Forensic Duplicators

Where a write blocker needs a workstation and imaging software, a duplicator does the whole job on its own. The examiner connects the evidence drive to a write-blocked source port, a clean destination drive or network share to an output port, chooses the image format and starts the job from a touchscreen. The device reads the source, writes the image, calculates hashes and reads the result back to verify it. Current examples are the OpenText Forensic TX2 Imager, which replaced the long-serving Tableau TX1 and introduced a parallel block-hash verification it calls tree hashing, and the Logicube Falcon-NEO2, which images to dd, dmg, E01 and Ex01 with MD5, SHA1 and SHA256 hashes and can run several jobs at once.

These units are built for volume and for the field. Source and destination ports usually cover SATA, PCIe NVMe and USB, with SAS, IDE and FireWire through adapters. Both products named above image to a network repository, offer logical imaging that collects selected files into L01 or similar containers, and can wipe destination media before use. Some can pass known credentials to BitLocker or Opal drives. The examiner's job is to choose the right mode, record the settings and keep the log the device produces, because that log and the hash are what the court will see.