)
The Working Copy is a full copy of the directory tree of the Flash card or USB drive.
This means all files and directories are copied. Any file types can be copied. It provides
a function similar to conventional backup software.
For the files on the Flash card to be recognised by PUMA, the card must be formatted
with a FAT16 or FAT32 file system. The Working Copy disk uses an ISO9660 filing
system and is recognised by most computing platforms. The system also implements
the Joliet extension to the ISO 9660 standard which allows for long file names.

Cypher Technology Ltd 2008 18
Where RAW image files are detected, the system automatically converts them to a
JPEG compressed image file with a compression ratio of about 7:1. The file has the
same root name as the original, so that dcn0005.nef becomes dcn0005nef.jpg. For
most picture content it will not be possible to readily observe any difference in quality
between the JPEG and RAW images. Where this feature is not required, it may be
disabled (see above).
A wide range of RAW file formats are supported and these are listed in the Appendix.
5.4 Card and Disk Checksum
Puma produces a 32 bit checksum of the Flash card and Master Copy file. The
checksum is a unique number derived from all the data on the card or from the whole
image file on the Master Copy. As such the checksum will always change if any data
changes are made within the file or on the card. The chance of two Flash cards, with
different image data, of having the same checksum is 1 in 4,000,000,000.
The checksum of a Flash card or Master Copy can be found using the Menu functions
(see above).
5.5 Flash Card Wipe (Erasing)
As mentioned above, when a file is deleted the file data remains on the medium. This
file may be un-deleted and the file’s data recovered. The only way to render the card
safe from data recovery is to re-write the whole card with new data. Puma “Wipe Card”
function writes binary zeros to the whole card. Also viruses may be present in the
Master Boot Record (MBR). During the wipe process the MBR is overwritten also and is
recreated during the format operation.
5.6 System Architecture
Puma is based on a Linux platform and uses proprietary software. The proprietary
nature of the software has allowed the transfer process to be tailored precisely to the
needs of law enforcement and evidence gathering. For maximum reliability and security
it contains no hard disk and boots from a read-only Flash file system.
5.7 Transfer Times
The Media Transfer Station uses a full height, high performance CD/DVD writer drive.
This type of drive provides transfer rates up to 20 Mbyte/sec compared with 8Mbyte/sec
for laptop drives. Also, the larger size of the drive provides a higher reliability disk.
Further time is saved during the transfer as the separate tasks (Transfer, Verify and
Erase) are started automatically, one after the other. The user does not have to open
separate applications for disk imaging, file copy, file verify, raw file conversion and Flash
erase. Clearly for the user to run these five programs manually in sequence would
require considerable time and perhaps more important, be prone to error. A single,
automated process avoids these sources of error and saves time.
For reading, the maximum transfer rate (at he outside of the disk) is about 20
Mbytes/sec. A 4 Gbyte card can be copied in about 4 minutes.

Cypher Technology Ltd 2008 19
Master Creation
When making the Master disk, the whole contents of the Flash card are coped to the
CD/DVD. The transfer time is dependent on the Flash card size. A 4GByte card would
take about 5 minutes to transfer.
Master Verify
This involves re-reading the Flash card and comparing the data with the disk image.
This takes about 4 minutes for a 4 Gbyte card.
Working Copy Creation
This involves only copying the files themselves and the time taken will depend on the
amount of data contained in the files. A large RAW file of say 16 Mbytes would take
around 1 second to transfer.
Where a JPEG is created from the RAW file this will take from a few seconds to a few
tens of seconds per file depending on the size of the RAW file.
Flash Erasure
The erasing process involves writing a fixed binary pattern of data back to the Flash
media so that the original data cannot be recovered or un-erased under any
circumstances. This wiping process therefore depends on the write speed of the
particular Flash card. Write speeds are commonly up to about 10 Mbytes/s which gives
an erase time of about 6 minutes for a 4 Gbyte card.
Transfer Time for a Complete Automated Master and Working Copy
Example:
For a 4 Gbyte SD card with 6 x 16 Mbytes RAW files the transfer time would be:
Create Master 5 Mins
Master Verify 4 Mins
Create Working Copy 3 Mins (depends of RAW conversion speed)
Erase Flash 6 Mins(Depends of Flash card type and brand)
Total 18 Minutes
5.8 RAW File handling
RAW to JPEG converter
The system incorporates a RAW image file format converter. This automatically detects
the type of RAW file present and converts it to a standard JPEG image file which is
added to the Working Copy along with the original RAW format file. The JPEG will
typically be about 1/7th the size of the RAW file, and so will not add greatly to storage
requirements. This software is maintained and new formats are supported as they arise.
The JPEG file will have the same root name as the RAW file. For example, if the RAW
image file is D94L0948.DCR the JPEG will be D94L0948DCR.JPG
The cameras currently supported by the converter are listed in Appendix 1.

Cypher Technology Ltd 2008 20
6 Technical Support
6.1 System re-starting in the event of failure
Every effort has been made to allow PUMA cope gracefully with various fault conditions.
It is possible, however, that the system will temporally lock-out. If the system does not
respond during use (please wait for 3 minutes during a transfer), then the system should
be powered down by switching off at the rear panel. Remove the Flash card and re-start
the system. The disk can only be ejected once the system is ready for use. In an
emergency, when the system cannot be powered, the disk can be ejected by pushing
hard with a blunt rod through the disk eject hole in the front panel.
6.2 Contact
In case any technical or user assistance is required please contact Griffiths
Communications on:
+01547 560112
or email:
[email protected]
Address:
Griffiths Communications,
Unit 31, Ddole Road Enterprise Park
Llandrindod Wells,
Powys,
LD1 6DF
or
Cypher Technology Limited,
5-7 Gravel Hill,
Leatherhead,
Surrey,
KT22 7HG
6.3 Software Updates
The system can be updated with new application software when necessary. This
software can be installed from CD or from a USB thumb drive. See Section 4.14.
Updates can be downloaded from:
:
http://www.cyphertechnology.co.uk/