ZXi™-Forensic

Designed for digital forensic labs, the ZXi™-Forensic’s blazing fast imaging speeds of over 50GB*/min and three Gigabit Ethernet ports streamline forensic imaging processes. The solution provides a network “Push” feature that allows users to upload images from up to 3 evidence drives directly to a network repository simultaneously. Add the optional 3 drive expansion kit to push up to a total of 5 evidence drives.

Extreme speed, imaging at over 50GB/min*
Designed for digital forensic labs
Three Gigabit Ethernet ports
Network “Push” feature to upload images to a network repository from 3 evidence drives simultaneously
Image from 3 suspect drives to a network repository or to 3 evidence drives simultaneously
Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using the ZXi-Forensic or Veracrypt
Optional expansion kit adds 3 additional destination drives

High Speed Imaging
The ZXi-Forensic can achieve imaging speeds of over 50GB/min*.

Multi-Target, Volume Imaging
Image from 3 suspect drives simultaneously to network repositories using 3 Gigabit Ethernet connections; image from 3 source drives directly to 3 destination drives; image from 3 source drives to network repositories and simultaneously image to 3 destination hard drives. Use the optional expansion kit to add 3 additional destinations

Multiple Imaging Ports
Write-protected source ports include:
3 SAS/SATA
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
Destination ports include:
3 SAS/SATA
2 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)

Imaging Formats
Supports dd, ex01, e01 or native imaging formats. The ZXi-Forensic supports SHA1, SHA256 or MD5 authentication.

Parallel Imaging
Simultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01 format.

Web Browser/Remote Operation
An easy to use and intuitive interface allows you to connect to the ZXi-Forensic from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.

Broad Interface Support
Built-in support for SAS/SATA/USB storage devices, including SSDs. Supports 1.8″/2.5″/3.5″ IDE and 1.8″ IDE ZIF, eSATA, mSATA,M.2 PCIe (AHCI & SATA types), flash drives and microSATA interfaces with optional adapters.

Wipe
Wipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min

Image From Desktop/Laptop PCs
Users have the ability to image from a desktop or laptop computer without removing the hard drive from the computer. Create a forensic bootable USB flash drive using software (available for download from our support Knowledge base on our website) that allows the user to image a source drive from a computer on the same network without booting the native operating system on the computer. It also allows drives connected to the networked computer (or directly connected to each other using a network cable) to appear as a destination drive without removing the drive from the computer.

Error Granularity Setting
Drive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found the ZXi-Forensic will, by default, skip that sector. Changing the granularity allows more sectors to be skipped. There are 3 options ( 512 Bytes, 4096 Bytes, 64 KIB,). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the ZXi-F will skip the entire cluster (or 4096 bytes or 8 sectors).

Removable Storage Drive
O/S and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations

7″ Touch Screen
Uses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.

HPA And DCO Capture
Detect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.

Drive Spanning
Capture from one large capacity drive to two smaller capacity drives.

Removable Drive Stations
Easy to remove drive stations are field replaceable

Network Push Feature
Push/upload evidence drive images (previously captured using Logicube’s Forensic Falcon or ZXi-Forensic) to a network repository. Push from up to 3 evidence drives simultaneously on the base unit or add the optional expansion kit and push from up to 5 evidence drives. An MD5 or SHA-1 hash is performed during the process and a log file is generated for each push task.

Image to or from a Network Location
Use the ZXi-Forensic to image to a network location using CIFS protocol and/or image from a network location using iSCSI. The ZXi-Forensic uses CIFS protocol to provide file system access and the highest level of security and control. Users can also use iSCSI as a source or destination drive.

Network Services
Users can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI Iperf and Ping, for security purposes

Forensic, Filter-Based File Copy
Users can filter and then image by the file extension (such as .PDF,.xls, .JPEG, .mov etc.).

