Moderator's introduction
And our first section is opened by Vladimir Greshnov of ELETEK, with a topic that, I actually think, is similar to those, you know, even slightly philosophical questions that the famous American writer Isaac Asimov asked back in the last century, because, well, now that machines have actually, let's say, grown into the Skynet we saw back in the day in Terminator 2, it's become a pressing topic, and yet, who'd have thought, even ordinary duplicators are starting to nip at our heels. I hope Vladimir will clarify for us how things stand right now and whether we should be worried. Let's give him a round of applause.
Vladimir, you're on. This one here's for the next page. Here, take the mic. I'll go up here, I guess? Go ahead.
Talk and Q&A
Hello, colleagues. So, as Dmitry said, my name is Vladimir. I represent the company ELETEK. Today I'm going to tell you about one of the areas we work in. That's the design and manufacture of duplicators, which help us in our work with fast and safe acquisition of data from digital storage media without making any changes to them.
On the first slide you can see the products that will be covered today. It won't just be the hardware solution; I'll also talk about our software solution.
Many of you know our products. Some have already had them in trial operation, but some are seeing them for the first time. So the first system I'd like to tell you about is a system designed for copying data from personal computers and laptops without having to take them apart in order to pull out the internal drive, and without having to boot the native operating system, so that no changes whatsoever are made to that drive.
It's quite simple to operate. You connect it to the computer. Through the Boot Manager, you boot the operating system that's stored on the unit.
Once it's booted, the program mounts all the drives that are either installed inside the computer itself, or connected, say, flash drives plugged into the USB ports, and then you can proceed to acquire that data.
Now the slide will show the software part of this system specifically, what it actually looks like from the user's side once the unit has booted up.
As for new features, the most recent ones that have been added. Previously, we could only do file-by-file copying by masks, that is, we set certain masks, which you can see on the screen now, say, audio, video, or, more specifically, mp3, mp4 and so on, and when it scans the drive's file system, it only extracts those files, but now, in the latest release, we've also added search and data extraction by signatures. So if, say, an attacker took a document with a.docx extension and either removed the extension altogether or changed it to, say, mp3, or to something else, then the signature search we've implemented will help determine that it's actually a text document, and it will extract it as well for further processing.
Also, among the new features of this system, a lot of people asked us to implement parallel copying of drives. Previously, we had it set up so that copying ran sequentially: first the first disk is imaged, then the second, the third, but now you can select a drive that's inside the unit, whichever one you're interested in, and, say, either image it first, or basically image only that one.
Right, let's move on to the next product. The next product is our most compact duplicator. It was originally built at the request of field operatives so that during an operation they could, as discreetly and quickly as possible, image any flash drive that's, say, lying around somewhere: an officer could walk up at a convenient moment, plug it into our device, and it would automatically make either a sector-by-sector copy or extract all the files on that flash drive.
This unit runs on battery for up to two hours, specifically in copying mode. All of its pre-configuration, and the ability to see what's currently happening on it, whether copying is in progress, how many and which dumps are stored in the unit, is done through a mobile app. It's implemented for phones running the Android operating system. On the slide now you can see exactly what the screens of the app for controlling this device look like. But in principle, this device can also be used without a mobile phone. By default, it's set to create sector-by-sector copies of flash drives.
And the device itself has LED indicators that tell you the device is ready, that copying is in progress, and that copying is complete.
The next product is probably one of our newest, one of the most recent. It's a simpler type of duplicator than the next product I'll be presenting. This duplicator is designed to copy data from SATA drives. That's 2.5-inch HDDs and SSDs, or 3.5-inch HDDs.
Copying here is pass-through. To bring down the cost of the unit, we don't put in internal memory, an internal drive. But if needed, if the customer wants it, internal storage can also be added as an option.
Here, unlike on our largest workstation, there's a hardware write blocker, which is exactly what lets us avoid making any changes to the evidence drives we connect. During operation, you can see the device's status, the copying progress, and whether it's ready to go, on a small display. Like the previous system, this duplicator is controlled via a mobile phone. That is, selecting the operating mode, and you can also check the device's status. But it's also standalone, that is, when you connect an evidence drive, copying starts automatically.
Here on the slide are the same control app screens you saw for the previous product.
Our next product is our largest duplicator. It's a full workstation with its own large 7-inch touchscreen for control. This system is built on a Mini ATX board with a full-fledged processor. In this particular version, the one in the photo, it's an Intel Core i3. It comes with 8 gigabytes of RAM installed. If needed, that can be expanded to 16 or 32.
For internal storage, there's a 2-terabyte NVMe drive, which can also be upgraded to 4 terabytes if needed, or, basically, whatever the NVMe drives themselves allow.
This unit, the reason we call it a full-fledged workstation, is that it can be used both in the field, for example, out on site, it can run off a power bank, and also in a lab setting. In terms of operation, it lets you copy from external drives in sector-by-sector mode, in cloning mode, that is, a full disk-to-disk copy, in file container mode, and you can also pick, through the file manager, specific files you're interested in, and it will extract only those.
Of the new things we've done: I think at the last exhibition, or the one before, we were asked about the size of the block it uses for sector-by-sector copying. Here we've given the user a choice: you can select a block size from a minimum of 64 kilobytes up to a maximum of 8 megabytes.
