Home

ZClone® Xi User`s Manual

1. FIRMWARE UPDATE COULD TAKE UP TO A FEW MINUTES TO COMPLETE PLEASE DO NOT INTERRUPT POWER DURING THIS TIME ON COMPLETION THE UNIT WILL AUTO RESTART AND CONFIRM THE UPDATE Tap the OK icon to start the firmware update process When the OK icon is tapped the screen may appear to do nothing Do not keep tapping the OK icon The firmware update will take no more than 60 seconds When the firmware update finishes the Falcon will reboot automatically b FIRMWARE UPGRADE NOT AVAILABLE This message will appear if the device does not require a firmware update No further action is necessary if this message appears Logicube Forensic ZXi User s Manual 60 7 Remote Operation 7 0 Introduction The ZXi comes with two gigabit network connections in the back of the unit Connecting the ZXi to a network allows remote access to the ZXi from any computer within the same network The ZXi is configured for DHCP by default See Section 7 5 for instructions on how to configure the ZXi with a Static IP address The ZXi is setup with a Zero Configuration Network Zeroconf There are two ways to access the ZX e Web interface A graphical interface using an Internet browser where the screens are shown exactly the way they appear on the ZXi e Command Line Interface CLI A text only command line interface that can be accessed one of two ways i Telnet via a network connection ii SSH Secure Shell via a network
2. Logicube ZClone Xi User s Manual 2 iTcube INTRODUCTION e Remote operation ZXi allows you to control all operations from a remote computer using a web browser or CLI interface e Task Macro Allows users to set specific tasks to be performed sequentially For example wipe then clone then hash e Advanced administrative functions allow administrator to create manage image repositories manage network settings create user profiles save configurations manage drive station assignments e Audit trail log report Provides detailed information on each completed task Logs can be printed using a web browser and your PC Includes a digital signature for authentication purposes Optional light stack amp audible beeper alerts user when tasks complete or when attention required HPA DCO support Clone or wipe HPA DCO areas of a drive 1 2 Inthe Box The complete ZXi system includes the following e The Logicube ZXi unit e Power cable e 6 SAS SATA 5 cables e CD ROM with user s manual A WARNINGS A e Avoid dropping the Logicube ZXi or subjecting it to sharp jolts When in use place it on a flat surface Keep the unit dry If the ZXi needs to be cleaned use a lightly damp lint free cloth Avoid using soap or other cleaning agents particularly those containing bleach ammonia alcohol or other harsh chemicals Do not attempt to service or open the Logicube ZXi Doing so may void the warranty If the unit requires service pl
3. S MANUAL sica LIMITATION OF LIABILITY AND WARRANTY INFORMATION ccccsccsceccsccscesccscscesces LOGICUBE DISCLAIMER Saeta sotano ben WARRANT arta ita ROHS CERTIFICATE OF COMPLIANCE si nseresudavacseusonderstineessievoasnnsnsiiuwsdedsnbonnoUuteassieveedeeyeiaiwededoeretenoaeuentes III LOGICUBE TECHNICAL SUPPORT CONTACT INFORMATION sssssssessessssessrsrosesresessreresesrrsresesresesreereseereeee III TABLE OFCONTEN ES sra E AEE OEE E O E IN ROC NON caras ie 1 1 0 INTRODUCTION TO THE LOGICUBE ZCLONE Xl sccssccssccsccssccsccseccscceceeccseceseeeeceeesseceeceseeeseseeeeeeeaes 1 A E E AE E 1 12 INE Diet 3 Ze GETTING STARTED costat is rr rice 5 2 O OVERVIEW OF THE ZAI ba 5 2 14 TURNING THE ZXVON AND Ocio 6 2 2 CONNECTING VARIOUS DRIVE TYPE Susini nia 7 2 TIE USER INTERFACE iia 8 24 OUEN SCREEN ba 8 Ao A E o A 9 2 6 USB FLASH DRIVE LOCATED IN THE BACK OF THE ZXl ooooccccccononcccnnnononoconnnonanocnnnnnnnaccnnnononacnnnnnnnns 9 3 UIC STA siii EE E 10 30 OUL SIART IDE rincon tii toiciind 10 SL DRIVES aan 10 A 10 5 251 Step by step Instructions CINE simil eee 11 A PP e ue A 12 3 3 1 Step by step instructions Has inusitado 13 Se E S 14 3 4 1 Step by step instructions Wip eessessrssesssrerereressrrerereressrrerereressrrerereressrrerereressrreres 14 Su TA MARO Soros 16 3 5 1 Step by step instructions Task MACOS ccscccccsseccecessececeesececeeeceeceesceeeeesecetsueeees 16 e II
4. ip_or_hostname sharename If you are connecting to a CIFS share use IP_or_hostname sharename for the path NETWORK SETTINGS Tap Role and input the role for this repository Tap OK when finished ROLE BOTH Logicube Forensic ZXi User s Manual 48 TYPES OF OPERATIONS To delete a repository tap the delete icon A confirmation screen will appear Tap Yes to permanently delete the repository from the list In order for a repository to remain configured when the ZXi is turned off the changes must be saved and loaded to a configuration file Details on configuration files can be found in Section 5 0 9 1 5 0 8 2 iSCSI This screen allows a user to add a repository using the iSCSI protocol To add a repository using the iSCSI protocol an iSCSI Target must be setup on the remote system Since networks are configured differently a Systems Administrator or Network Administrator may be needed to set up the iSCSI protocol Once the iSCSI Target has been setup click Settings NETWORK SETTINGS Input the iSCSI target portal username and password Tap the OK icon when finished Tap Role and input the role for the iSCSI server then tap OK 5 0 9 System Settings The System Settings screen allows users to configure four different settings for the ZXi Logicube Forensic ZXi User s Manual 49 TYPES OF OPERATIONS e User Profiles Configurations e Passwords e Language Time Zone e Bay Roles
5. 17 Manage Repositories Network 46 Mirror Settings 28 Mode Logicube Forensic ZXi User s Manual 10 Index Imaging Mode 22 network connection 61 Overview 5 Quick Start 10 Remote Operation 61 66 Remote operation CLI 62 Remote Operation Web Interface 61 RoHS Directive 2002 95 EC III S M A R T Self Monitoring Analysis and Reporting Technology 46 Screen Touch 8 Secure Erase 14 Settings 24 Software Update 56 Software Updates 57 Source 23 Statistics 46 System Settings 49 Task Macro 44 Task Macros 16 Technical Support Logicube Ill 70 Telnet 62 Time Zone 54 Touch Screen 8 Types of Operation 35 User interface UI 8 User Profiles Configurations 50 Warranty Parts and Labor Ill Website Logicube III Windows Vista 62 Windows XP 62 Wipe 14 39 41 42 Wipe Patterns 41 43 ZXi 1 69 Technical Support Information For further assistance please contact Logicube Technical Support at 001 818 700 8488 7am 5pm PST M F excluding US legal holidays or by email to techsupport logicube com Software Attribution Ubuntu 12 04 LTS http www ubuntu com Linux Kernel 3 2 37 GPL v2 http www kernel org modified libcli 1 9 5 LGPL v2 1 https github com dparrish libcli modified monitorix 3 2 1 GPL v2 http www monitorix org modified Electrostatic Discharge ESD WARNING All electronic products may be susceptible
6. 5 0 9 1 User Profiles Configurations This screen shows all user profiles configurations for the ZXi There are three options in this screen e New Allows the user to create a new profile configuration name e Save Saves the selected profile configuration e Load Loads the selected profile configuration USER PROFILES CONFIGURATIONS USER PROFILES CONFIGURATIONS DELETE The ZXi will boot with the profile configuration that has an asterisk next to the name Profiles configurations allow users to create different profiles or configurations The profile configuration can then be saved When a profile configuration is loaded using the Load icon the ZXi will load that configuration immediately and will also load that configuration during the boot process For example if the user wants the ZXi to always boot up with the default Clone mode of Image to Drive 1 Turn the ZXi off then back on This will reset all settings to its default configuration This is an important step to help ensure only the changes desired will be the changes saved 2 Gotothe Clone screen and set the Mode to Image to Drive 3 Inthe System Settings go to User Profiles Configurations and tap the New icon Logicube Forensic ZXi User s Manual 50 TYPES OF OPERATIONS 4 Type a name for this profile For example ImageToDrive and tap the OK icon The profile name should appear on the screen 5 Tapthe newly saved profile
7. The Hash Verification feature is an option To verify if this option has been enabled on your ZXi tap on the Statistics icon from the navigation menu and select the Options tab To purchase this option contact the Logicube Sales Department at sales logicube com Logicube Forensic ZXi User s Manual 12 iTcube QUICK START 3 3 1 Step by step instructions Hash ADD NEW TASK AAA SETTINGS JOB INFO 1 n from the types of operation on the left side 2 Tap Rives and select the drive to be hashed or multiple drives to be verified then tap the KI icon 3 Tap the TS icon to select the hash method or algorithm Choose from SHA 1 SHA 256 or MD5 SHA 1 or SHA 256 are the recommended algorithms 4 Leave the expected value at zeroes to hash the drive If the drive needs to be verified against a known expected hash change the expected value by tapping the edit icon Tap the OK icon to continue 5 Change any of the optional settings LBA settings or percentage of the drive to be hashed if needed 6 Optional Tap Job Info to set the Job Name Job ID Operator ID Other ID or Job Notes The ZXi will convert any non POSIX portable characters used in Job Name field to underscores _ when creating the log or file names POSIX portable characters are Upperjob A to Z Period Lowerjob a to z Underscore _ Numbers 0 to 9 Hyphen Dash 7 Tap the MU icon to start the hash task 8
8. as seen below 5 0 9 3 Language Time Zone The ZXi menu system s language can be changed This screen also allows the time zone to be set 5 0 9 3 1 Language Select a language As soon as the selection is made the ZXi s screen or the computer s Logicube Forensic ZXi User s Manual 54 TYPES OF OPERATIONS Internet browser will automatically refresh and display the selected language The Custom button is reserved for future language releases 5 0 9 3 2 Time Zone The ZXi utilizes NTP Network Time Protocol Each time the ZXi is connected to a network with internet access it will automatically check for the correct time using NTP and adjust the time as needed The ZXi also has a time zone setting Tap Time Zone to select the time zone region Tap the OK icon to continue After selecting the region select the time zone where the ZXi is located Tap the OK icon to set the time zone 5 0 9 4 Bay Roles Each of the drive bays on the ZXi can be configured as a Master Target or both Master Target Tap a drive bay then tap the Edit Role icon to assign the specific drive bay BAY ROLES BAY ROLES DRIVE BAY ASSIGNED ROLE EDIT ROLE gt 5 0 10 IP Settings In order for the ZXi to be able to update software from a network over the internet a proxy settings may need to be set Networks that have a proxy server for internet access will IP SETTINGS Logicube Forensic ZXi User s Manual
9. this will show the repository screen which contains the different images located on the ZXi s repository drive If a drive has been selected for a previous task it will show as unavailable for other additional tasks 4 0 4 1 Selecting Target drives or images If DRIVE TO DRIVE or IMAGE TO DRIVE was chosen as the mode the following screen will appear This will allow you to select one or more Targets It will display all available drives that are connected If a drive has been selected for a different task it will be greyed out and cannot be selected SELECT TARGETS DRIVE BAY DRIVE INFORMATION DRIVE STATUS MORE y You can also tap the MORE INFO icon to see more information on the drive The drive details window will appear showing information about the drive such as the which bay it is connected to the model size cylinders heads sectors etc DRIVE DETAILS Logicube Forensic ZXi User s Manual 32 IMAGING If DRIVE TO IMAGE was chosen as the mode the following screen will appear This will allow you to select a repository which contains previously cloned images to the repository The example below shows the following e An unformatted drive on T1 that can be formatted to be used as a repository to store images the ZXi can format a drive using NTFS or EXT4 for repository purposes e A formatted drive on T2 that can be used as a repository e Anetwork shared location
