Mediaimager GM4 SuperKIT User manual

Users’ Guide
Version 1.7
Mediarecovery
Nowogrodzka 56A
00-695 Warszawa, Poland
[phone]
[email protected]m
Technical Support:
Phone: [phone]
E-Mail: [email protected]m
Home Page: http://www.mediaimager.com

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 2 of 63
Table of Contents
About Mediarecovery ............................................................................................................................. 4
Production of hardware and software ................................................................................................ 4
Business partners ................................................................................................................................ 4
Certifications ....................................................................................................................................... 4
Educational activities .......................................................................................................................... 4
About this Guide ................................................................................................................................. 5
Mediaimager ........................................................................................................................................... 6
Kit contents ......................................................................................................................................... 8
The features and capabilities .............................................................................................................. 9
List of accessories included in Mediaimager SuperKIT ..................................................................... 10
Technical specifications .................................................................................................................... 13
Setting up the Mediaimager ................................................................................................................. 14
Using the Mediaimager ......................................................................................................................... 18
Home Screen ..................................................................................................................................... 18
New Case ........................................................................................................................................... 20
Open Case ......................................................................................................................................... 21
Connecting drives ............................................................................................................................. 21
Duplication ........................................................................................................................................ 22
Mediaimager allows to create multiple type of a disk images, such as: ...................................... 22
Disk to disk (cloning 1:1) ............................................................................................................... 22
Disk to disk (cloning 1:1) with marker .......................................................................................... 26
Disk to file ..................................................................................................................................... 27
Disk to file with span function ...................................................................................................... 31
Disk to file – network share .......................................................................................................... 32
Disk to file – image allocated data ................................................................................................ 33
Disk to file – image data manual ................................................................................................... 34
Restoring image ................................................................................................................................ 37
Restoring image ............................................................................................................................ 37
Hashing.............................................................................................................................................. 40
Disk hashing .................................................................................................................................. 40
Image hashing ............................................................................................................................... 42
Disk hashing with marker .............................................................................................................. 44
Remote access .................................................................................................................................. 45
Erasing ............................................................................................................................................... 46

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 3 of 63
Processes list ..................................................................................................................................... 48
Logs ................................................................................................................................................... 52
Diagnostics ........................................................................................................................................ 55
Settings.............................................................................................................................................. 56
Calibrate touchscreen ................................................................................................................... 58
Uncalibrated device (medium) ..................................................................................................... 59
Exit menu .......................................................................................................................................... 60
Definitions ......................................................................................................................................... 61
Troubleshooting .................................................................................................................................... 62
Crash recovery .................................................................................................................................. 62
Black screen issues ............................................................................................................................ 62
Service and repairs ............................................................................................................................ 62
Frequently asked questions .................................................................................................................. 62
Does the Mediaimager write-protect the source drive? .................................................................. 62
How fast is MI at duplicating hard drives? ........................................................................................ 62
Does MI duplicator work with USB memory card readers? ............................................................. 62
I recalculated hash value from the SSD drive and it is different from the original one. Have I done
something wrong? ............................................................................................................................ 62
Are there any software updates for MI? If so, how could I know there is one. ............................... 63
Is the set of adapters only available in the SuperKIT version of MediaImager? Can I buy it
separately? ........................................................................................................................................ 63
Is my language supported? ............................................................................................................... 63
Can I setup the time zone? ............................................................................................................... 63
What operating system does Mediaimager use? ............................................................................. 63
What file system does Mediaimager use when formatting target drives? ...................................... 63
Does Mediaimager go with a carrying case? .................................................................................... 63
Do you have representatives in my local area? ................................................................................ 63
Do I need to work in Law Enforcement in order to buy the Mediaimager? ..................................... 63
Which ports are available on the expansion cable? ......................................................................... 63

