IMSolo-IV Expansion Option Quick Start Guide - ICS-IQ.com

IMSolo-IV Expansion OptionQuick Start GuideRev 1.1This Quick Start Guide provides the procedure to quickly setup and start usingthe IMSolo-IV Expansion Option to capture data from additional devices whichhave interfaces not available on the IMSolo-IV unit. The IMSolo-IV ExpansionOption is configured with the following hardware:• FireWire 1394b PCI-Express card for connecting 1394a or 1394b massstorage devices.• SCSI Ultra320 PCI-Express card for connecting SCSI mass storagedevices.• PCI-Express to ExpressCard 34/54 Reader for connecting a broad rangeof ExpressCard compliant cards, such as ExpressCard USB 3.0 cardsused to connect USB 3.0 mass storage devices.NOTE: ExpressCards are not supplied with the Expansion OptionTransfer rates are dependent on the media and interface in use. The table belowprovides expected transfer rates using high performance drives.Interface Connection Transfer RateFireWire 1394b 1394b 4.5GB/minSCSI Ultra320 5.5GB/minUSB ExpressCard 1 USB 3.0 2.1GB/min1 ExpressCard is not supplied

ExpressCard34/54 ReaderFireWire1394bPortsSCSIPortFireWire1394a PortFRONT PANEL

External DrivePower-OUTPCI-eInterconnect PortExpansion PortPower-OUTIMSolo-IV BACK PANEL

SCSI In-Line TerminatorSCSI CABLEExpressCard/34(NOT Supplied)

Setup1. Power OFF the IMSolo-IV unit.2. Connect the Expansion Box Power Cable to the Expansion Box Power-OUTPort, located on the back of the IMSolo-IV unit and to the Expansion BoxPower-IN Port, located on the back of the Expansion Box.3. Connect the PCI-e Expansion Box Interconnect Cable to the IMSolo-IV unitand the Expansion Box, using the PCI-e Interconnect Ports located on theback of both units. Secure the cable’s connectors using the connectorsthumb screws.PCI-e Expansion BoxInterconnect CableExpansion BoxPower CableIMSolo-IV with Expansion Box – Back View

SCSI DataCableFireWire DataCableUSB 3.0 DataCable(Not Supplied)USB 3.0ExpressCard(Not Supplied)Expansion Box with Interface Cables

Operational ProceduresCapturing from External FireWire DrivesThe following procedure is recommended to capture data fromExternal FireWire drives using the Expansion Option.1. Power OFF the IMSolo-IV unit.2. Connect the Expansion Box to the IMSolo-IV unit using the SETUPInstructions outlined in the section titled SETUP.3. Connect the appropriate FireWire data cable to the Expansion Box and to theExternal FireWire drive.4. Power ON the IMSolo-IV by pressing the unit’s Power ON button, located ontop corner of the unit’s back panel. The IMSolo-IV Forensics AdvancedInterface Control Console will be displayed.NOTE: If the IMSolo-IV fails to initialize properly. Power OFF the IMSolo-IVand wait approximately 20 seconds before powering ON.Drive SelectionPanelOperational Modes

5. Attach the Evidence drive(s) to the IMSolo-IV unit’s Evidence ports using theICS supplied SATA/SAS drive data/power cables.6. Select the Mode of Operation from the Operations pull down menu.7. Power ON the External FireWire drive.8. Select the Evidence Drive(s) to be used for the selected operation from theDrive Selection Panel.NOTE: Do not select any Suspect position from the Drive Selection Panel.9. Select Detect Drives from the IMSolo-IV Forensics Advanced InterfaceControl Console screen. The detected FireWire drive will be listed in theOther Detected Drives, “Non-Active” drive panel. The Evidence drive will belisted in the Destination Drives panel list.NOTE: If the External FireWire Drive is not detected, reseat the FireWiredata cable and select Detect Drives again.10. Using the touch screen display, select and move the listed FireWire drivemodel from the Other Detected Drives Panel to the Source Drive Panel.11. Verify all remaining applicable settings and optionally enter Case Informationusing the CASE INFO screen functions. It is recommended to enable theHash Targets function. Selecting Hash Targets will result in the Captureoperation generating the Hash value for the data read from the Suspect driveand the data written to the Evidence drive. After all the data is written to theEvidence drive, the Capture operation will generate the Hash value for thedata read from the Evidence drive.Hash values generated during the capture operation are generatedfor the data read from the Suspect’s drive not from the data read fromthe Evidence (target) drive, unless the unit is instructed to hash theEvidence drive(s) by enabling the Hash Targets function. As analternative, the Evidence Drives can also be hashed after the captureoperation using the Hash mode of operation.12. Select START to begin the operation. Operational status information will bedisplayed during an operation.13. After the operation completes, the Evidence drive will be powered OFF andthe drive can be safely removed. Power OFF and disconnect the ExternalFireWire drive. The simulated drive status LEDs will be set to GREEN if theoperation passes or RED if the operation fails. Log files will automatically bestored internally and can be transferred to external media using the unit’sUSB ports, located on the back of the unit.