10. IS NO LONGER SUPPORTED BY LOGICUBE THE PRODUCT MAY BE REPLACED WITH AN EQUIVALENT OR SUCCESSOR PRODUCT AT LOGICUBE S DISCRETION THIS WARRANTY EXTENDS ONLY TO THE END PURCHASER OF LOGICUBE PRODUCTS THIS WARRANTY DOES NOT APPLY TO AND IS NOT FOR THE BENEFIT OF RESELLERS OR DISTRIBUTORS OF LOGICUBE PRODUCTS UNLESS OTHERWISE AGREED IN WRITING BY LOGICUBE NO WARRANTY IS PROVIDED TO RESELLERS OR DISTRIBUTORS OF LOGICUBE PRODUCTS IN ORDER TO RECEIVE WARRANTY SERVICES CONTACT LOGICUBE S TECHNICAL SUPPORT DEPARTMENT VIA PHONE OR E MAIL PRODUCTS RETURNED TO LOGICUBE FOR REPAIR UNDER WARRANTY MUST REFERENCE A LOGICUBE RETURN MATERIAL AUTHORIZATION NUMBER RMA ANY PRODUCT RECEIVED BY LOGICUBE WITHOUT AN RMA WILL BE REFUSED AND RETURNED TO PURCHASER THE PURCHASER MUST CONTACT LOGICUBE S TECHNICAL SUPPORT DEPARTMENT VIA E MAIL SUPPORT LOGICUBE COM OR VIA PHONE AT 1 818 700 8488 OPT 3 TO OBTAIN A VALID RMA THE PURCHASER MAY BE REQUIRED TO PERFORM CERTAIN DIAGNOSTIC TESTS ON A PRODUCT PRIOR TO LOGICUBE ISSUING AN RMA THE PURCHASER MUST PROVIDE THE PRODUCT MODEL SERIAL NUMBER PURCHASER NAME AND ADDRESS EMAIL ADDRESS AND A DESCRIPTION OF THE PROBLEM WITH AS MUCH DETAIL AS POSSIBLE AT LOGICUBE S SOLE AND ABSOLUTE DISCRETION REASONABLE TELEPHONE AND EMAIL SUPPORT MAY ALSO BE AVAILABLE FOR THE LIFE OF THE PRODUCT AS DEFINED BY LOGICUBE EXCEPT AS OTHERWISE SPECIFICALLY PROVIDED IN THIS AGREEMENT LOGICUBE PRODUCTS ARE PROVIDED AS IS AN
11. O A 17 3 6 1 Step by step instructions Viewing or exporting lOgS ccccoocccnconoconnnnaconnonanonnnnnnoss 17 O o e e O ee eee ener 18 3 6 3 Accessing the logs Over a NetwoFk oooccccconcccnccnccnnnnnnconnnnannnnonanonnnonaronnnnacnnnonanonnnnonoss 18 3A ITESO 20 Logicube ZClone Xi User Manual 3 59 MANAGE REPOSITOR EStdt dd tddi 20 Sd OS TEME TING cda 20 3 10 1PSETTNES PROXY SETTINGS sido da 21 SOFWARE UPDATES donald 21 312 FOWE O addon S 21 A CLONING asii oa 22 O C CON E ak weeds a otis A A 22 EOL Moderar N A OA 22 40 2 Master Image PIG aia a A A A 23 DOS DEN Sada 24 OL Job Info COMMON SEUA A eee 24 40 32 HPAJDCO COMMON SCLIN A A ii a 25 4 0 3 3 Error Handling Common Setting ooccccccccooocccnnnononocononononacononanonocononononacononos 26 4 0 3 4 Hash Verification Method Common Setting csscccccccccccccccccccssseesecseseeeeeessssses 27 OSO EOS An 28 40 331 Special Settings Tor Dive to DIVO tl A AE a il aa 28 4 1 3 5 2 Clever Clone Partition Resize Settings or Mirror Clone Advanced Settings cccsssseeeeeeeeees 29 4 0 3 5 2 Clone Drives Prom a RATO Array ces ccd cesses A a dci 31 40A TOGO IPC nn E E O A AAE A A O 32 A041 Selectino Tarserdriyes or Malestar a a li a N 32 A1 STARTING THE IMAGING OPERATION errar 34 5 TYPES OF OPERATIONS vcni da 35 PO TYPES OF OPERATIONS arrin Ee EEE E E E 35 SOT DIVES nnana a a a aN 36 SOZ a A 37 O ian i ek neki 37 50 3 1 DIVES A
12. When finished the status will show COMPLETED At this point it is recommended to click Reset Task to reset the task and also to delete the task in order for the drive bays to be properly reset and not show as being used or assigned for other tasks to be configured Logicube Forensic ZXi User s Manual 13 iTcube QUICK START 3 4 Wipe Drives connected to bays that are configured as Target or both Master and Target can be wiped using the ZXi When a drive is wiped there will be no file system on the Destination drive The following methods are available in the Wipe menu e Secure Erase Sends a command to the drive instructing it to wipe the drive based on the hard drive manufacturer s specifications for the Secure Erase command Contact the hard drive manufacturer for Secure Erase specifications for each model type of hard drive e Wipe Patterns Allows the user to set a specific pattern to use for wiping the drive The number of passes is customizable up to 7 passes along with the type of data written for each pass In addition a 7 pass DoD wipe can be set with pre selected pass values e Format Allows the user to format a drive to prepare it to be used as a repository for images Drive to Image operations The drive can be formatted with the NT File System NTFS or EXT4 file system The ZXi can perform one two or all three methods on the same drive using the same task The ZXi will perform each met
13. XXXXXX is the serial number of the ZXi On some Operating Systems the ZXi will need to be O accessed by opening ZXi XXXXXX local 5 Login with the username it without the quotes and the password it without the quotes 6 The ZXi can now be configured or managed via the command line interface 7 4 Zero Configuration Networking Zeroconf The ZXi has the capabilities for Zero Configuration Networking Zeroconf Zeroconf allows devices to automatically create a usable computer network based on the Internet Protocol Suite TCP IP For example when the ZXi is connected connected via a network cable directly to a Windows based computer that is DHCP enabled both the ZXi and the Windows based computer will automatically configure themselves to be seen by each other using TCP IP Logicube Forensic ZXi User s Manual 63 MiTcube REMOTE OPERATION 7 5 Configuring the ZXi with a static IP address The ZXi is DHCP enabled by default Some networks do not support DHCP and require a static IP address The ZXi can be configured with a static IP address and needs to be connected to a network with DHCP first 7 5 1 Step by step instructions Static IP address Connect the ZXi to a network with DHCP Turn the ZXi on The ZXi should automatically assign itself an IP address that the Windows computer can see Go to the Statistics screen on the ZXi and take a look at the HostName and IPAddress 3 Using Tel
14. a remote connection Navigate to the Power Off screen and tap or click the Power Off icon It is not recommended to use the power switch to turn the ZXi off Using the Power Off icon in the GUI gracefully shuts down the ZXi s Operating System Logicube Forensic ZXi User s Manual 6 GETTING STARTED ube 2 2 Connecting various drive types The ZXi comes standard with six SAS SATA cables One end of the cable has a male connector that connects to the ZXi On the other end is a female connector that connects to a drive or Logicube adapter Support for SAS drives is optional To verify if you have this feature installed press the Statistics icon from the left hand navigation menu and select the Options tab If you need to purchase the SAS option contact our sales team at sales logicube com Cables and adapters are available for the following drive types e SAS e SATA e USB e 1 8 microSATA optional e 2 5 and 3 5 PATA IDE optional e 1 8 ZIF optional e 1 8 PATA IDE optional e eSATA optional e mSATA optional e Flash Media optional The ZXi ports are hot swappable Drives that are not being used in any task clone hash wipe etc can be disconnected any time Some drives are not hot swappable Please check with the drive manufacturer to find out if the drive being used does not support hot swapping When disconnecting drives it is very important to make sure the drives
15. a value for the 7 pass or an error will appear and the ZXi will not proceed with the wipe operation Values can be changed or added by tapping the edit icon Logicube Forensic ZXi User s Manual 42 TYPES OF OPERATIONS e f Custom was selected no passes will be filled out It is mandatory that the user set the value for at least one pass or the wipe operation will fail The pass value can be set by tapping the edit icon There is no default value entered for any passes It is mandatory that the user select a value for at least the first pass or an error will appear and the ZXi will not proceed with the wipe operation Values can be changed or added by tapping the edit icon Editing one or more of the passes in DOD or CUSTOM mode will bring up some options e SKIP Instructs the ZXi to skip the pass e RANDOM Instructs the ZXi to perform a random pattern or value e VALUE Instructs the ZXi to use the specified hex value to be written for the pass The values can range anywhere from 00 to FF 5 0 4 2 3 Format FORMAT Allows the user to format a drive to prepare it to be used as a repository for images Drive to Image operations The drive can be formatted with the NT File System NTFS or EXT4 file system FORMAT SETTINGS Format Settings File System Logicube Forensic ZXi User s Manual 43 TYPES OF OPERATIONS 5 0 4 3 Job Info Job Info allows users to enter informatio
16. auditlog 3 Libraries J Share 4 The auditlog folder contains the HTML PDF and XML files for each of the log files There will be two folders html and pdf that contain either the HTML or PDF versions of the log files The XML files can be used with any XML viewer which allows for some customization on how the information can be viewed Logicube Forensic ZXi User s Manual 19 iTcube QUICK START OU 2 gt Network zxi 10270 auditlog gt Organize New folder w Pasties Name Date modified pe Size L html 4 Libraries Le pdf Computer cl Network 3 7 Statistics This will display four tabs About Adv Drive Statistics Options and I O Ports LGVY INE The About screen will show information about the ZXi including the current software installed J Xt STATISTICS The Adv Drive Statistics tab displays S M A R T information taken directly from what the drives are reporting The I O Ports tab shows a diagram of the input and output ports located in the back of the ZXi The Options tab shows which options have been installed on your ZXi For more information on the Statistics screen see Section 5 0 7 of this manual 3 8 Manage Repositories Repositories can be added to the ZXi in this operation When Manage Repositories is selected a list of repositories will be shown The user has the option of adding or deleting a repository MANAGE REPOSITORIES For more information on how to manage re
17. connection BROWSER COMPATIBILITY Google Chrome and Mozilla Firefox are recommended Other browsers may not compatible 7 1 Web Interface Using a web browser go to the IP address or the name of the ZXi with its serial number Both IP address and serial number can be found by going to the Statistics screen on the ZXi For example browse to http 192 168 1 100 or http 2Xi XXXXXX where XXXXX is the 6 digit serial number of the ZXi The ZXi s web interface will appear on the browser screen All screens and operations available on the ZXi will be available on the browser On some browsers or Operating Systems the ZXi will need to be accessed by browsing to http ZXi XXXXXX local The ZXi can be controlled by clicking on the icons appearing on the browser window Logicube ZClone Xi User s Manual 61 REMOTE OPERATION iube 7 2 Command Line Interface CLI The ZXi also has a CLI or Command Line Interface This interface has no graphical content and is all command line text based and is for advanced users who have knowledge of command line functions This type of connection requires a Telnet or SSH client There are several telnet and SSH clients available from different software companies Microsoft Windows also has a built in Telnet client that can be used Windows XP has a built in Telnet client Windows Vista 7 8 and 8 1 have a built in Telnet client but is not installed by default Installing the Telne
18. method is SHA 1 or SHA 256 HASH VALUES By default this value will have Os zeros If this is not changed or no value is entered this will instruct the ZXi to hash the drive using the selected algorithm in the previous step If a value is entered the ZXi will hash the selected drive and verify hash with the value entered edited Logicube Forensic ZXi User s Manual 38 TYPES OF OPERATIONS To set the expected value tap the edit icon The on screen keyboard will appear and the expected hash value can be set IBA The LBA icon will bring up the LBA settings screen On this screen the user can adjust the percentage or the number of blocks of the drive to hash and also where to start the hash By default the length is set to 100 whole drive and the starting percentage is set to 0 start of the drive When the ZXi finishes hashing the drive the COMPLETED screen will appear showing the task completed Tap the Info icon on the left of the completed screen to see both the expected hash value and the computed hash value 5 0 3 3 Job Info Job Info allows users to enter information about the job This is optional and is not required to start an operation Information entered here will appear in the logs More information on the Job Info screen can be found in Section 4 0 3 1 5 0 4 Wipe This type of operation allows the user to erase and or wipe one or more Destination drives There are three main setting
19. mode to Drive to Drive or File to File but can start the Drive to Image task Tap Password or Key to enter a log file deletion password or a config lock key The following screen will appear Tap the Enable icon to enter a password or key The available characters are O through 9 and A through F Logicube Forensic ZXi User s Manual 51 Logicube Forensic ZXi User s Manual TYPES OF OPERATIONS 5 0 9 2 1 Additional information for Config Lock Tap the Auto Lock icon to set the time to automatically lock the configuration and require a password By default this is set to 1 minute A shortcut and indicator to the config lock can always be seen on the ZXi s screen It is located on the top right of the screen next to the ZXi logo While in a locked state the following operations will be affected as follows e Clone A Clone task can be started but no settings can be changed Additionally no new task can be added and no task can be deleted without the unlock key e Hash A hash task can be started but no settings can be changed Additionally no new task can be added and no task can be deleted without the unlock key e Wipe A wipe task can be started but no settings can be changed Additionally no new task can be added and no task can be deleted without the unlock key e Task Macro A task macro can be started but no settings can be changed Additionally no new macro can be set or edit
