# Duplicators vs. manual copying: when speed and accuracy are critical Vladimir Greshnov · ELETEK MOSCOW FORENSICS DAY ’25 · Day 1 — Thursday, 11 September 2025: digital forensics day · Scheduled 10:10–10:40 · In the recording 00:06:45–00:27:56 Talk summary · https://2025.moscow-forensics-day.workers.dev/en/summary/01-greshnov Transcript: https://2025.moscow-forensics-day.workers.dev/en/transcript/01-greshnov · Slides: https://2025.moscow-forensics-day.workers.dev/en/slides/01-greshnov-dublikatory · Watch from 00:06:45: https://youtu.be/4V7Wez3L_58?t=405 --- ## In brief A catalog of the ELETEK line (a partner with a booth) rather than a comparison with manual copying: four duplicators (Element-U — acquisition from a PC without taking it apart, flash drives, SATA, a workstation), a RAW/E01 image viewer, "live" acquisition. There are no speed or accuracy figures, and the title is not borne out by the content. The value is in the new features of the releases and in the Q&A, where the limitations came out: it does not acquire RAM, encryption only sector-by-sector, it does not reassemble RAID, it does not know about TPM. The audience — law enforcement officers. ## Key points 1. ELETEK makes duplicators for fast and safe acquisition without changing the storage medium; part of the audience already has them in trial operation. 2. Element-U (the name is given only in the Q&A): acquisition from a PC without opening the case; the native OS is not booted, the unit's own OS is loaded through the Boot Manager, and all internal and USB drives are mounted. 3. New — acquisition by signatures, not only by masks (mp3, mp4): a swapped extension on a.docx does not prevent acquisition. "Parallel copying" — a choice of which drive to image first or as the only one. 4. The flash-drive duplicator — built at the request of field operatives to image flash drives discreetly during an operation: up to two hours on battery, an Android app, a sector-by-sector copy without a phone, LED indicators. 5. The SATA duplicator, "one of our newest": 2.5-inch HDDs/SSDs and 3.5-inch HDDs, "pass-through" copying, no internal memory to bring down the cost, a hardware write blocker. 6. The workstation: a 7-inch display, Mini ATX, Intel Core i3, 8 GB of RAM (up to 16–32), a 2 TB NVMe (up to 4 TB), a power bank; sector-by-sector, a disk-to-disk clone, containers, a choice of files. 7. From the exhibitions: a block of 64 kilobytes – 8 megabytes; the hash separately, during the process, or as a verification (previously only a "fixed verification"); hidden areas are checked automatically; only BitLocker is detected — and then only a sector-by-sector copy, the rest they are "currently working on". Reports (mode, disks, success, hash) and a "status drawer": evidence drives are read-only, trusted ones carry a volume label, and there is image deployment. 8. An image viewer for RAW and E01: recovery of deleted files, of partitions, "detect deleted operating systems"; E01 on Astra Linux — on request. "Live" acquisition software for a computer that is switched on: Windows, Linux, Astra Linux "in our plans". 9. Limitations from the Q&A: RAM is not acquired, encrypted disks only sector-by-sector and without viewing, RAID can be imaged but not reassembled, the speaker does not know about TPM, flash drives one at a time. ## Tools, artifacts, technologies - **ELETEK**: Element-U plus five unnamed products — the flash-drive duplicator, the SATA duplicator, the workstation, the image viewer, the "live" acquisition software. - **Astra Linux** (E01 on request, "live" acquisition in the plans), **BitLocker** (detection only), **TPM** (unknown), **RAID** (reassembly is up to the user), **Android** (control), **RAW/E01**, **Mini ATX, Intel Core i3, NVMe, SATA**; the hash algorithms are not named. ## Legal and organizational context No laws, no articles, no agencies, no methodologies; the Russian word for "forensic examination" is never spoken — what is said is "data acquisition", "evidence drives", "dumps", "field operatives". The procedural side is a property of the products: the storage medium stays unchanged, hashes, verification, reports. The products are built in response to officers' requests and to questions from the exhibitions; for details — come by the booth. ## Questions from the audience Ilya carried the microphone (he is named from the stage); there is no speaker labeling. 1. From the audience: RAID? → it can be imaged, reassembling the array is up to the user. 2. Yuri Mikhailovich: a RAM dump? → "we don't work with RAM yet", "on the verge of starting to work on that"; from the audience — "That's bad." An encrypted disk? → a sector-by-sector copy, no viewing of the data. Why a clone, if an image is better? → the basic mode is a copy to a file. 3. From the audience: Secure Boot and TPM? → there is a Secure Boot bypass, and as for TPM, "it's hard to say off the top of my head". 4. From the audience (front row): several USB drives at once? → the flash-drive duplicator acquires one storage device. ## The speaker's position An even, slide-by-slide presentation, with no polemics and no comparisons with competitors. The correct mode is a sector-by-sector copy to a file; the disk-to-disk clone is a concession to "a lot of officers". He acknowledges the limitations only under questioning. ## Quotes - "…fast and safe acquisition of data from digital storage media without making any changes to them." - "…as discreetly and quickly as possible, image any flash drive…" - "No, we don't work with RAM yet. That's bad. I mean, we're, so to speak, on the verge of starting to work on that…" ("That's bad" — from the audience) - "…a Secure Boot bypass in this software specifically. But as for the TPM module specifically, it's hard to say off the top of my head."