Capturing from SCSI DrivesThe following procedure is recommended to capture data from SCSIdrives using the Expansion Option.1. Power OFF the IMSolo-IV unit.2. Connect the Expansion Box to the IMSolo-IV unit using the SETUPInstructions outlined in the section titled SETUP.3. Connect the SCSI In-Line Terminator between to the supplied SCSI cableand to the SCSI drive.4. Connect the supplied SCSI cable to the Expansion Box. Secure the cableusing the connector’s thumb screws.5. Connect the supplied drive power cable to the SCSI drive and to theIMSolo-IV External Drive Power Connector, located on the back of theIMSolo-IV unit.NOTE: Due to power consumption, it may be necessary to use an externalpower source to power some SCSI drive models.

6. Power ON the IMSolo-IV by pressing the unit’s Power ON button, located ontop corner of the unit’s back panel. The IMSolo-IV Forensics AdvancedInterface Control Console will be displayed.NOTE: If the IMSolo-IV fails to initialize properly. Power OFF the IMSolo-IVand wait approximately 20 seconds before powering ON.Drive SelectionPanelOperational Modes7. Attach the Evidence drive(s) to the IMSolo-IV unit’s Evidence ports using theICS supplied SATA/SAS drive data/power cables.8. Select the Mode of Operation from the Operations pull down menu.9. Select the Evidence Drive(s) to be used for the selected operation from theDrive Selection Panel.NOTE: Do not select any Suspect position from the Drive Selection Panel.10. Select Detect Drives from the IMSolo-IV Forensics Advanced InterfaceControl Console screen. The detected SCSI drive will be listed in the OtherDetected Drives, “Non-Active” drive panel. The Evidence drive will be listedin the Destination Drives panel list.11. Using the touch screen display, select and move the listed SCSI drive modelfrom the Other Detected Drives Panel to the Source Drive Panel.

12. Verify all remaining applicable settings and optionally enter Case Informationusing the CASE INFO screen functions. It is recommended to enable theHash Targets function. Selecting Hash Targets will result in the Captureoperation generating the Hash value for the data read from the Suspect driveand the data written to the Evidence drive. After all the data is written to theEvidence drive, the Capture operation will generate the Hash value for thedata read from the Evidence drive.Hash values generated during the capture operation are generatedfor the data read from the Suspect’s drive not from the data read fromthe Evidence (target) drive, unless the unit is instructed to hash theEvidence drive(s) by enabling the Hash Targets function. As analternative, the Evidence Drives can also be hashed after the captureoperation using the Hash mode of operation.13. Select START to begin the operation. Operational status information will bedisplayed during an operation.14. After the operation completes, the Evidence drive will be powered OFF andthe drive can be safely removed. The SCSI drive will remain powered ON.The simulated drive status LEDs will be set to GREEN if the operation passesor RED if the operation fails. Log files will automatically be stored internallyand can be transferred to external media using the unit’s USB ports, locatedon the back of the unit.15. Power OFF the IMSolo-IV and disconnect the SCSI drive.