20. operations and their screens can be found in this section yee 08 8 Xi ADD NEW TASK AAA MASTER SETTINGS TARGET 1 DRIVES This screen shows the status of all drive bays Each drive bay will be listed whether or not there is a drive connected 2 CLONE The ZXi has three modes of operation to clone virtually any drive Hard Disk Drives or Solid State Drives Drives can be cloned using Mirror bit for bit copy or Clever copies only data areas skips blank sectors and partitions can be resized a Drive to Drive Clones a drive to one or more Target drives b Image to Drive Restores an image created by the ZXi to one or more Target drives c Drive to Image Creates a Logicube ZXi image file to a Destination or Repository This image file can be restored to drives using the Image to Drive mode Details on the different screens found in the Imaging operation can be found in Chapter 4 Cloning Logicube ZClone Xi User s Manual 35 TYPES OF OPERATIONS Tube 3 HASH Perform a SHA1 SHA 256 or MD5 hash of a drive This can also verify the hash of the drive by entering an expected value for the hash Hash Verification is an optional feature Contact Logicube sales if you do not have this option enabled 4 WIPE This type of operation is used to erase and or wipe There are two main settings e Secure Erase Sends a command to the drive instructing it to perform a secure erase based on
21. the screen e Add Remove using the SMB Server Message Block or CIFS Common Internet File System protocol e iSCSI Internet Small Computer System Interface protocol Networks are configured differently and may require the assistance of a Network or Systems Administrator to ensure proper configuration for sharing 5 0 8 1 Add Remove A list of repositories will be shown The user has the option of adding or deleting a repository This will include all drives Logicube Forensic ZXi User s Manual 46 TYPES OF OPERATIONS attached to the ZXi and any networked repository ADD REMOVE REPOSITORIES FILE FREE EDIT DEA NAME DON SYSTEM f SPACE f FILES fO ETE MAA If a repository location shows NOT MOUNTED it is because the drive attached is not formatted by the ZXi or the ZXi cannot connect to the shared network resource Tap Add Repository to add a repository The Add Repository window will appear ADD REPOSITORY NETWORK SETTINGS Tap Name to set the name of the repository Tap the OK icon when finished REPOSITORY NAME Logicube Forensic ZXi User s Manual 47 TYPES OF OPERATIONS Tap Drive to select a drive or network share to set as a repository Tap the OK icon when finished SELECT DRIVE NETWORK SHARE Tap Network Settings to enter the network settings See the example below Tap the OK icon when finished If you are connecting to a Samba share use the syntax SMB
22. top of the screen 3 Select From Network The ZXi will check for a newer version on the web If one is found it will display the version on the screen and the Update icon will be selectable Logicube ZClone Xi User s Manual 97 UPDATING ZXI SOFTWARE 4 Tap the Update icon to begin the update A confirmation screen will appear Tap Yes to continue the update 5 Do not interrupt the update process It may take several minutes Once completed a Successful screen will appear Reboot the ZXi by turning the unit off then back Verify the software version at the top of the Software Updates screen When finished go to Section 6 2 Firmware Loading Instructions 6 1 2 From USB Drive Via software download The latest software can also be downloaded from Logicube s website and be placed onto a USB flash drive It is recommended to use an empty USB flash drive Download the latest software from the ZXi product support page at http www logicube com knowledge zclonexi Download the zip file from the download page Extract the contents of the downloaded zip file to the root of the USB flash drive the file must not be in any folder Do not connect the USB flash drive yet The ZXi will display a message when to connect the USB drive If the computer being used to extract the contents of the downloaded zip file has the software WinZip or other third party zip software please review Section 6 1 2
23. up to nine 9 operations Set up to 9 operations by tapping on each operation in order Operation 1 Operation 2 etc When all the operations have been set tap the OK icon Tap the Start icon to execute the macro and perform all the operations within that macro When finished the status will show COMPLETED At this point it is recommended to click Reset Task to reset the task and also to delete the task in order for the drive bays to be properly reset and not show as being used or assigned for other tasks to be configured Logicube Forensic ZXi User s Manual 16 iTcube QUICK START 3 6 Logs The ZXi keeps logs of all clone hash and wipe operations Logs can be viewed directly on the ZXi or from a computer s browser if the ZXi is connected to a network In addition to viewing the logs can be exported to an external USB location such as a USB flash drive Logs are exported in PDF HTML and XML format 3 6 1 Step by step instructions Viewing or exporting logs LOG FILES LOGS LOG FILE NAME DATE CREATED 1 Select Logs from the types of operation on the left side A list of log files will appear sorted by date newest on top 2 Select the log file to view by tapping the name of the log file This will highlight the log file chosen 3 Tap the View icon to view the log file on screen The log files can also be exported to a USB drive To export the log files a Connect a USB drive USB flash
24. 1 before proceeding 3 From the main screen tap the Software Updates icon 4 Select From USB Drive The ZXi will prompt for the USB drive to be connected to USB_1 the front USB port 5 Connect the USB drive to USB_1 ZXi will then check for the version of the software on the USB drive and will display that version on the box next to the selected location 6 Tap the Update icon to begin the update A confirmation screen will appear Tap Yes to continue the update Do not interrupt the update process It may take several minutes Once completed a Successful screen will appear 7 Reboot the ZXi by turning the unit off then back on using the Power button in front of the unit Logicube Forensic ZXi User s Manual 58 UPDATING ZXI SOFTWARE Tube 8 Verify the software version at the top of the Software Updates screen When finished go to Section 6 2 Firmware Loading Instructions 6 1 2 1 Extracting the software download on a computer with WinZip or other third party zip software WinZip and other third party zip software may improperly extract the files required for the software update There are compressed files within the download that need to stay compressed If the computer being used to extract the software download has WinZip or other third party zip software it is highly recommended to use the built in utility in Windows If the downloaded zip file is highlighted and WinZip is installed there w
25. 256 or MDS allows the user to clone and verify the exact replication of the source drive Available with the purchase of an optional software activation package e Write protected source drives ZXi drive stations or USB ports that are designated as a source master by the user are automatically write blocked to prevent any alteration to sensitive data on the source drive e Removable drive stations are field replaceable e Wipe feature Sanitizes hard drives to DoD 7 pass specification offers Secure Erase and custom pass settings e Compact footprint of 3 7 X19 X17 2 takes up minimal real estate on the work bench The ZXi weighs approximately 24lbs e Color touch screen display provides an intuitive and easy to use interface Bad sector handling Scan for bad sectors on the source drive abort or skip and log for review e Supports large capacity drives gt 2TB e Multiple cloning modes Mirror Copy bit for bit copy Supports all OS including Linux and MAC CleverCopy copies only data areas skips blank sectors scales partitions to target Supports FAT16 FAT32 NTFS and Linux ext ext2 ext3 ext4 file systems Multi lmage Master Store multiple ZXi created images in a repository on an attached drive a USB enclosure connected to ZXi or on a shared network location and then clone to selected targets Partition Cloning For multiple partition drives ZXi automatically selects the optimum cloning method Clever or Mirror
26. 99 TYPES OF OPERATIONS iube require proxy settings for devices like the ZXi to connect to the Internet This typically includes a server or IP address a host port a username and password 5 0 10 1 Server Tap the Server icon to set the IP address or server name and port of the proxy server 5 0 10 2 Username Password If the proxy server requires a username and password for authentication tap the Username Password icon to set this information 5 0 11 Software Update New and improved software will be released from time to E time There are two ways to update the software on the ZXi From the web via a network connection or from a USB drive SOFTWARE UPDATES For the latest step by step instructions on how to update the ZXi software please read the ZXi Software readme file located on the ZXi s support page at www logicube com In depth information on updating the ZXi software can be found in Chapter 8 Updating the ZXi Software 5 0 12 Power Off The ZXi can be turned off in this menu This is useful when the 2 ZXi is controlled remotely from a browser and needs to be turned off Simply select the Power Off option Additionally the Graphical User Interface GUI can be refreshed POWER OFF POWER OFF Tapping this button will turn off the ZXi from the GUI REFRESH Tapping this button will refresh the GUI A confirmation screen will appear when choosing either button Select Yes to confi
27. D AS AVAILABLE AND LOGICUBE DISCLAIMS ANY AND ALL OTHER WARRANTIES WHETHER EXPRESS IMPLIED OR STATUTORY INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT OF THIRD PARTY RIGHTS SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES OR LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS SO THE ABOVE LIMITATIONS OR EXCLUSIONS MAY NOT APPLY TO YOU THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS AND YOU MAY HAVE OTHER RIGHTS WHICH VARY FROM JURISDICTION TO JURISDICTION Logicube ZClone Xi User s Manual II ROHS Certificate of Compliance LOGICUBE PRODUCTS COMPLY WITH THE EUROPEAN UNION RESTRICTION OF THE USE OF CERTAIN HAZARDOUS SUBSTANCES IN ELECTRONIC EQUIPMENT ROHS DIRECTIVE 2002 95 EC THE ROHS DIRECTIVE PROHIBITS THE SALE OF CERTAIN ELECTRONIC EQUIPMENT CONTAINING SOME HAZARDOUS SUBSTANCES SUCH AS MERCURY LEAD CADMIUM HEXAVALENT CHROMIUM AND CERTAIN FLAME RETARDANTS IN THE EUROPEAN UNION THIS DIRECTIVE APPLIES TO ELECTRONIC PRODUCTS PLACED ON THE EU MARKET AFTER JULY 1 2006 Logicube Technical Support Contact Information 1 By website www logicube com By email techsupport logicube com 3 Bytelephone 1 818 700 8488 ext 3 between the hours of 7am 5pm PST Monday through Friday excluding U S legal holidays dd Logicube ZClone Xi User s Manual SSS ae Table of Contents ZCLONE XI USER
28. EASE READ THE TERMS OF THIS AGREEMENT CAREFULLY BY INSTALLING OR USING LOGICUBE PRODUCTS YOU AGREE TO BE BOUND BY THIS AGREEMENT IN NO EVENT WILL LOGICUBE BE LIABLE WHETHER UNDER THIS AGREEMENT RESULTING FROM THE PERFORMANCE OR USE OF LOGICUBE PRODUCTS OR OTHERWISE FOR ANY AMOUNTS REPRESENTING LOSS OF PROFITS LOSS OR INACCURACY OF DATA LOSS OR DELAYS OF BUSINESS LOSS OF TIME COSTS OF PROCUREMENT OF SUBSTITUTE GOODS SERVICES OR TECHNOLOGY PROPERTY DAMAGE OR INDIRECT CONSEQUENTIAL OR PUNITIVE DAMAGES OF A PURCHASER OR USER OF LOGICUBE PRODUCTS OR ANY THIRD PARTY LOGICUBE S AGGREGATE LIABILITY IN CONTRACT TORT OR OTHERWISE WHETHER UNDER THIS AGREEMENT RESULTING FROM THE PERFORMANCE OR USE OF LOGICUBE PRODUCTS OR OTHERWISE TO A PURCHASER OR USER OF LOGICUBE PRODUCTS SHALL BE LIMITED TO THE AMOUNT PAID BY THE PURCHASER FOR THE LOGICUBE PRODUCT THIS LIMITATION OF LIABILITY WILL BE EFFECTIVE EVEN IF LOGICUBE HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH DAMAGES LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ITS PRODUCTS HOWEVER THE PURCHASER IS RESPONSIBLE FOR VERIFYING THAT THE OUTPUT OF A LOGICUBE PRODUCT MEETS THE Logicube ZClone Xi User Manual PURCHASER S REQUIREMENTS THE PURCHASER FURTHER ACKNOWLEDGES THAT IMPROPER OPERATION OF LOGICUBE PRODUCTS CAN CAUSE LOSS OF DATA DEFECTIVE FORMATTING OR DEFECTIVE DATA LOADING LOGICUBE WILL MAKE EFFORTS TO SOLVE OR REPAIR ANY PROBLEMS IDENTIFIED BY PURCHASER EI