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 4 of 63
About Mediarecovery
Mediarecovery is a leading centre for research and development in the field of computer forensics
and data security. The company owns one of the biggest Computer Forensics laboratories in
Europe, where search and analysis of digital evidence are conducted, including the analysis of
information security infringement, hacking, data leaks, frauds and malpractices are processed.
Moreover, the laboratory specializes in data recovery and data erase. The specialists of
Mediarecovery are the most experienced ones on the Polish market in analysing digital information,
including incident information, network intrusion, unethical or illegal activities of employees. More
than 7,000 expertise have been performed so far. The company implements advanced IT security
solutions in the largest banks, insurance companies and the government sector.
Production of hardware and software
Mediarecovery specialists, based on many years of experience, have designed a series of data
duplicators – Mediaimager. For several years, the company has been a manufacturer of equipment
for irreversible data erasure – Mediaeraser. At the beginning of 2015 Mediarecovery launched
another model of degausser – Mediaeraser MD 205.
Business partners
Mediarecovery Computer Forensics Laboratory is among leading companies in the area of
computer forensics such as: Guidance Software, AccessData, Belkasoft, Oxygen
Forensic, Microsystemation, Tableau, X-Ways Forensics Magnet, Passware, ICS, ACE Laboratory etc.
Certifications
In 2008 Mediarecovery Computer Forensics Laboratory was certified by the Polish Internal
Security Agency (ABW) that confirms that process of classifying information is safe. In 2013
the company implemented Information Security Management System based on the standard CEI /
IEC ISO 27001:2013. The system guarantees that the company fulfils all the legal requirements and
gives maximum protection of the processed and stored information.
Educational activities
Mediarecovery has published “Magazine of Computer Forensics” since 2008. The authors of the
magazine are experienced specialists in the field of computer forensics. The company also operates
an educational project – Academy of Computer Forensics. At the end of the trainings, participants
take an exam certifying their competence and knowledge. Mediarecovery also leads advanced

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 5 of 63
collaboration with the Computer Forensic Institute Association. The members of association are
forensic experts, IT security experts and lawyers who specialize in new technologies.
About this Guide
This guide is designed to assist users when working on the Mediaimager device. It consists of
technical specification of the Mediaimager, its features, interface and functionality information.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 6 of 63
Mediaimager
Mediaimager is a powerful forensic duplicator that allows making binary copies of media storage in a
fast and safe way, capable of making 2 copies simultaneously in the Basic version, up to even 6
copies in the same time in the Pro and SuperKIT versions.
It is a portable device, working in compliance with best forensic practises where the source disks are
connected to write-blocking ports, and copies are 100% true images of the original drive. At the
moment of development, Mediaimager is the most powerful forensic duplicator on the market with
features and functions needed for the most demanding specialists:
 High speed operation – data transfers up to 25 GB/min.
 High numbers of parallel captures:
o 1:1 x4
o 1:2 x4
o 1:3 x3
o 1:4 x2.
 Expansion cable – extending device capabilities with another 4 ports (configurable when
buying, with a possibility of editing by a user: 4 additional sources or 2 additional sources
and 2 additional targets).
 Supported interfaces:
o Native support for SATA, USB 3.0 devices.
o Set of adapters allow investigator to connect drives with interfaces such as:
 X1 Carbon Ultrabook SSD to SATA adapter
 UX21, UX31, UX31, Adata, Sandisk XM11 SSD to SATA adapter
 Mac Book Air SSD to SATA adapter
 micro SATA to SATA adapter
 M.2 SSD (NGFF) to SATA adapter
 Lenovo Yoga SSD adapter
 ATA (1,8” | 2,5” | 3,5”)
 LIF and ZIF HDD to SATA adapter
 ASUS ZenBook SSD to SATA adapter
 mSata to SATA adapter
 USB to SATA adapter
 Card reader SD (USB 3.0)
 Molex to SATA cable