Capturing from ExpressCard Mass StorageDevicesThe following procedure is recommended to capture data from massstorage devices connected through an installed ExpressCard.NOTE: ExpressCards are not supplied with the Expansion Option.1. Power OFF the IMSolo-IV unit.2. Connect the Expansion Box to the IMSolo-IV unit using the SETUPInstructions outlined in the section titled SETUP.3. Connect the ExpressCard to the ExpressCard port of the Expansion Box.4. Power ON the IMSolo-IV by pressing the unit’s Power ON button, located ontop corner of the unit’s back panel. The IMSolo-IV Forensics AdvancedInterface Control Console will be displayed.NOTE: If the IMSolo-IV fails to initialize properly. Power OFF the IMSolo-IVand wait approximately 20 seconds before powering ON.5. The IMSolo-IV O/S will detect the ExpressCard as “New Hardware”, and aprompt will be displayed requesting drivers for the installed hardware.NOTE: Drivers can be installed using the IMSolo-IV unit’s general purposeUSB ports, located on the back of the unit. Insert a USB Thumbdrive with the appropriate driver files. Select Detect Drives and usethe unit’s Mount Drive function to mount the USB Thumb drive’svolume. Follow the prompts to install the appropriate driver for theinstalled hardware.

6. Select Remove Drives to “remove” the USB Thumb Drive and power cycle theIMSolo-IV unit. The IMSolo-IV Forensics Advanced Interface Control Consolewill be displayed.Drive SelectionPanelOperational Modes7. Attach the Evidence drive(s) to the IMSolo-IV unit’s Evidence ports using theICS supplied SATA/SAS drive data/power cables.8. Select the Mode of Operation from the Operations pull down menu.9. Connect the External Mass Storage Device to the installed ExpressCardusing the appropriate data cable for the device.10. Power ON the External Mass Storage device.11. Select the Evidence Drive(s) to be used for the selected operation from theDrive Selection Panel.NOTE: Do not select any Suspect position from the Drive Selection Panel.12. Select Detect Drives from the IMSolo-IV Forensics Advanced InterfaceControl Console screen. The detected Mass Storage Device will be listed inthe Other Detected Drives, “Non-Active” drive panel. The Evidence drive willbe listed in the Destination Drives panel list.NOTE: If the Mass Storage Device is not detected, reseat the device datacable and select Detect Drives again.

13. Using the touch screen display, select and move the listed Mass StorageDevice model from the Other Detected Drives Panel to the Source DrivePanel.14. Verify all remaining applicable settings and optionally enter Case Informationusing the CASE INFO screen functions. It is recommended to enable theHash Targets function. Selecting Hash Targets will result in the Captureoperation generating the Hash value for the data read from the Suspect driveand the data written to the Evidence drive. After all the data is written to theEvidence drive, the Capture operation will generate the Hash value for thedata read from the Evidence drive.Hash values generated during the capture operation are generatedfor the data read from the Suspect’s drive not from the data read fromthe Evidence (target) drive, unless the unit is instructed to hash theEvidence drive(s) by enabling the Hash Targets function. As analternative, the Evidence Drives can also be hashed after the captureoperation using the Hash mode of operation.15. Select START to begin the operation. Operational status information will bedisplayed during an operation.16. After the operation completes, the Evidence drive will be powered OFF andthe can be safely removed. Power OFF and disconnect the External MassStorage device. The simulated drive status LEDs will be set to GREEN if theoperation passes or RED if the operation fails. Log files will automatically bestored internally and can be transferred to external media using the unit’sUSB ports, located on the back of the unit.

Menu ItemCOMMON SETTINGSSingle Capture SettingsTable 1SettingOperational ModesSingle CaptureBad Sector HandlingLog and SkipWrite-VerifyDisable (Optional)Readback-HashEnable (Optional)Transfer Buffer Size (64KB)10– Located under ProgramSettingsBad Sector HandlingAbort DriveHashing Methods CRC32: OFFMD5: ONSHA1: OFFSHA2: OFFMenu ItemLinuxDD Capture SettingsTable 2SettingOperational ModesLinuxDD CaptureBad Sector HandlingLog and SkipWrite-VerifyDisable (Optional)Readback-HashEnable (Optional)Transfer Buffer Size (64KB)10– Located under ProgramSettingsBad Sector HandlingAbort DriveHashing Methods CRC32: OFFMD5: ONSHA1: OFFSHA2: OFFFile Size 4000