29. OB NAME Logicube Forensic ZXi User s Manual 24 IMAGING Log names and file names can be customized by entering a Job File Name For example if a clone operation is performed and the Job File Name is set to TestJob the log name and file name will be called TestJob Subsequent Job File Names that are the same will be identified with a dash then the next image number For example TestJob 1 TestJob 2 etc The ZXi will convert any non POSIX portable characters used in Job File Name field to underscores _ when creating the log or file names POSIX portable characters are Upperjob A to Z Period Lowerjob a to z Underscore _ Numbers 0 to 9 Hyphen Dash 4 0 3 2 HPA DCO Common Setting Some computer manufacturers will use a utility that creates an HPA or DCO configuration on a hard drive These configurations are designed to change drive characteristics such as drive capacity speed and other settings as they are reported to the computer s BIOS The HPA DCO setting allows the user to set whether a drives HPA or DCO is to be unlocked and imaged Select YES to unlock and image a Host Protected Area HPA or Device Configuration Overlay DCO CLONE HPA CLONE DCO Logicube Forensic ZXi User s Manual 25 IMAGING HPA Host Protected Area can limit the size of a hard drive but it can also change many other settings such as speed and S M A R T status DCO Device Configuration Ove
30. THER UNDER THE WARRANTY SET FORTH BELOW OR ON A TIME AND MATERIALS BASIS LIMITED WARRANTY FOR ONE YEAR FROM THE DATE OF SALE THE WARRANTY PERIOD LOGICUBE WARRANTS THAT THE PRODUCT EXCLUDING CABLES ADAPTERS AND OTHER CONSUMABLE ITEMS IS FREE FROM MANUFACTURING DEFECTS IN MATERIAL AND WORKMANSHIP THIS LIMITED WARRANTY COVERS DEFECTS ENCOUNTERED IN THE NORMAL USE OF THE PRODUCT DURING THE WARRANTY PERIOD AND DOES NOT APPLY TO PRODUCTS DAMAGED DUE TO PHYSICAL ABUSE MISHANDLING ACCIDENT NEGLIGENCE OR FAILURE TO FOLLOW ALL OPERATING INSTRUCTIONS CONTAINED IN THE OPERATING MANUAL PRODUCTS WHICH ARE MODIFIED PRODUCTS WHICH ARE USED IN ANY MANNER OTHER THAN THE MANNER FOR WHICH THEY WERE INTENDED AS SET FORTH IN THE OPERATING MANUAL PRODUCTS WHICH ARE DAMAGED OR DEFECTS CAUSED BY THE USE OF UNAUTHORIZED PARTS OR BY UNAUTHORIZED SERVICE PRODUCTS DAMAGED DUE TO UNSUITABLE OPERATING OR PHYSICAL CONDITIONS DIFFERING FROM THOSE RECOMMENDED IN THE OPERATING MANUAL OR PRODUCT SPECIFICATIONS PROVIDED BY LOGICUBE ANY PRODUCT WHICH HAS HAD ANY OF ITS SERIAL NUMBERS ALTERED OR REMOVED OR ANY PRODUCT DAMAGED DUE TO IMPROPER PACKAGING OF THE WARRANTY RETURN TO LOGICUBE AT LOGICUBE S OPTION ANY PRODUCT PROVEN TO BE DEFECTIVE WITHIN THE WARRANTY PERIOD WILL EITHER BE REPAIRED OR REPLACED USING NEW OR REFURBISHED COMPONENTS AT NO COST THIS WARRANTY IS THE SOLE AND EXCLUSIVE REMEDY FOR DEFECTIVE PRODUCTS IF A PRODUCT IS HAS BECOME OBSOLETE OR
31. Xi to keep the same partition size e The percentage value when set from 1 to 100 will determine what percentage of the Target drive s will be used For example setting the percentage value to 100 would instruct the ZXi to use the entire Target drive for that partition e When attempting to clone to a Target drive that is smaller in capacity than the Master drive the partitions on the Master drive need to be adjusted to be no more than the same size of the Target drives e Windows Vista 7 and 8 have a built in partition utility that can shrink volumes or partitions For more information on how to shrink volumes you can search the Internet for technet shrink volume Although there are several ways of shrinking a partition or volume we recommend using Microsoft s recommended method e The capacity of a hard drive may be smaller than the capacity on the label For example the typical capacity of a 500 GB hard drive is 465 GB e f Mirror was chosen a screen will appear showing a percentage of the Master drive to copy By default it will be set to 100 to copy the entire Master drive Tap Mirror Settings to bring up the Mirror Clone Advanced Settings window This screen displays an option to select whether the Master drive is a RAID configuration or a NON RAID configuration There are also 3 other parameters that can be set e LENGTH Set the percentage or number of blocks to clone e MASTER START Set the percent
32. ace 8 0 2 Serial Attached SCSI SAS Capability When this option is purchased the latest software posted online contains a license file which will be loaded along with a software re load or update See Chapter 6 for details on how to update the software Logicube ZClone Xi User s Manual 66 9 FREQUENTLY ASKED QUESTIONS 9 0 FAQs PP PP PP PP PP How many concurrent tasks can the ZXi run The ZXi can run up to 5 concurrent tasks Do Target drives need to be wiped or formatted using the ZXi It is not necessary to wipe Target drives prior to cloning However if the user requires wiping Target drives Logicube recommends using the ZXi to wipe Target drives The ZXi logs all wipe operations Can the ZXi clone Linux partitions Yes ZXi can clone Linux partitions using both Mirror mode and Clever Clone mode Can the ZXi clone a Hierarchical File System HFS Yes ZXi can clone HFS using Mirror mode How does the ZXi handle bad sectors found on the Source drive ZXi will retry the bad sector 7 times After the 7 attempt if the sector still cannot be read it will skip that sector and list the sector in the log file What operating system does ZXi use ZXi uses a Linux based operating system A Linux based operating system provides increased stability and security over Windows based systems Does imaging performance slow down when multiple drives are imaged at the same time Performance is limited by the slowes
33. age or number of blocks from the start of the Master e TARGET START Set the percentage or number of blocks from the start of the Target s 30 IMAGING To enter an LBA number number of blocks press and hold one of the left or right arrows on the Length Master Start or Target Start A window will appear similar to the one below allowing you to enter a specific number of blocks 4 0 3 5 2 Cloning Drives From a RAID Array When cloning drives from a RAID array Drive to Drive and Mirror mode must be used The ZXi can check the Master drive to see if it is has a RAID configuration When the RAID icon is selected the ZXi will check the Master Drive for a RAID configuration and check the Target drives RAID information is NOT copied or cloned to the Target drive Typically when cloning a Master drive from a RAID array the Target drives may need to be initialized by the RAID controller prior to cloning in order for the RAID controller to recognize the drives as part of a RAID array MIRROR CLONE ADVANCED SETTINGS PARAMETER Logicube Forensic ZXi User s Manual 31 IMAGING 4 0 4 Target TARGET Tap this icon to select which drive s or image file will be used as the Target drive or image When DRIVE TO DRIVE or IMAGE TO DRIVE is chosen from the Mode settings this will show the different drives connected to the ZXi When DRIVE TO IMAGE is chosen from the Mode settings
34. and tap Save A confirmation screen will appear Tap the Yes icon to save the profile Make sure the profile to be loaded during the boot process is highlighted in this job ImageToDrive DB and tap the Load icon A confirmation screen will appear 8 The next time the ZXi is turned on it will load ImageToDrive profile Also each time a profile or configuration is selected then loaded it will immediately load the saved settings on that profile or configuration To delete a profile tap the delete icon A confirmation screen will appear Tap the Yes icon to delete the selected profile Do not highlight and save over the INITIAL DB configuration This is the default configuration of the ZXi and is used to reset the ZXi to the factory default settings 5 0 9 2 Passwords There are two sets of passwords that can be entered on the ZXi e Log File Deletion Password A password can be set as an extra layer of protection when deleting log files If this password is set ZXi will prompt for the password before any log files can be deleted e Config Lock The ZXi can be configured to lock out any configuration changes When this is enabled changes to the different types of operations cannot be made without entering the correct key or password Different types of operations can still be started For example when the ZXi is locked and it is configured for Drive to Image Imaging mode the user will be unable to change this
35. ap Clone Method Settings and one of the following two screens will appear CLONE METHOD SETTINGS CLONE METHOD SETTINGS Logicube Forensic ZXi User s Manual 28 Logicube Forensic ZXi User s Manual IMAGING From these screens you can choose Mode to change the mode Choose between Mirror or Clever e CLEVER Clones only sectors with data skips blank sectors then adjusts the partition to fit the drive CLEVER CLONE PARTITION RESIZE PARTITION FILE SYSTEM RESIZE PERCENTAGE gt gt K lt ENS e MIRROR Performs a bit for bit copy of the Master drive or image MIRROR CLONE ADVANCED SETTINGS f i EF a Kl lt AB K lt gt Klel ES 4 1 3 5 2 Clever Clone Partition Resize Settings or Mirror Clone Advanced Settings The Partition Resize Settings or Mirror Settings window will show the different clone settings available based on which clone method above was chosen e lf Clever was chosen the following screen will appear showing a list of partitions seen on the Master drive PARTITION RESIZE SETTINGS Tap Settings to bring up the Clever Clone Partition Resize window This screen displays each partition on the selected Master drive the Filesystem and for each partition a resize 29 Logicube Forensic ZXi User s Manual IMAGING percentage bar to set the percentage to resize each partition e Setting the slider percentage to 0 will instruct the Z
36. are not being used on any task Disconnecting drives while the ZXi is using the drive for a task may cause data loss Logicube Forensic ZXi User s Manual 7 GETTING STARTED ube 2 3 The user interface The user interface UI has been designed to quickly and easily input commands It is simple and intuitive showing common icons such as tasks modes of operation and scroll icons on the screen The Ul is designed to be easily followed going from left to right across the screen ZCELONE Xi E ADD NEW TASK SETTINGS TARGET w A Operations Tasks currently running B Lock indicator shortcut C Operations Tasks D Add or delete tasks E Types of Operations F Up and down scroll arrows G Operation options and settings H Start icon 2 4 Touch screen The ZXi features a 7 color LCD capacitive touch screen that allows the user to quickly input commands The screen is bright and easy to read Logicube Forensic ZXi User s Manual 8 GETTING STARTED ube 2 5 HDMI The ZXi has two HDMI ports located in the back panel Simply connect an HDMI cable from the ZXi to an external display that supports HDMI and the ZXi will automatically show the display on both the ZXi and the external display To change the display resolution on the external display 1 Connect a wired USB keyboard to one of the back USB 2 0 host ports 2 Press ALT R An on screen display should app
37. ask Select T1 as the Target and change the setting to perform a Secure Erase Wipe Patterns set to off Do not start this task 2 Next set the Clone task Select Drive to Drive as the Mode Select M1 as the Master Change the settings as needed Select T1 as the Destination Do not start this task 3 Choose Task Macro from the list of operations on the left side Tap the Tasks icon to select the different tasks for the macro Logicube Forensic ZXi User s Manual 44 TYPES OF OPERATIONS 5 Tap the field next to Operation 1 to set the first operation Since the first task to be run is the Wipe task select Wipe 1 then tap OK 6 Tap the field next to Operation 2 to set the second operation Since the second task to be run is the Drive to Drive Imaging task select Clone 1 then tap OK 7 The screen should now show Wipe 1 Clone 1 as the Tasks for Macro 1 8 Tap the Start icon to begin the macro The macro will run the Wipe 1 task first then Clone 1 5 0 6 Logs The ZXi keeps logs of all clone hash and wipe operations Logs can be viewed directly on the ZXi or from a computer s browser if the ZXi is connected to a network In addition to viewing the logs can be exported to an external USB location such as a USB flash drive Logs are exported in PDF HTML and XML format From this screen log files can also be deleted one at a time or all at once LOG FILES LOGS LOG FILE NAME DATE CREATED y The log