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 7 of 63
 eSATA to SATA (cable)
 USB 3.0 to eSATA Adapter
 SATA 29P Male to Male Cables with secure screws
 Detailed log and processes information with an option to export outside the device.
 Multi operational mode: Image, hash, wipe and restore in the same time.
 Multiple hash mode – device is capable of hashing drives and images using MD5, SHA1 and
SHA2 (SHA256, SHA384, SHA512).
 Multiple imaging formats support – images can be done to a file in DD or E01 formats or can
be mirrored (cloned 1:1) - disk to disk.
 Restore function – created images can be restored to another drive.
 Erase function – data can be erased in a irreversibly way by choosing from 1 to 35 passes of
data .
 10’’ colour touch screen user interface making its usage easy and comfortable.
 Highly secure environment – capability to encrypt the binary copy (AES256).
 100% of Mediaimager software is created by Mediarecovery specialists.
 Parts used to assembly the device are the highest quality.
 Ability to connect external displays by using DVI or HDMI port.
 High mobility due to the small size of the device (276 x 202 x 103 mm).

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 8 of 63
Kit contents
Mediaimager SuperKIT is the highest of all three duplicator versions and it comes together with:
Mediaimager duplicator
Power supply + power cord
SATA/SAS cable x 4
Case pack
Set of adapters
Expansion cable

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 9 of 63
The features and capabilities
 Processing power: i7 processor and 8 GB of RAM memory (extendable to 16 GB).
 Process management based on case.
 Copying sessions: 6.
 Maximum of 18 disks connected at the same time.
 Write-protected source ports.
 Capture Modes:
o E01
o LinuxDD
o Mirror Image Capture
o Data fragments copy (targeted triage)
o Capture to Network Storage
 6 source locations (2x SAS/SATA + 2x USB 3.0) + 2x SAS/SATA on extension cable.
 12 destination locations:
o 4 dedicated (2x SAS/SATA + 2x USB 3.0)
o 6 additional (6x USB 3.0)
o 2 additional by extension cable (2x SAS/SATA)
 Hash calculation:
o MD5
o SHA1
o SHA2 (SHA-256, SHA-384, SHA-512)
 Encryption support (image file) AES256.
 Wiping standards:
o DoD
o Single Pass
o Secure Erase
o Full Gutmann
o From 1 to 35 passes
 Restore function.
 Browsing the files structure (FAT, NTFS).
 Reporting and logging function for all activities.
o Different report formats (PDF)
o Export option
 HDD S.M.A.R.T. Analysis.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 10 of 63
 Advanced acquisition options (Read Step, Skip Count, Retry Count).
 Formatting target drives (NTFS - MBR or GPT).
 10,4” colour touch screen.
 Interfaces to connect external display (DVI, HDMI, DisplayPort).
 Operating system: Windows 8 Embedded or Windows 10 Embedded.
 Gigabit Ethernet.
 Case pack.
 Adapters and accessories (listed below - pictorial images, the supplied adapters may look a
bit different).
List of accessories included in Mediaimager SuperKIT
X1 Carbon Ultrabook SSD to SATA adapter
UX21, UX31, UX31, Adata, Sandisk XM11 SSD to SATA adapter
Mac Book Air SSD to SATA adapter
micro SATA to SATA adapter

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 11 of 63
ATA 2,5" to SATA adapter
ATA 3,5" to SATA adapter
1,8” ATA Adapter
SATA 29P Male to Male Cable z bezpiecznymi śrubkami
LIF HDD to SATA adapter
ZIF HDD to SATA adapter

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 12 of 63
Adapter M.2 (NGFF) to SATA
Lenovo Yoga to SATA Adapter
mSATA to SATA Adapter
USB HUB
Adapter SATA to USB 3.0
Multi Card Reader USB 3.0

