Designed for digital forensic labs, the ZXi™ Forensic’s blazing fast imaging speeds of over 50GB*/min and three Gigabit Ethernet ports streamline forensic imaging processes. The solution provides a network “Push” feature that allows users to upload images from up to 3 evidence drives directly to a network repository simultaneously. Add the optional 3 drive expansion kit to push up to a total of 5 evidence drives.

• Extreme speed, imaging at over 50GB/min*

• Designed for digital forensic labs

• Three Gigabit Ethernet ports

• Network “Push” feature to upload images to a network repository from 3 evidence drives simultaneously

• Image from 3 suspect drives to a network repository or to 3 evidence drives simultaneously

• Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using the ZXi-Forensic or Veracrypt

• Optional expansion kit adds 3 additional destination drives

Features:

High Speed ImagingThe ZXi-Forensic can achieve imaging speeds of over 50GB/min*.
Multi-Target, Volume ImagingImage from 3 suspect drives simultaneously to network repositories using 3 Gigabit Ethernet connections; image from 3 source drives directly to 3 destination drives; image from 3 source drives to network repositories and simultaneously image to 3 destination hard drives. Use the optional expansion kit to add 3 additional destinations
Multiple Imaging PortsWrite-protected source ports include:
3 SAS/SATA
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)

Destination ports include:
3 SAS/SATA
2 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
Imaging FormatsSupports dd, ex01, e01 or native imaging formats. The ZXi-Forensic supports SHA1, SHA256 or MD5 authentication.
Parallel ImagingSimultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01 format.
Web Browser/Remote OperationAn easy to use and intuitive interface allows you to connect to the ZXi-Forensic from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.
Broad Interface SupportBuilt-in support for SAS/SATA/USB storage devices, including SSDs. Supports 1.8″/2.5″/3.5″ IDE and 1.8″ IDE ZIF, eSATA, mSATA,M.2 PCIe (AHCI & SATA types), flash drives and microSATA interfaces with optional adapters.
WipeWipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min
Image From Desktop/Laptop PCsUsers have the ability to image from a desktop or laptop computer without removing the hard drive from the computer. Create a forensic bootable USB flash drive using software (available for download from our support Knowledge base on our website) that allows the user to image a source drive from a computer on the same network without booting the native operating system on the computer. It also allows drives connected to the networked computer (or directly connected to each other using a network cable) to appear as a destination drive without removing the drive from the computer.Error Granularity SettingDrive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found the ZXi-Forensic will, by default, skip that sector. Changing the granularity allows more sectors to be skipped. There are 3 options ( 512 Bytes, 4096 Bytes, 64 KIB,). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the ZXi-F will skip the entire cluster (or 4096 bytes or 8 sectors).Removable Storage DriveO/S and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations7″ Touch ScreenUses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.
HPA And DCO CaptureDetect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.
Drive SpanningCapture from one large capacity drive to two smaller capacity drives.
Removable Drive StationsEasy to remove drive stations are field replaceable

Network Push FeaturePush/upload evidence drive images (previously captured using Logicube’s Forensic Falcon or ZXi-Forensic) to a network repository. Push from up to 3 evidence drives simultaneously on the base unit or add the optional expansion kit and push from up to 5 evidence drives. An MD5 or SHA-1 hash is performed during the process and a log file is generated for each push task.
Image to or from a Network LocationUse the ZXi-Forensic to image to a network location using CIFS protocol and/or image from a network location using iSCSI. The ZXi-Forensic uses CIFS protocol to provide file system access and the highest level of security and control. Users can also use iSCSI as a source or destination drive.
Network ServicesUsers can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI Iperf and Ping, for security purposes
Forensic, Filter-Based File CopyUsers can filter and then image by the file extension (such as .PDF,.xls, .JPEG, .mov etc.).
Write-Blocked Drive PreviewPreview/ triage the drive contents directly on the ZXi-Forensic. The file browser feature provides logical access to source or destination drives connected to ZXi-Forensic. Users can view the drive’s partitions and contents, and view text files, jpeg, PDF, XML, HTML files. Other file types (such as .doc and .xls) can be viewed by connecting the ZXi-Forensic to a network and via a workstation, download and view. Users can use the iSCSI or SMB protocol to preview source drives via the network
Concurrent Image+VerifyImaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.
User Profiles/ConfigurationsAdministrators can save configuration settings and set password-protected user profiles.
Audit Trail Reporting/Log FilesProvides detailed information on each operation. Log files can be viewed on ZXi-Forensic or via a web browser, exported to XML, HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when connected to ZXi-Forensic via a web browser
EncryptionSecure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using the ZXi-Forensic or by using a free open source decryption software such as TrueCrypt or FreeOTFE.
Drive TrimAllows the ZXi-Forensic to manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive
Tasks MacroAllows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive.Set up to five Macros with up to 9 operations/tasks for each macro.
Drive “Time-Out” FeatureUsers can set a specific “time-out” for hard drives connected to the ZXi-Forensic. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives
USB Host PortsThe ZXi-Forensic features two USB 2.0 host ports for keyboard, mouse or printer connectivity
HDMI PortAn HDMI port is located on the back of the ZXi-Forensic. This port can be used to connect the ZXi-Forensic to a projector.
One-year Standard WarrantyThe system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty (total of 2 years) and a 2 year extended warranty (total of 3 years) are available.

In The BoxThe ZXi-Forensic includes the following:

Power supply and power cord
3 CAT6 network cable
6 SAS/SATA cables
Users manual on CD-ROM


*The ZXi-Forensic achieves speeds of over 50GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.