38. can be set up in the Network Repositories menu SELECT REPOSITORY REPOSITORY LOCATION 4 OF FILES FREE SPACE FORMAT Once a repository is selected you can create a new image file by tapping the New File icon SELECT IMAGE FILE NAME DATE CREATED MORE INFO You can also tap the MORE INFO icon to see more information about the image When selected a screen will appear showing details on the selected image file Logicube Forensic ZXi User s Manual 33 IMAGING IMAGE FILE DETAILS 4 1 Starting the Imaging Operation Once all the settings and options have been selected or set tap the BYE Start icon to begin the imaging A confirmation screen will appear Tap the Yes icon to continue A progress bar will appear at the bottom of the screen showing the bytes processed the rate speed elapsed time bad sectors on the Master drive and time remaining When finished the status will change to COMPLETED At this point it is recommended to click Reset Task to reset the task and also to delete the task in order for the drive bays to be properly reset and not show as being used or assigned for other tasks to be configured Logicube Forensic ZXi User s Manual 34 5 Types of Operations 5 0 Types of Operations There are twelve 12 types of operations available on the ZXi The left side of the screen shows the different operation types that can be set Detailed information on all of the different
39. ceca A A A aes een ae 37 5032 SCUUINGS iarr E tensa Ga ee A OTR R 38 S033 VODA cda 39 OA VIDA AAA AA A E eee 39 OAT TUTELA A a 40 IS A ea 40 IAZ SO CULC a Erien acuta OE EA A OA suas E eu E tas cadwudesdelecmpa tater 41 IOA 2d SWAPS E EAS A EA E A ds 41 eee RO 43 5O43 SOMO A E AAA AAA A A A E 44 505 TASK AC IAS 44 SOGA TOSK AAA o A eaa a aaa ueevone 44 S0 0 A E ree re ee terre 45 SOT COUAUISUCS ce itiec sc E ice abt sncettinun na ceeindea das voce deat EE des Anti dae dahl acute cele doe otal 46 50 8 Manage REDOSILOMES ii A A AAA AS 46 508A AUG RENOVE de O 46 TO DO ESA E eee 49 SS A O 49 50 94 User PROsICS CONTIGUIOTIONIS id 50 50 92 SP ASS WO Sai 51 5 0 9 2 1 Additional information for Config LOCK cccccccccccnnnnnnnononnnnnnnnnnnnnonononnnonnnnnnnnnnnnnnnnonnnonnnnananons 32 50 9 22 Foreotten password or Comme lock Keys usecase ais 53 Logicube ZClone Xi User s Manual 5 0 9 3 LONGUAGGE TIME ZONE ic 54 ODIA ANS WAC re A A in 54 30O A AAA SAA RR POCO PR O 55 RIA BOY RO ES A SANA A AS AA o 55 50 10 IPSetnesia dad 55 OL SOM E o Ue 56 50 102 USCrRaMme POSS WO A A ic 56 SOL SOM Ware UNA A oe 56 50 12 Power ON a da 56 6 UPDATING OR RELOADING THE ZXI SOFTWARE AND FIRMWARE sceccescesees 57 6 0 LOADING NEW SOFTWAR E sarao celica 57 6 1 SOFTWARE LOADING RELOADING INSTRUCTIONS cccsssecccccsssccceesececeesececcescseeeeseseceeseseceeeceeeenes 57 O LL From Network Vid
40. cude ZClone Xi User s Manual Z NE Logicube Inc Chatsworth CA 91311 USA Phone 818 700 8488 Fax 818 700 8466 Version 1 3 Date 02 05 15 MAN ZXi Logicube ZClone Xi User Manual eee Limitation of Liability and Warranty Information Logicube Disclaimer LOGICUBE IS NOT LIABLE FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROPERTY DAMAGE LOSS OF TIME OR DATA FROM USE OF A LOGICUBE PRODUCT OR ANY OTHER DAMAGES RESULTING FROM PRODUCT MALFUNCTION OR FAILURE OF INCLUDING WITHOUT LIMITATION THOSE RESULTING FROM 1 RELIANCE ON THE MATERIALS PRESENTED 2 COSTS OF REPLACEMENT GOODS 3 LOSS OF USE DATA OR PROFITS 4 DELAYS OR BUSINESS INTERRUPTIONS 5 AND ANY THEORY OF LIABILITY ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OR FROM DELAYS IN SERVICING OR INABILITY TO RENDER SERVICE ON ANY LOGICUBE PRODUCT LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ALL PRODUCTS HOWEVER THE CUSTOMER IS RESPONSIBLE TO VERIFY THAT THE OUTPUT OF LOGICUBE PRODUCT MEETS THE CUSTOMER S QUALITY REQUIREMENT THE CUSTOMER FURTHER ACKNOWLEDGES THAT IMPROPER OPERATION OF LOGICUBE PRODUCT AND OR SOFTWARE OR HARDWARE PROBLEMS CAN CAUSE LOSS OF DATA DEFECTIVE FORMATTING OR DATA LOADING LOGICUBE WILL MAKE EFFORTS TO SOLVE OR REPAIR ANY PROBLEMS IDENTIFIED BY CUSTOMER EITHER UNDER WARRANTY OR ON A TIME AND MATERIALS BASIS Warranty DISCLAIMER IMIPORTANT PL
41. d screen shots see Section 5 0 12 of this manual Logicube Forensic ZXi User s Manual 21 4 CLONING 4 0 CLONE This type of operation allows the cloning of a Master drive or image created by the ZXi to one or more Destinations another drive or a repository There are three different clone modes and several settings to choose from These selections should be performed in order from left to right Within each mode there are two different ways to perform the clone Mirror and Clever Mirror Performs a bit for bit copy of the Master drive or image Clever Clones only sectors with data skips blank sectors then adjusts the partition to fit the drive There are four selections when performing an image e Mode e Master Image File e Settings e Target 4 0 1 Mode MODE Tap this icon to choose between the following three imaging modes SELECT MODE aA DRIVE TO DRIVE Logicube ZClone Xi User s Manual 22 IMAGING e Drive to Drive Clones one Master drive to one or more Target drives e Image to Drive Creates an image file from the Source drive The image file can be written to a drive or a network repository e Drive to Image Restores ZXi image files to one or more drives 4 0 2 Master Image File Tap this icon to select the Master drive or Image MASTER IMAGE FILE File ZXi will list all the available drives on the Master position s When Drive to Drive or Drive to Image mo
42. de is selected the Master window will show all drives connected to the bays or ports configured as Master or both Master and Target SELECT MASTER DRIVE BAY DRIVE INFORMATION DRIVE STATUS MORE When Image to Drive mode is selected the Image File window will list all available drives that may contain ZXi image files The More Info icon displays more information on the drive The drive details window will appear showing information about the drive DRIVE DETAILS Logicube Forensic ZXi User s Manual 23 iTcube IMAGING 4 0 3 Settings SETTINGS Tap the Settings icon to change the clone settings Depending on what Mode was selected Drive to Drive Image to Drive or Drive to Image different screens will appear COMMON SETTINGS The following settings are found on all three modes e Job Info e HPA DCO e Error Handling e Hash Verification Method optional feature O SHA 256 verification is only available when using Drive to Drive mode 4 0 3 1 Job Info Common Setting Job Info allows users to enter information about the job This is optional and is not required to start an imaging operation Information entered here will appear in the logs ENTER JOB INFO JOB NAME JOB ID OPERATOR OTHER ID JOB NOTES Tap any of the boxes and an on screen keyboard will appear allowing information to be entered After entering the information tap the OK icon to go back to the previous screen J
43. drive or USB external drive to one of the two USB 2 0 ports located in the back of the ZXi The USB drive must be formatted with the FAT FAT32 NTFS or EXT4 file system b Tap the Export icon to export the log file via USB The log will be exported copied to the attached USB drive and will be in HTML PDF and XML formats Repeat steps 2 through 4 if other log files need to be exported or viewed To print the log files use the web interface as described in Chapter 7 Remote Operation and click the print icon on the bottom left corner of the screen The browser s print menu will Logicube Forensic ZXi User s Manual 17 iTcube QUICK START appear and the log can be printed to an available printer on configured on the computer 3 6 2 Deleting log files LOG FILES LOGS LOG FILE NAME DATE CREATED MIRRORCLONE 16 WED JAN 21 13 49 58 2015 Log files can be deleted one at a time or all at once e To delete a single log file tap or click the log file to highlight the log file to be deleted Tap the Delete icon to delete the selected log file e To delete all the log files tap the Delete All icon A log file deletion password can be set to add a layer of security when deleting log files If a password was set log files cannot be deleted without entering the correct password e Ifalog file deletion password was not created a confirmation screen will appear confirming to delete the single log file or all log fil
44. ear Type telnet in the Open field and press Enter The Telnet window should appear b For Windows Vista or 7 click Start and in the Search field type Telnet Telnet should appear in search results Logicube Forensic ZXi User s Manual 62 REMOTE OPERATION 4 Type open followed by the IP address or name of the ZXi For example open 192 168 1 100 or open ZXi XXXXXX where XXXXXX is the 6 digit serial number of the ZXi then press Enter The ZXi login screen should appear Note On some Operating Systems the ZXi will need to be accessed by opening ZXi XXXXXX local 5 Login with the username it without the quotes and the password it without the quotes 6 The ZXi can now be configured or managed via the command line interface 7 3 2 Connecting via SSH Connecting to the ZXi via SSH Secure Shell is very similar to connecting via Telnet Since Windows does not have a built in SSH client a third party SSH client will need to be downloaded and installed to connect via SSH For instructions and support on how to use third party SSH clients please contact the SSH client s manufacturer 1 Connect the ZXi to the network by attaching a network cable CAT 6 type to the RJ45 connector in the back of the ZXi 2 Turn the ZXi on and allow it to boot up completely Open the SSH client and select an SSH connection 4 Connect to the ZXi either by IP address or by name The name of the ZXi will be ZXi XXXXXX where
45. ear on the external display that allows the display resolution to be changed 2 6 USB flash drive located in the back of the ZXi There is a USB flash drive located in the back of the ZXi that is connected to one of the y USB 2 0 ports This USB flash drive contains the Operating System and ZXi software and must be connected to the ZXi at all times Logicube Forensic ZXi User s Manual 3 Quick Start 3 0 Quick Start Guide This chapter gives a basic overview and steps on how to perform different types of operations using the ZXi Clone Hash Wipe etc Complete details on each operation menu or selection and the different screens can be found in Chapter 4 Cloning and Chapter 5 Types of Operation The ZXi can perform up to five 5 concurrent types of operation at the same type specifically Clone Hash and or Wipe For example two clone operations can be running along with two wipe operations and one hash operation all at the same time 3 1 Drives This screen shows the status of all drive bays Each drive bay will be listed whether or not there is a drive connected If there is a drive connected the model of the drive will appear in the Drive Information column and will have av symbol in the Drive Connected column If no drive is detected the bay will have a Lx symbol Additional drive information can be viewed by tapping the more info icon 3 2 Clone The ZXi has three modes of operation to c
46. ease contact Logicube Technical Support for assistance Logicube ZClone Xi User s Manual 3 2 Getting Started 2 0 Overview of the ZXi Please pay close attention when any of these two icons are found These icons highlight additional information or important warnings on specific topics Special Icons Throughout this manual there are two icons that can be seen ZXi Drive Bays Removable Removable Drive Stations Drive Stations S USB 3 0 Port Power On Off Touch Screen Warning LED Alarm Display ZXi Rear View Gigabit Ethernet coM1 71 Jacks Line In Y Line Out HDMI VGA ps 2 Port1 USB 3 0 Host Ports Fan Power Keyboard HDMI Port 3 Port Port 2 USB 3 0 Port 2 Logicube ZClone Xi User s Manual 5 GETTING STARTED ZXi Right Side Expansion Bays SATA ONLY i ee Ww SATA SAS SATA Only ZXi LEFT SIDE VIEW FAN FAN 2 1 Turning the ZXi on and off The ZXi comes with a standard power cable that connects to the back of the device Attach the included power cable the power connector in the back of the ZXi To turn the ZXi on turn the power switch located next to the power connector to the ON position The ZXi will turn on and start the boot process It is normal for the fans to either turn off or slow down after the initial start up sequence To turn the ZXi off use the Graphical User Interface GUI either on the touch screen or via a browser through
47. ed without the unlock key e Logs Since there are no settings or configurations for this operation it is not affected by Config Lock e Statistics Since there are no settings or configurations for this operation it is not affected by Config Lock e Manage Repositories A managed repository cannot be added without the unlock key At this time a managed repository can be deleted without the unlock key A future software update will require the unlock key to delete a managed repository 92 TYPES OF OPERATIONS e System Settings This entire section cannot be accessed without the unlock key e IP Settings This entire section cannot be accessed without the unlock key e Software Updates This entire section cannot be accessed without the unlock key e Power Off This entire section cannot be accessed without the unlock key The Passwords can be saved into a user profile configuration and loaded each time the ZXi is turned on See Section 5 0 10 1 for more information on saving and loading a user profile configuration The ZXi can still be turned off without the unlock key by using the power button in front of the ZXi or the power switch located in the back of the ZXi Remember the Config Lock Key If the ZXi is configured to load with the Config Lock set enabled the only way to delete the Config Lock is to reset the ZXi using the Command Line Interface CLI 5 0 9 2 2 Forgotten passw