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 13 of 63
USB 3.0 to eSATA Adapter
Technical specifications
• Voltage: 12V @ 15A.
• Output voltage: 5V @ 5A, 12V @ 4A.
• Dimensions: 276 x 202 x 103 mm.
• Weight: 4 kg.
• Operating Temperature: 5 - 50 ° C.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 14 of 63
Setting up the Mediaimager
Duplicator can be used both by using touchscreen user interface or by using external USB keyboard
and mouse (not included in the set). Touchscreen is 10,4’’ large in colour which gives user a full
control over the processes done on it.
The device has been designed to give users as much capability as possible, yet be very simple to use.
The only hardware button on the devices is a power button, located on the front side of the device.
All other functions are available by using touchscreen user interface.
Just under the power button, there is DC Power In connector, which for the extra security of the
device and evidence material, has the ability to fasten the cable to the device to minimize the
possibility of disconnecting power while working on the device.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 15 of 63
On the left side of the device, there are 4 SOURCE ports located as presented on the photo below:
2 x SOURCE SAS/SATA ports – Source 1 and Source 2
2 x SOURCE USB 3.0 ports – Source 3 and Source 4
Source ports are used for connecting:
 Original drives to be hashed/imaged.
 Drive with an image to restore.
 Drive with hidden HPA/DCO areas (SATA only).
These has been clearly marked as SOURCE Ports ( with number from 1 to 4) according to their
markings in the Mediaimager software on the device as well as, has been separated and marked as
USB 3.0 and SATA/SATA ports.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 16 of 63
On the right side of the device, there are 4 TARGET ports located as presented on the photo below:
2 x TARGET SAS/SATA ports – Target 1 and Target 2
2 x TARGET USB 3.0 ports - Target 3 and Target 4
Target ports are used for connecting:
 destination drives for an image copy
 drives with an image to be hashed
 drives for data erase
 destination drives in case of restoring an image
These has been clearly marked as TARGET Ports ( with number from 1 to 4) according to their
markings in the MediaImager software on the device as well as, has been separated and marked as
USB 3.0 and SATA/SATA ports.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 17 of 63
Back panel of the Mediaimager forensic duplicator consists of marked area to connect the extension
cable and its power supply.
Under the logo, there are set of interfaces (the number of ports and their location may be different):
 Video interfaces to connect external displays – DVI, HDMI or DisplayPort.
 6 USB 3.0 ports – marked in blue colour – these may be used as additional USB 3.0 TARGET
interfaces
 2x USB 2.0 (marked in black) to connect external keyboard and mouse for an additional
control of user interface
 2x Gigabit Ethernet interface – this port will be used to send data through network, e.g.
to NAS. This feature will be available in the nearest future. For now, only one at the time can
be used .
On the right side of described interfaces there is Expansion area.
In the red bordered area there is a mini-SAS socket with dedicated external power socket.
Using expansion cable and power adapter will give opportunity to add additional SAS/SATA drives:
 2 x SOURCE SAS / SATA – Source 5 and Source 6
 2 x TARGET SAS / SATA – Target 5 and Target 6
In order to use the Mediaimager forensic duplicator, the machine should be placed on a flat surface
with a Power adapter connected to the Power-In port, located in the front of the device. Once the
power adapter is plugged in, make sure the ring around it is correctly turned. Now the device can be
powered on by pressing the Power button located above the Power In port, on the front panel. Once
launched, the Windows logo will appear on the screen. When prompted, log in using password
received during the purchase ( optional). Upon successful login, Mediaimager user interface will be
displayed and the device is ready to work.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 18 of 63
Using the Mediaimager
In order to perform any task on the device, a new case must be created or existing case must be
opened.
Home Screen
Upon successful login, Home screen will be displayed to the user.
Main screen is divided into three parts:
Left panel - provides access to all device functions.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 19 of 63
Tiles – allow quick access to all functions of the Mediaimager directly from the Home screen.
Top taskbar – contains information like time and date, logs, running processes and case info.

MEDIAIMAGER – Users’ Guide, Version 1.7
Page 20 of 63
New Case
“Create New Case” window can be opened by pressing the “New Case” tile, located in the top left
corner.
When creating a new case, a user can enter details such as:
 Case ID
 Case Examiner
 Case Notes
The above details will appear in logs and reports of created cases. Virtual keyboard will appear upon
click in order to input the data.
Error message will appear if a typed Case ID already exists. If prompted, please type another Case ID.