We've also reworked the hash calculation feature a bit, made it more, so to speak, complete. Previously we only did a fixed verification, but now, accordingly, if the user needs it, we can either calculate hashes separately, or calculate hashes directly during the copying, the duplication of the evidence drive, or also run a verification afterwards.
We've automated some functions that were previously available only to a user who was, so to speak, trained, who knows that he needs to, say, check a disk for hidden areas. Now all of that happens automatically. When a copy job is added, the unit warns the user that hidden areas are present. To disable them, the user has to go into the settings. And we've also added a user notification about disk encryption. For now, we've implemented a BitLocker notification specifically: if a disk is BitLocker-encrypted, you can only take a sector-by-sector copy of it, but we're also currently working on other types of encryption.
On this slide you can now see what the visual part of the system's software and its controls look like.
For convenience in working with the unit, and later on with the copied images, we've also implemented a report generation feature, where the user of this device can look and, so to speak, refresh their memory as to what mode the copy was made in, from which disk to which, whether everything completed successfully, what the hash is, if hashing was enabled, and so on, everything about the unit's operation.
Here on the slide you can see a status drawer that shows the mode in which these drives are connected. As I said earlier, evidence drives connected to the unit are connected in read-only mode, which is indicated by the closed padlock in the status drawer. If needed, you can also use your own trusted drives, to which data will be written, or exported from the internal storage.
For them to show up, we've implemented a special volume label, when it's set, the unit understands that this is a drive it's allowed to write to, and it doesn't block it for writing.
Various disk operations are implemented here, such as restoring a previously created image to a drive, or rather, deploying it, if the user needs that.
Let's move on to the next one. Here, as I said at the beginning, it's not only our hardware solutions that are presented. This slide shows our software solution. It's a software package built for viewing images in various formats, such as RAW, our most standard format, and E01. With the ability to recover deleted files, view deleted partitions, and detect deleted operating systems.
In the latest releases of this product, our main focus has been on Astra Linux, so that it can be used on that operating system. And most importantly, we had a request for viewing the E01 format on Astra Linux. That's now been implemented as well.
This slide shows the visual side of the program. Basically, all the systems, all the programs you're seeing in my talk today, you can come by our booth and we'll show you how they work in more detail, or tell you more about each of them.
And our last product for today is also a software product. In how it works, it's similar to our very first product, which is designed for extracting data from personal computers, but with one key, main difference: it works on a live system. So, if needed, you have a computer that's switched on. With this software package you can go through the computer's entire file system either in mask mode or in signature mode, and extract only those files, only the information that you actually need. This package also runs on Windows and Linux systems.
For Astra Linux, that's still in our plans, but it's coming too.
Here's what the control panel of this package actually looks like.
But again, as I said earlier, you can come by the booth and we'll show and tell you more. That basically wraps up my talk. Your questions, please. So, colleagues, let's do it by a show of hands. Ilya, I'll come over to you. —
— Good afternoon. You didn't mention, what about RAID? —
— Look, as far as RAID goes. You can image RAID as well using our first system, which is called Element-U. But after that, it's up to you how to reassemble those RAIDs. So the whole problem will be in the subsequent reassembly. Yuri Mikhailovich, go ahead. Good afternoon. So, about the first unit, the one that connects directly to a computer. Have you done anything about RAM dumps? No, we don't work with RAM yet. That's bad. I mean, we're, so to speak, on the verge of starting to work on that, but the main focus was on working with file systems. RAM is something we do want to add.
Next, one more quick one. So, that is, drives that are under BitLocker or something else. Will you do anything about those? Say that again? Encrypted, encrypted. What do you do with a clone of the drive? I see what you mean. Look, as far as encrypted drives go, you can make a sector-by-sector copy of any encrypted drive. But actually viewing the data with our devices — that won't work here. And one very last question. Why make a clone at all, if an image is better? —
— By clone you mean disk-to-disk? Yes, yes, yes — an image, I mean. First of all, we can compute a hash. Here, hashing is pointless for you. And then do whatever you want with it. Have you implemented imaging at all? Look, actually our main mode, the one we started the development of every unit from, is a sector-by-sector copy to a file. We added cloning here just as an extra, because a lot of officers asked to be able to make a copy and immediately examine the information that's on the drive. Here it's more of an add-on. —
— Colleagues. Ilya, hand over the mic on that side, please.
I'd like to clarify something about the Element-U. Could you bring the mic a bit closer? About the Element-U. You said we connect it automatically and make a dump. A bootable operating system is loaded. What if Secure Boot is enabled and a TPM module is in use? I mean, does it boot, does the system get dumped? Look, we do have a Secure Boot bypass in this software specifically. But as for the TPM module specifically, it's hard to say off the top of my head. You can come by our booth. We have the engineer there, the actual developer. So you'll be able to discuss it with him directly. Colleagues, are there any more questions? Ilya, over there, in the front row. Thank you very much. Hello, tell me, if, as you said, for operatives, several USB drives onto internal storage, is it possible to save them all at once as images? Well, look, as for — I take it you mean the device that acquires from flash drives. Yes, yes.
It's designed to acquire only one storage device at a time. Thank you. —
— Right, colleagues, any more questions? No more questions, then — I see no hands. Vladimir, thank you very much. You can leave the clicker and the mic right on the lectern. Let's see Vladimir off with a round of applause. That was great. So we do still have a chance after all.