48. es e Ifalog file deletion password was created a screen will appear prompting to enter the log file deletion password Enter the log file deletion password Tap the OK icon to delete the single log file or all the log files depending on which was selected The password can be set in the Systems Settings More information about the log file deletion password can be found in Section 5 0 9 2 3 6 3 Accessing the logs over a network The log files can also be accessed through a network on a computer if the ZXi is connected on the same network 1 Open Windows Explorer or a similar window and browse to the hostname or the IP address found in the Statistics screen See Section Logicube Forensic ZXi User s Manual 18 iTcube QUICK START 5 0 7 for more information on the Statistics screen de mda 102701 Organize Ep Preview 2 AWindows security screen will appear prompting to enter a User name and Password to connect to the ZXi Login with the following credentials e Username it e Password it nto O O S Enter Network Password Enter your password to connect to xi 102701 Username name y p Password a LG Remember my credentials E Logon failure unknown user name or bad password Conca 3 Once connected an auditlog folder will appear Open the auditlog folder OU gt Network za 102701 Organize v Search active directory Network and Shar Jr Favorites 4 Share 1
49. file may contain several sections depending on what settings and options were chosen during the operation including e Information on the ZXi and its settings e Job info if entered e Master and Target hashes Logicube Forensic ZXi User s Manual 45 TYPES OF OPERATIONS See Section 3 6 1 for instructions on how to export the log files See Section 3 6 2 for instructions on how to delete the log files See Section 3 6 3 for instructions on how to Accessing the logs over a network 5 0 7 Statistics This will display four tabs About Adv Drive Statistics I O LO Ports and Options The About screen will show information about the ZXi including the current software installed J Kt STATISTICS The Adv Drive Statistics tab shows S M A R T Self Monitoring Analysis and Reporting Technology information taken directly from what the drive is reporting Navigate between drives by using the left and right scroll arrows The up and down scroll arrows scroll through the different information The information shown is the raw value tracked by the drive and is not translated The I O Ports tab displays a diagram of the input and output ports located in the back of the ZXi The Options tab displays which software options are installed on your ZXi 5 0 8 Manage Repositories Repositories can be added to the ZXi in this operation REPOSITORIES When Manage Repositories is selected two tabs are available at the top of
50. hod in order Secure Erase Wipe Patterns then Format depending on which methods are chosen For example if both Secure Erase and Wipe Patterns are selected the ZXi will perform a Secure Erase first then a Wipe Patterns wipe 3 4 1 Step by step instructions Wipe ADD NEW TASK d SETTINGS JOB INFO Logicube Forensic ZXi User s Manual 14 iTcube QUICK START 1 Select ES the types of operation on the left side 2 Tap NSS and select one or more drives to wipe then tap the POKI icon Drives with different capacities should be wiped using multiple tasks if Wipe Patterns will be selected It is okay to use one wipe task when using Secure Erase 3 Tap ES and choose the type of wipe to be performed Secure Erase Wipe Patterns and or Format If Wipe Patterns is selected choose the type of Wipe Pattern to perform DoD or Custom 4 Ifthe drive has an HPA or DCO area that needs to be wiped tap the HPA DCO icon and select Yes to wipe the HPA DCO area of the drive 5 Tap the Passes icon to edit the number of passes and what gets written on each pass If Custom was selected at least one pass must be edited and chosen If DoD was selected a 7 pass value must be edited entered 6 Optional Tap Job Info to set the Job Name Job ID Operator ID Other ID or Job Notes The ZXi will convert any non POSIX portable characters used in Job Name field to underscores _ when creating the log or file
51. i to calculate the hash for the specified drive or validate the hash value for that drive The Hash Verification feature is an option To verify if this option has been enabled on your ZXi tap on the Statistics icon from the navigation menu and select the Options tab To purchase this option contact the Logicube Sales Department at sales logicube com ADD NEW TASK AAA SETTINGS JOB INFO 5 0 3 1 Drives TARGET Tap this icon to select which drive s will be hashed or verified The Zxi will show all Logicube Forensic ZXi User s Manual 37 TYPES OF OPERATIONS connected Master and Target drives Tap the drive to be hashed then tap OK SELECT TARGETS DRIVE BAY DRIVE INFORMATION DRIVE STATUS ka y A 5 0 3 2 Settings SETTINGS Tap this icon to choose a drive to adjust the hash settings The Hash Settings screen will appear Tap this icon to set the hash method SHA 1 HASH VALUES SHA 256 or MD5 and to set the expected hash value if desired Setting the expected hash value instructs the ZXi to hash the drive then verify the hash with the expected value set HASH METHOD Select one of the following hash methods e SHA 1 Select this to hash or verify the Target drives using the SHA 1 algorithm e SHA 256 Select this to hash or verify the Target drives using the SHA 256 algorithm e MD5 Select this to verify the Target drives using the MD5 algorithm O The recommended
52. ill be an option to Open with WinZip A computer without WinZip installed will have an option to Open when the file is highlighted If WinZip is installed highlight the downloaded zip file then click the arrow pointing downward next to Open with WinZip A drop down menu will appear Select Windows Explorer SAR Computer Local Disk C Downloads Organize gi Open with WinZip Print New folder Windows Explorer el Type Y Favorites S WinZip 19 14 AM WinZip File Libraries Choose default program Windows Explorer will open the zip file and the files can be extracted using the Extract all files function to the USB flash drive This will bypass WinZip and use the built in utility in Windows G Computer Local Disk C Downloads Organize v Extract all files Name N xtract all files T w Favorites Logicube Forensic ZXi User s Manual 99 UPDATING ZXI SOFTWARE iube 6 2 Firmware Loading Instructions FIRMWARE UPDATE FIRMWARE UPGRADE AVAILABLE Some software releases may contain a firmware upgrade The steps below outline how to check if the Falcon requires a firmware upgrade 1 After the software is updated on the Falcon from the main menu tap the down arrow twice then tap the Software Updates icon 2 Tap the Firmware Update page One of two screens will appear a FIRMWARE UPGRADE AVAILABE Tap the Update icon A message will appear
53. lone virtually any drive Hard Disk Drives or Solid State Drives Drives can be cloned using Mirror bit for bit copy or Clever copies only data areas skips blank sectors and partitions can be resized to fit larger capacity drives e Drive to Drive Clones a drive to one or more Target drives e Image to Drive Restores an image created by the ZXi to one or more Target drives e Drive to Image Creates a Logicube ZXi image file to a Destination or Repository This image file can be restored to drives using the Image to Drive mode Logicube ZClone Xi User s Manual 10 iTcube QUICK START The ZXi can clone from one or more Master drives to one or more Target drives Details on the different screens found in the Clone operation can be found in Chapter 4 Cloning The ZXi clone hash and wipe speeds are determined by several factors including the following The manufacturer specifications of the drive s being used The age of the drive manufactured date How often that drive has been used For example a 2 TB drive with 64MB of cache produced by the manufacturer 2 years ago is most likely slower than a 2 TB drive that the same manufacturer just released this year even though they are both 7200RPM with 64MB of cache and are both SATA III 3 2 1 Step by step instructions Clone ADD NEW TASK MASTER SETTINGS TARGET i 1 select o rom the types of operation on the left side 2 Ta
54. n about the job This is optional and is not required to start an operation Information entered here will appear in the logs More information on the Job Info screen can be found in Section 4 0 3 1 5 0 5 Task Macro This operation allows up to five 5 macros that can be set Each macro can run up to nine 9 tasks sequentially one after another For example a macro can be set to perform these AS tasks in order Wipe Clone then Hash das y eee 3 Each of the five macros can be set by tapping on the Macro number on the top of the screen Each task or operation must be set up before setting up the macro For example to set up a Task Macro that will perform a wipe then clone users must first set up both the wipe and clone tasks Once the wipe for example Wipe 1 and clone for example Clone 1 has been set up the Task Macro can be set 5 0 5 1 Tasks TASKS Tapping this icon allows the user to set specific tasks for each macro Tap Operation 1 to set the first operation in the macro The following screen will appear allowing the user to choose the task Tap the OK icon to continue Example Setting up a Macro for a Wipe using Secure Erase then perform a Drive to Drive Clone To set a macro to perform a Wipe using Secure Erase on T1 immediately followed by performing a Drive to Drive Clone from M1 to the newly wiped secure erased T1 the Wipe and Imaging Tasks first need to be set up 1 First set the Wipe t
55. n the ZXi Wait about 30 seconds then turn the ZXi back on The ZXi should load the new configuration The IP address can be checked by going to the Statistics screen Logicube Forensic ZXi User s Manual 65 A 8 Options 4 Drive Expansion and SAS 8 0 Introduction The ZXi has two available additional options e 4 Drive Expansion e Serial Attached SCSI SAS Capability To purchase one or both of these options please contact Logicube Sales department via email at sales logicube com or via telephone at 888 494 8832 8 0 1 4 Drive Expansion The optional expansion kit provides an additional 2 SAS SATA and 2 SATA only targets for a total of 9 SATA 7 SAS targets when cloning from a master hard drive or 10 SATA 8 SAS targets from a network repository or from a repository stored on an external USB enclosure connected to the ZXi 8 0 1 1 Attaching the removable ZXi DriveStation Follow these steps to attach the removable ZXi DriveStations to the ZXi s expansion slots 1 Remove the cover on one of the expansion ports T6 through T9 using a phillips head screw driver There are two screws on the cover one on each side Set the two screws aside as they will be used for the ZXi DriveStation 2 Connect the ZXi DriveStation to the open port from step 1 When inserted properly the ZXi DriveStation should not be protruding or sticking out 3 Use the two screws set aside from step 1 to tighten and set the ZXi DriveStation in pl
56. names POSIX portable characters are Upperjob A to Z Period Lowerjob a to z Underscore _ Numbers 0 to 9 Hyphen Dash 7 Tap the Start icon to start the wipe task The ZXi will perform a Secure Erase first if selected then a Wipe Pattern if selected and finally a Format if selected 8 When finished the status will show COMPLETED At this point it is recommended to click Reset Task to reset the task and also to delete the task in order for the drive bays to be properly reset and not show as being used or assigned for other tasks to be configured Logicube Forensic ZXi User s Manual 15 iTcube QUICK START 3 5 Task Macros eer E 3 TASK MACRO This operation allows up to five 5 macros that can be set Each macro can run up to nine 9 tasks sequentially one after another For example a macro can be set to perform these tasks in order Wipe Clone then Hash 3 5 1 Step by step instructions Task Macros MACRO 1 Each task or operation must be set up before setting up the macro For example to set up a Task Macro that will perform a wipe then clone Drive to Drive users must first set up both the wipe and clone tasks Once the wipe for example Wipe 1 and clone for example Clone 1 has been set up the Task Macro can be set A H Select Task Macro from the types of operation on the left side Select a macro Macro 1 through Macro 5 Tap the Task icon to select
