In brief

A catalog of the ELETEK line (a partner with a booth) rather than a comparison with manual copying: four duplicators (Element-U — acquisition from a PC without taking it apart, flash drives, SATA, a workstation), a RAW/E01 image viewer, "live" acquisition. There are no speed or accuracy figures, and the title is not borne out by the content. The value is in the new features of the releases and in the Q&A, where the limitations came out: it does not acquire RAM, encryption only sector-by-sector, it does not reassemble RAID, it does not know about TPM. The audience — law enforcement officers.

Key points

  1. ELETEK makes duplicators for fast and safe acquisition without changing the storage medium; part of the audience already has them in trial operation.
  2. Element-U (the name is given only in the Q&A): acquisition from a PC without opening the case; the native OS is not booted, the unit's own OS is loaded through the Boot Manager, and all internal and USB drives are mounted.
  3. New — acquisition by signatures, not only by masks (mp3, mp4): a swapped extension on a.docx does not prevent acquisition. "Parallel copying" — a choice of which drive to image first or as the only one.
  4. The flash-drive duplicator — built at the request of field operatives to image flash drives discreetly during an operation: up to two hours on battery, an Android app, a sector-by-sector copy without a phone, LED indicators.
  5. The SATA duplicator, "one of our newest": 2.5-inch HDDs/SSDs and 3.5-inch HDDs, "pass-through" copying, no internal memory to bring down the cost, a hardware write blocker.
  6. The workstation: a 7-inch display, Mini ATX, Intel Core i3, 8 GB of RAM (up to 16–32), a 2 TB NVMe (up to 4 TB), a power bank; sector-by-sector, a disk-to-disk clone, containers, a choice of files.
  7. From the exhibitions: a block of 64 kilobytes – 8 megabytes; the hash separately, during the process, or as a verification (previously only a "fixed verification"); hidden areas are checked automatically; only BitLocker is detected — and then only a sector-by-sector copy, the rest they are "currently working on". Reports (mode, disks, success, hash) and a "status drawer": evidence drives are read-only, trusted ones carry a volume label, and there is image deployment.
  8. An image viewer for RAW and E01: recovery of deleted files, of partitions, "detect deleted operating systems"; E01 on Astra Linux — on request. "Live" acquisition software for a computer that is switched on: Windows, Linux, Astra Linux "in our plans".
  9. Limitations from the Q&A: RAM is not acquired, encrypted disks only sector-by-sector and without viewing, RAID can be imaged but not reassembled, the speaker does not know about TPM, flash drives one at a time.

Tools, artifacts, technologies

No laws, no articles, no agencies, no methodologies; the Russian word for "forensic examination" is never spoken — what is said is "data acquisition", "evidence drives", "dumps", "field operatives". The procedural side is a property of the products: the storage medium stays unchanged, hashes, verification, reports. The products are built in response to officers' requests and to questions from the exhibitions; for details — come by the booth.

Questions from the audience

Ilya carried the microphone (he is named from the stage); there is no speaker labeling.

  1. From the audience: RAID? → it can be imaged, reassembling the array is up to the user.
  2. Yuri Mikhailovich: a RAM dump? → "we don't work with RAM yet", "on the verge of starting to work on that"; from the audience — "That's bad." An encrypted disk? → a sector-by-sector copy, no viewing of the data. Why a clone, if an image is better? → the basic mode is a copy to a file.
  3. From the audience: Secure Boot and TPM? → there is a Secure Boot bypass, and as for TPM, "it's hard to say off the top of my head".
  4. From the audience (front row): several USB drives at once? → the flash-drive duplicator acquires one storage device.

The speaker's position

An even, slide-by-slide presentation, with no polemics and no comparisons with competitors. The correct mode is a sector-by-sector copy to a file; the disk-to-disk clone is a concession to "a lot of officers". He acknowledges the limitations only under questioning.

Quotes