Description
Next-generation imaging
The Ditto DX Forensic FieldStation has been optimized for various forms of media, including SATA SSDs, NVMe/PCIe SSDs, hard drives, SD and CF cards, and others.
Compromise-free peripheral management
Ditto DX improves on the original Ditto with an additional control interface that sports dedicated Ethernet and USB ports for remote access and connecting peripherals. What’s more, this frees the USB and Ethernet ports that were meant for imaging and capturing data to be used only for those purposes.
Time-saving Logical Imaging
With hard drives and networked file shares exploding in size, Logical Imaging is more important than ever. Ditto DX Logical Imaging performance is twice that of the original Ditto device. And with automatic, pre-selected search and acquire capability, Ditto DX slashes the time it takes to capture needed evidence. You can also create your own search and collection scripts for an even more targeted approach.
Remote operation
An easy-to-use web browser interface supports remote operation via network or VPN, providing access to Ditto configuration, user administration and user rights, as well as direct operation of Ditto cloning and imaging operations.
Create logical and physical images in the field
The built-in menu system makes it easy to configure and perform forensic captures without an attached computer. Optionally, attach a computer for additional options such as generating complete listings of drive or file system contents to facilitate discovery, or automatically capture specific file types.
Source Inputs (write-blocked)
Ditto natively supports many write-blocked inputs: SATA, eSATA, PATA, USB3.x/2.0. Additional acquisition interfaces are available via expansion modules, such as the Ditto SAS Expansion Module and Ditto FireWire Expansion Module.
Destination Outputs
Use dual SATA outputs simultaneously with same performance as one eSATA (single, dual and mirrored). Images can also be output to large volumes, including NAS and other network destinations, as well as portable RAID enclosures.
Data Acquisition Modes
Clone, DD, E01, L01 with MD5, SHA-1, or SHA-256 hashing. Ditto DX also offers a combined mode that captures a clone and DD or E01 (to different destination drives) in a single pass reading of the suspect drive.
Pause and Resume
The Ditto family of imagers was the first to include a pause and resume feature. When creating a Physical Image DD, the investigator may pause the imaging process, disconnect everything for secure storage and then come back later to resume the image without losing any previous work.
Image Restore
Restore an image to a Destination drive to create a bootable clone of the original drive.
S.M.A.R.T. and hdparm Data
Ditto DX allows investigators to collect S.M.A.R.T and hdparm data for any connected device.
Hard Drive Password Lock/Unlock and Encryption
Ditto DX automatically identifies drives that are firmware password protected. The investigator may enter the password, if known, to unlock the drive. Ditto DX also supports whole disk encryption using the AES 256 OPAL encryption schema. If known, the investigator can enter the passphrase to decrypt the drive for imaging.
PCIe Support
Ditto DX supports imaging NVMe drives and using NVMe drives as a Destination device. Additionally, other PCIe devices can be accessed using PCIe adapters.
Complete and Secure Erasure
Ditto DX is capable of sanitizing drives with preset erase modes or a user configurable pattern. NVMe devices and other drives can be securely wiped using a variety of sanitization modes including DOD Clear and Sanitize modes plus NIST800-88 Clear and Purge. The drive can also be formatted after the erase is complete.