57. net or SSH connect to the ZXi Instructions on how to connect via Telnet or SSH can be found in Section 7 3 1 or 7 3 2 4 Once logged in to the ZXi via CLI follow these steps to set the IP address to a Static IP a From the main prompt type command then press the enter key Type config then press the enter key Type net del n eth0 to delete the current network configuration The following information is required a static IP the netmask network gateway the network nameserver the domain For example i IP Address 192 168 1 123 ii Netmask 255 255 255 0 iii Gateway 192 168 1 10 iv Nameserver 192 168 1 10 typically the same as the gateway unless the network has a specific nameserver IP V Domain LG Networks are configured differently and the necessary settings may require the assistance of a Network or Systems Administrator Based on the info above the example for this line will be to type job sensitive net add n ethO t static a 192 168 1 143 m 255 255 255 0 g 192 168 1 1 N 192 168 1 1 d lg then press the enter key The ZXi should respond with the following Command DbNetworkConfig Successful Logicube Forensic ZXi User s Manual 64 REMOTE OPERATION g Now we need to save the configuration Type db save staticip db then press the enter key A Successful message should appear h Type db load staticip db to load the database configuration i Perform a full shut down o
58. ong with the type of data written for each pass In addition a 7 pass DoD wipe can be set with pre selected pass values There are 4 selections when setting a wipe pattern e MODE e HPA DCO e LBAS e PASSES MODE Selecting this will open the Wipe Mode screen showing 3 41 TYPES OF OPERATIONS options e NONE Choosing this will instruct the ZXi not to perform a wipe using Wipe Mode e DOD Choosing this will instruct the ZXi to perform a 7 pass wipe conforming to the DoD M 5220 standards e CUSTOM Choosing this will allow the user to specify how many wipe passes will be performed and what values each pass will be written on each of the passes selected This will open the HPA DCO HPA DGO option for wiping If the drive to be wiped has HPA and or DCO that needs to be wiped select Yes for the corresponding option By default this is set to 100 which will wipe all Logical LBA Block Addresses LBAs and will wipe the entire drive 100 This Wipe Setting will change PASSES depending on the Wipe Pattern Mode selected e f None was selected this is not selectable e If DoD was selected the first six pass values will be filled automatically by default It is mandatory that the user enter the 7 pass value by tapping the edit icon or the operation will fail The ZXi automatically enters default values for pass numbers 1 through 6 It is mandatory that the user enters
59. ord or config lock key If the Log File Deletion password or Config Lock key is forgotten the ZXi will need to be reset using the Command Line Interface CLI See Section 7 2 for more information on how to connect to the ZXi using the CLI Once connected to the CLI Logicube Forensic ZXi User s Manual 53 TYPES OF OPERATIONS 1 Login with the username it without the quotes and the password it without the quotes 2 From the main prompt type command then press the enter key 3 Type config then press the enter key 4 Type db list then press the enter key This will show a list of databases or configurations saved The example below shows two databases the default initial db and Lock db The db that shows an asterisk before the name is the current database or configuration being loaded each time the ZXi is turned on 5 Type db load initial db then press the Enter key to load the default database There should be a response showing Command DbManagement Successful 6 Type db list again and there should be an asterisk on initial db 7 Turn the ZXi off and close the Telnet SSH application 8 Wait for the ZXi to completely turn off then turn it back on When the ZXi boots up it will load the default configuration The default configuration can checked by going to System Settings and looking at the User Profiles Configurations tab INITIAL DB should have an asterisk next to it
60. p and select one of the following modes Tap oK when finished Logicube Forensic ZXi User s Manual 11 iTcube QUICK START 3 Depending on your selection on step 2 tap LINA to choose the master drive or ALTA to choose an image to restore Tap oK when finished 4 Tap ENS and adjust any of the settings as needed Job Info Clone Method Settings HPA DCO Error Handling and Hash Verification Method Tap BORI when finished 5 Tap and select one or more target locations Tap oK when finished 6 Tap ilig to start the cloning task by entering a Job name See Section 4 0 3 1 for more O Log file names can be set in Settings in the Job Info screen information The ZXi will convert any non POSIX portable characters used in Job File Name field to underscores _ when creating the log or file names POSIX portable characters are Upperjob A to Z Period Lowerjob a to z Underscore _ Numbers 0 to 9 Hyphen Dash 7 When finished the status will show COMPLETED At this point it is recommended to click the Reset Task icon to reset the task and also to delete the task in order for the drive bays to be properly reset and not show as being used or assigned for other tasks to be configured 3 3 Hash A hash operation can be performed to any drive connected to the ZXi Performing a hash operation will instruct the ZXi to calculate the hash for the specified drive or validate the hash value for that drive
61. positories see Section 5 0 8 of this manual 3 9 System Settings The System Settings screen allows users to configure four different settings for the ZXi e User Profiles Configurations e Passwords Logicube Forensic ZXi User s Manual 20 iTcube QUICK START e Language Time Zone e Brightness For more information on ZXi s system settings see Section 5 0 9 of this manual 3 10 IP Settings Proxy settings In order for the ZXi to be able to update software from a network over the internet or to synchronize the date and time proxy server settings may need to be set Networks that have a proxy server for internet access will require proxy settings for devices like the ZXi to connect to the Internet This typically includes a server or IP address a host port a username and password Sa Kar IP SETTINGS For more information on the IP Settings screen see Section 5 0 10 of this manual 3 11 Software Updates gt New and improved software will be released from time to time There are two E ways to update the software on the ZXi From the web via a network SOFTWARE connection or from a USB drive UPDATES For more information on see Chapter 6 Updating the ZXi Software 3 12 Power Off e The ZXi can be turned off in this menu This is useful when the ZXi is controlled 25 remotely from a browser and needs to be turned off Simply select the Power Off option POWER OFF For more detaile
62. r Secure Erase Wipe Patterns then Format depending on which methods are chosen For example if both Secure Erase and Wipe Patterns are selected the ZXi will perform a Secure Erase first then a Wipe Patterns wipe Logicube Forensic ZXi User s Manual 40 Logicube Forensic ZXi User s Manual TYPES OF OPERATIONS 5 0 4 2 1 Secure Erase SECURE ERASE Choose ON to Secure Erase the selected Target drive s Most drives support this function Secure Erase will send a command to the drive instructing it to reset itself to the specifications the drive manufacturer has set For information on what happens when the Secure Erase command is sent please contact the drive manufacturer If the secure erase process fails contact the drive manufacturer to find out if Secure Erase is supported on that specific drive For SAS Serial Attached SCSI drives Secure Erase sends a Format command For SATA Serial ATA drives Secure Erase sends a Security Erase Unit command For SATA drives that support Enhanced Security Erase Unit commands the enhanced command will be sent For questions on how each drive supports these features or what the drive will do with these commands please contact the drive manufacturer 5 0 4 2 2 Wipe Patterns WIPE PATTERNS Allows the user to set a specific wipe pattern or patterns to use for wiping the drive The number of passes is customizable up to 7 passes al
63. r from USB enclosures will the ZXi s USB ports power my devices or will an additional power source be required Each of the ZXi s USB ports meets the standard specification of up to 5V of power If your USB device has higher power requirements an external power source will be necessary Check with the manufacturer of your USB device to determine the exact power requirements Can the ZXi image to an external storage device such as a NAS Network Attached Storage Yes ZXi can image to external storage devices The external device can be connected to ZXi via the Gigabit Ethernet or via the destination ports USB 3 0 or the SAS SATA built into ZXi If the external storage device has a RAID configuration it will require that it be configured as a single drive Any source drive connected to ZXi can be imaged directly to the external storage device Logicube Forensic ZXi User s Manual 68 BIOS 25 Browser Compatibility 61 Case Info 24 Clone step by step 11 Config Lock 51 Connecting via SSH 63 Connecting via Telnet 62 Disclaimer Liability Limitation Disk Control Overlay DCO 25 26 Display LCD 8 DoD wipe 14 Drive to Drive 28 31 drive types 7 EU EUROPEAN UNION III FAQs 67 Features 1 Hash 12 37 Hash Verification Method 27 Host Protected Area HPA 25 26 HPA DCO 25 26 Image 36 Imaging 10 22 IP Settings Proxy settings 55 iSCSI 49 Language 54 Log files deleting log files 18 Logs
64. rlay limits the size of a drive only For example a 160GB drive can be made to look like a 100GB drive to a computer 4 0 3 3 Error Handling Common Setting When bad sectors are encountered on the Master drive ZXi can either skip the bad sectors or abort the operation This allows flexibility on what to do when bad sectors are found on the Master drive ERROR HANDLING SKIP ERR GRANULARTY 1 SECTOR When bad sectors are encountered and error handling is set to Skip ZXi will write a zero on the corresponding sector or position in the target drive ZXi also has a setting for error granularity There are 4 options e 1 sector 512 Bytes e 4096 Bytes 8 sectors e 64 KIB 128 sectors e 128 KIB 256 sectors When a bad sector on the Master drive is found by default it will skip that sector Changing the granularity allows more sectors to be skipped A cluster size represents the smallest amount of disk space that can be used to hold a file The most common cluster size for an NTFS volume for example is 4KB 4096 Bytes This means that Logicube Forensic ZXi User s Manual 26 IMAGING the smallest amount of space that will be used for a file is 4096 Bytes As an example if 4096 Bytes is chosen and one of the 8 sectors in that cluster size contains a bad sector the ZXi will skip the entire cluster or 4096 bytes or 8 sectors 4 0 3 4 Hash Verification Method Common Setting This setting allow
65. rm the selection Logicube Forensic ZXi User s Manual 96 AAA 6 Updating or Reloading the ZXi Software and Firmware 6 0 Loading New Software New and improved software will be released from time to time and will always be available on the ZXi support page at http www logicube com knowledge zclonexi The software will also contain a license file which is used for ZXi devices with the optional SAS capability purchased 6 1 Software Loading Reloading Instructions There are two methods of how to update the ZXi software A FROM NETWORK Via the web through an internet connection B FROM USB DRIVE Via software file download onto a USB drive flash The actual software installation will take about 5 minutes If FROM NETWORK was chosen the total time can exceed 10 to 20 minutes or longer depending on Internet speeds and Internet traffic The most up to date instructions on updating the software can be found in the ZXi Software readme file located on the ZXi s support page at http www logicube com knowledge zclonexi 6 1 1 From Network Via the web 1 Connect the ZXi to a network with Internet access Set the proxy settings IP settings if necessary Attach a network cable to the back of the ZXi O The ZXi is DHCP enabled by default 2 From the main menu on the ZXi tap the down arrow twice then tap the Software Updates icon A screen will appear showing the current version of software installed towards the