Write-Blocked Drive Preview
Preview/ triage the drive contents directly on the ZXi-Forensic. The file browser feature provides logical access to source or destination drives connected to ZXi-Forensic. Users can view the drive’s partitions and contents, and view text files, jpeg, PDF, XML, HTML files. Other file types (such as .doc and .xls) can be viewed by connecting the ZXi-Forensic to a network and via a workstation, download and view. Users can use the iSCSI or SMB protocol to preview source drives via the network

Concurrent Image+Verify
Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.

User Profiles/Configurations
Administrators can save configuration settings and set password-protected user profiles.

Audit Trail Reporting/Log Files
Provides detailed information on each operation. Log files can be viewed on ZXi-Forensic or via a web browser, exported to XML, HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when connected to ZXi-Forensic via a web browser

Encryption
Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using the ZXi-Forensic or by using a free open source decryption software such as TrueCrypt or FreeOTFE.

Drive Trim
Allows the ZXi-Forensic to manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive

Tasks Macro
Allows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive.Set up to five Macros with up to 9 operations/tasks for each macro.

Drive “Time-Out” Feature
Users can set a specific “time-out” for hard drives connected to the ZXi-Forensic. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives

USB Host Ports
The ZXi-Forensic features two USB 2.0 host ports for keyboard, mouse or printer connectivity

HDMI Port
An HDMI port is located on the back of the ZXi-Forensic. This port can be used to connect the ZXi-Forensic to a projector.

One-year Standard Warranty
The system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty (total of 2 years) and a 2 year extended warranty (total of 3 years) are available.

In The Box
The ZXi-Forensic includes the following:
Power supply and power cord
3 CAT6 network cable
6 SAS/SATA cables
Users manual on CD-ROM

*The ZXi-Forensic achieves speeds of over 50GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.

High Speed Imaging The ZXi-Forensic can achieve imaging speeds of over 50GB/min*.

Multiple Imaging Ports Write-protected source ports include: 3 SAS/SATA 1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter) Destination ports include: 3 SAS/SATA 2 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)

Imaging Formats Supports dd, ex01, e01 or native imaging formats. The ZXi-Forensic supports SHA1, SHA256 or MD5 authentication.

Parallel Imaging Simultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01 format.

Web Browser/Remote Operation An easy to use and intuitive interface allows you to connect to the ZXi-Forensic from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.

Broad Interface Support Built-in support for SAS/SATA/USB storage devices, including SSDs. Supports 1.8″/2.5″/3.5″ IDE and 1.8″ IDE ZIF, eSATA, mSATA,M.2 PCIe (AHCI & SATA types), flash drives and microSATA interfaces with optional adapters.

Wipe Wipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min

Removable Storage Drive O/S and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations

7″ Touch Screen Uses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.

HPA And DCO Capture Detect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.

Drive Spanning Capture from one large capacity drive to two smaller capacity drives.

Removable Drive Stations Easy to remove drive stations are field replaceable

Network Services Users can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI Iperf and Ping, for security purposes

Forensic, Filter-Based File Copy Users can filter and then image by the file extension (such as .PDF,.xls, .JPEG, .mov etc.).

Concurrent Image+Verify Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.

User Profiles/Configurations Administrators can save configuration settings and set password-protected user profiles.

Encryption Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using the ZXi-Forensic or by using a free open source decryption software such as TrueCrypt or FreeOTFE.

Drive Trim Allows the ZXi-Forensic to manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive

Tasks Macro Allows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive.Set up to five Macros with up to 9 operations/tasks for each macro.

Drive “Time-Out” Feature Users can set a specific “time-out” for hard drives connected to the ZXi-Forensic. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives

USB Host Ports The ZXi-Forensic features two USB 2.0 host ports for keyboard, mouse or printer connectivity

HDMI Port An HDMI port is located on the back of the ZXi-Forensic. This port can be used to connect the ZXi-Forensic to a projector.

One-year Standard Warranty The system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty (total of 2 years) and a 2 year extended warranty (total of 3 years) are available.

In The Box The ZXi-Forensic includes the following: Power supply and power cord 3 CAT6 network cable 6 SAS/SATA cables Users manual on CD-ROM

Logicube