66. s Secure Erase Wipe Patterns and Format e Secure Erase Sends a command to the drive instructing it to perform a secure erase based on the drive manufacturer s specifications for the secure erase command e Wipe Patterns Allows the user to set a specific pattern to use for wiping the drive The number of passes is customizable up to 7 passes along with the type of data written for each pass In addition a 7 pass DoD wipe can be set with pre selected pass values e Format Allows the user to format a drive to prepare it to be used as a repository for images Drive to Image operations The drive can be formatted with the NT File System NTFS or EXT4 file system Logicube Forensic ZXi User s Manual 39 TYPES OF OPERATIONS iube There are three selections when performing a wipe Destination Settings and Job Info ADD NEW TASK i SETTINGS JOB INFO 5 0 4 1 Target Tap this icon to choose a drive to erase and or A screen will appear allowing the selection of one or more destinations Tap the drive s to be erased wiped and or formatted then tap OK 5 0 4 2 Settings SETTINGS Tap this icon to choose a drive to set the wipe settings The Wipe Settings screen will appear There are three sections in the Settings screen e Secure Erase e Wipe Patterns e Format The ZXi can perform one two or all three O methods on the same drive using the same task The ZXi will perform each method in orde
67. s menu language e Bay Roles Assign a role of Master Target or both to each bay 10 IP SETTINGS Allows the user to set proxy settings if required by their network 11 SOFTWARE UPDATES Perform software and firmware updates on the ZXi Software can be updated over an internet connection from network or from a USB flash drive 12 POWER OFF Allows the user to turn the ZXi unit off by using the Graphical User Interface GUI or refresh the GUI 5 0 1 Drives This screen shows the status of all drive bays Each drive bay will be listed whether or not there is a drive connected If there is a drive connected the model of the drive will appear in the Drive Information column and will have av symbol in the Drive Connected column If no drive is detected the bay will have a F3 symbol Logicube Forensic ZXi User s Manual 36 TYPES OF OPERATIONS Additional drive information can be viewed by tapping the 0 more info icon 5 0 2 Clone The ZXi has three modes of operation to clone virtually any drive Hard Disk Drives or Solid State Drives Drives can be cloned using Mirror bit for bit copy or Clever copies only data areas skips blank sectors and partitions can be resized Details on the different screens found in the Imaging operation can be found in Chapter 4 Cloning 5 0 3 Hash A hash operation can be performed to any drive connected to the ZXi Performing a hash operation will instruct the ZX
68. s the user to set a hash and or a verification method verify if this option has been enabled on your ZXi tap on the Statistics icon from the O The Hash Verification feature is an option To navigation menu and select the Options tab To purchase this option contact the Logicube Sales Department at sales logicube com Hash Will hash the Master drive with the selected method There are three or four hash algorithm options available depending on which cloning mode is selected HASH METHOD SHA VERIFY e None No hash of the Master drive will be performed e SHA 1 Uses the SHA 1 algorithm to hash the Master e SHA 256 Uses the SHA 256 algorithm to hash the Master This is only available when using the Drive to Drive mode e MDS5 Uses the MD5 algorithm to hash the Source Logicube Forensic ZXi User s Manual 27 IMAGING Verification Method Select YES to hash the Destination and verify that hash with the selected Source hash 4 0 3 5 Settings The Settings screen changes depending on which of the three Modes Drive to Drive Image to Drive or Drive to Image is selected Each of the three modes has their own different Settings screen 4 0 3 5 1 Special Settings for Drive to Drive When Drive to Drive mode is selected Clone Method Settings will appear on the top right of the Settings screen SELECT SETTINGS CLONE METHOD SETTINGS HASH VERIFICATION METHOD T
69. sess aes caine eels arta a AE oe naamatnnae ss mesa uiae naleaeam Sune ones aA 67 BOS INDEX iaa 69 TECHNICAL SUPPORT INFORMATION cnica 70 SOTA RETA TN o 70 ELECTROSTATIC DISCHARGE ESD WARNING cccccssssecccceeesseccccceeeeeccceeeeseeceeseuenecesesaueeeceeesaeneeeess 70 Logicube ZClone Xi User s Manual 1 Introduction 1 0 Introduction to the Logicube ZClone Xi Welcome to the Logicube ZClone Xi also known as ZXi A five target solution expandable to nine targets the ZXi is the newest member of Logicube s hard disk drive duplicator family The ZXi combines advanced features such as networking task macros user profiles and blazing fast cloning speed along with a simple easy to use interface to make this an enterprise level duplicator that is easy to operate for all skill levels A flat bed design allows users to quickly connect hard drives to removable drive stations A variety of non standard size drives can be connected to the ZXi with optional adapters The ZXi supports mirror cloning a 100 bit for bit copy as well as a CleverCopy mode that copies only data areas The unit can also safely and securely sanitize hard drives Users can choose from Secure Erase a custom pass setting or a powerful DoD specification 7 pass wipe algorithm The industrial strength ZXi is perfect for day to day hard drive imaging tasks including PC deployment OS upgrades and content application distribution 1 1 Features e High
70. speed cloning The ZCloneXi will clone at blazing speeds of 24GB min e The ZXi has built in support for 3 5 2 5 SATA hard drives The SAS ready drive stations support SAS hard drives with the purchase of an optional software activation package Logicube ZClone Xi User s Manual 1 iTcube INTRODUCTION e 1 8 2 5 3 5 IDE and IDE ZIF drives eSATA microSATA mSATA and compact flash media are supported with optional adapters e Supports cloning to and from USB enclosures and USB thumb drives 3 USB 3 0 ports are available e Multi target volume cloning Clone from 1 Master to 5 SATA target drives or 5 SAS if SAS option is purchased target drives or clone from a ZXi created image repository stored on an external USB enclosure or on a network repository to a total of 6 SATA SAS target hard drives e Optional 4 drive expansion kit provides an additional 2 SAS SATA and 2 SATA targets for a total of 9SATA targets 7 SAS when cloning from a master hard drive or 10 SATA 8 SAS targets from a network repository or from an external USB enclosure connected to the ZXi e Supports multiple master source and target drives User can assign any drive connected to ZXi as a master source or target drive e Network sharing Allows network access upload download to drive images and log files e Multi session capability Allows user to perform multiple tasks including cloning wiping or hashing concurrently e Hash verification SHA1 SHA
71. t client may require the assistance of a Network or Systems Administrator Other third party Telnet programs are available All versions of Windows do not have a built in SSH client The instructions in this manual only refer to the clients that come with Windows There are many third party Telnet or SSH clients available For instructions and support for third party clients please contact the software manufacturer 7 3 Installing the Telnet client in Windows Vista 7 8 or 8 1 By default the Telnet Client is not installed with Windows but it can be installed it by following the steps below 1 Open Control Panel and select either Programs amp Features or Programs 2 Click Turn Windows features on or off If a prompt for an administrator password or confirmation type the administrator password or provide confirmation A Network or Systems Administrator may be required for administrator access 3 Inthe Windows Features dialog box select the Telnet Client check box 4 Click OK The installation might take several minutes 7 3 1 Connecting via Telnet Once the Telnet client is installed follow the steps below to connect using the Windows Telnet client 1 Connect the ZXi to the network by attaching a network cable CAT 6 type to the RJ45 connector in the back of the ZXi 2 Turn the ZXi on and allow it to boot up completely 3 Open the Telnet client a For Windows XP click Start gt Run The Run window should app
72. t drive in the configuration however there should not be any significant speed penalty when imaging multiple drives How many separate tasks can you have running concurrently You can have up to five separate tasks running concurrently Can I schedule or automate tasks ZXi features the ability to create up to 5 separate Tasks Macros Each macro allows you to set up to 9 operations to be performed sequentially You can add these operations to a Macro and from the ZXi GUI select the Macro and the ZXi will perform the specified tasks operations in the sequence you have defined The user can save the Macro to use in future imaging sessions Can the ZXi image to or from a network location Logicube ZClone Xi User s Manual 67 iTcube FAQs A Yes The ZXi includes two gigabit network connections Users can designate a network share as a repository using CIFS Common Internet File System or iSCSI Internet Small Computer System Interface protocols Does the ZXi provide log files Yes each operation task produces a log file The log file is viewable on the ZXi screen or remotely on a PC in an HTML format The log files can be exported to a thumb drive the ZXi will export in XML HTML and PDF XML log files can be customized using XML editors The log files are stored on the internal hard drive within ZXi and are accessible by pressing the log file icon from the left side navigation bar on the ZXi screen If I am imaging to o
73. the Wenn raid 57 6 1 2 From USB Drive Via software downl0AO ooccccocccnnnoccnonaccnonacnnonancnnnccnonarononanononoss 58 6 1 2 1 Extracting the software download on a computer with WinZip or other third DYIP SOWIE eA E A T n 59 0 2 FIRMWARE LOADING INSTRUCTIONS nerian da 60 7 REMOTE OPERATION oasis 61 AOINTRODUCTON ia o o odio 61 FE WEBINTERFACE a A e Ra 61 Ted COMMAND LINE INTERFACE CEI caras 62 7 3 INSTALLING THE TELNET CLIENT IN WINDOWS VISTA 7 8 OR 8 1 ccccccececcesecesseceseeceseususeuseseuens 62 73k Connectie via TENE oase a a a e 62 Tae EONMECUNS VI a a a tohenuascsacsam deacwaashrecunes 63 7 4 ZERO CONFIGURATION NETWORKING ZEROCONF ssssecccccccesseccccceesecceeeeeeeccseeeeeeeeeeeseueeeeeeeeeas 63 7 5 CONFIGURING THE ZXI WITH A STATIC IP ADDRESS ccecceecsecseceeccecceccsccsecseeseeseeseeseeseeeceeeeeeeecees 64 7 5 1 Step by step instructions Static IP AaAUress ooocccnoncncnnoccnonaccnnnannnnnacnnnaccnonarononanoss 64 8 OPTIONS 4 DRIVE EXPANSION AND SAG cccsccscesccscccccccccscccccccescescesccsccescecees 66 SU INTRODUC HON 1 iia 66 3 01 A DFING EXPANSION a odia 66 8 0 1 1 Attaching the removable ZXi DriveStation occccccoocncnccooccnnonononnnconononconoconananonoss 66 8 0 2 Serial Attached SCSI SAS Capability c ccsssssccrsosserscenccussrsesteausersesseascarsenseascanse 66 9 FREQUENTLY ASKED QUESTIONS auna rai ds 67 Os TE OS
74. the drive manufacturer s specifications e Wipe Patterns Allows the user to set a specific pattern to use for wiping the drive The number of passes is customizable up to 7 passes along with the type of data written for each pass In addition a 7 pass DoD wipe can be set with pre selected pass values 5 TASK MACRO Set up to nine 9 different tasks to perform sequentially one after another For example a macro can be set to perform these tasks in order Wipe clone then hash LOGS Display logs of each task that has been performed on the ZXi ZXi STATISTICS This will display information about the ZXi including the current software installed In addition the Statistics screen has an Advanced Drive Statistics tab that shows raw S M A R T data on any drive connected to the ZXi an Options tab that shows which software options have been installed and an I O ports tab which details the I O ports available on ZXi 8 MANAGE REPOSITORIES Allows the user to add a network location or drive bay as a repository that can be used as a Destination for imaging or pushing images 9 SYSTEM SETTINGS This mode allows changes to the system settings on the ZXi which include the following e User profiles configurations Allows the user to create save apply or delete user profiles configurations e Passwords Allows the user to set a password to lock the ZXi from any configuration changes e Languages Sets the ZXi
75. to Electrostatic Discharge ESD Electrostatic discharge ESD is the sudden flow of electricity between two electrically charged objects caused by contact an electrical short or dielectric breakdown The ZClone ZXi ZXi has been designed to minimize the effects of ESD and if an ESD event occurs the unit may experience a temporary loss of functionality If this occurs please power down the ZXi and power it back up this should clear any temporary loss of functionality Logicube Forensic ZXi User s Manual 70

ZClone® Xi User`s Manual

Contents

Download Pdf Manuals

Related Search

Related Contents

ZClone&reg; Xi User`s Manual

Contents

Download Pdf Manuals

Related Search

Related Contents

ZClone® Xi User`s Manual