• Forensic hardware appliance mainboard for evidence acquisition or inspection workflows.
• Single PCB reused across portable and desktop enclosure variants.
• Prototype / architecture-definition stage.
• Evidence-integrity behavior is a primary design requirement; any write-block feature must fail closed and be validated before use with evidence.

• Power from industry-standard PoE or from a USB-C female power-only input.
• Run a Raspberry Pi Compute Module 4 or 5 class compute module for UI, logging, networking, storage workflows, hashing, malware/BadUSB scanning, and device control.
• Accept a USB Type-A port for external USB storage/evidence devices.
• Prevent host-side writes from modifying attached evidence media.
• Provide a hardware/firmware-controlled write-blocking architecture rather than relying only on the Pi OS mount mode.

• Raspberry Pi Compute Module direction: CM5 preferred if sourcing and carrier-board requirements are stable; CM4-compatible fallback remains open.
• IEEE 802.3at PoE+ module power input target.
• USB-C female connector configured as 5 V power input only, no USB data.
• External connector set now includes: USB-C power input, USB 3.x Type-A suspect/evidence input, micro-HDMI output target, 3-pin JST-XH LED/status harness, and RJ45 PoE/Ethernet input.
• Protected power-path ORing between PoE-derived 5 V and USB-C 5 V input.
• USB evidence interface handled by an Olimex iMX8MP-SOM-4GB-IND write-block front end; the STM32H753 + USB3300 USB2 prototype path is superseded.
• Internal Gigabit Ethernet switch connecting external RJ45/PoE Ethernet, Raspberry Pi, and the write-block front end; selected switch IC is Microchip KSZ9893RNXC-TR.
• Forensic logging, read-only policy enforcement, device identification, and blocked-command logging expected in later firmware/system design.

Diagram

• PoE target: IEEE 802.3at PoE+ using a prebuilt PoE PD power module.
• USB-C target: power-only sink input.
• Main rail: 5V_SYS distributed to the Pi module and downstream circuits.
• Power-path requirement: PoE and USB-C inputs must not back-feed each other.
• Protection expected: input fuse/current limiting, TVS on exposed inputs, reverse/backfeed protection, test points for bring-up.

• Raspberry Pi Compute Module class compute section.
• CM5 preferred if practical; CM4-compatible path remains a fallback.
• Pi role: UI, logging, hashing, control plane, network services, malware/BadUSB scanning workflow, and report generation.
• The Pi should not directly mount or own the suspect USB device.

• Ethernet architecture decision: use an internal Gigabit Ethernet switch.
• Selected switch IC: Microchip KSZ9893RNXC-TR, a 3-port Gigabit Ethernet switch suitable for the external RJ45/PoE, Raspberry Pi, and STM32MP257/write-block front-end topology.
• The switch connects the external RJ45/PoE Ethernet path and the Raspberry Pi Compute Module; final SOM switch/API involvement is TBD after the Olimex connector pinout is captured.
• The Pi-to-write-block API/data path runs over a private subnet or VLAN on the internal switch.
• Include Ethernet ESD/magnetics strategy based on the selected MagJack, PoE module, PHY/switch, and Compute Module requirements.
• The write-block API should remain appliance-internal unless the software configuration explicitly exposes a controlled service.
• KSZ9893 verified requirements: AVDDL/DVDDL require 1.2 V nominal rails; AVDDH supports 3.3 V or 2.5 V; VDDIO supports 3.3 V, 2.5 V, or 1.8 V depending on host interface voltage.
• KSZ9893 clocking: requires a 25 MHz reference on XI, using either a 25 MHz crystal between XI/XO with load capacitors or a 2.5 V oscillator into XI with XO left floating; crystal tolerance target is ±50 ppm.
• KSZ9893 management: controller assignment must be revisited after the Olimex SOM connector pinout is captured. The previous STM32MP257/STM32H753 management wiring is superseded.
• KSZ9893 port model: ports 1 and 2 are integrated 10/100/1000BASE-T PHY ports; port 3 is the configurable host MAC interface supporting RGMII/MII/RMII, with RGMII needed for 1000 Mbps.
• KSZ9893 support parts: ISET must connect to GND through 6.04 kΩ 1% resistor; RESET_N needs POR/reset circuit; exposed pad must connect to GND via field; PHY-side transformer center taps need separate 0.1 µF common-mode capacitors to GND and must not be tied to a supply.

• No battery requirement has been confirmed yet, despite portable enclosure use.
• Design currently targets external powered operation: PoE or USB-C.
• If portable battery operation is added later, charger, pack protection, fuel gauge, and runtime budget must be added.

Diagram

• Prototype first.
• PoE module approach selected to reduce risk versus a fully discrete PoE PD supply.
• Board stackup baseline is now 8-layer controlled-impedance: L1 signal, L2 solid GND, L3 signal, L4 power, L5 solid GND, L6 signal, L7 solid GND, L8 signal.
• USB 3.x, HDMI, Gigabit Ethernet, DDR4, eMMC, QSPI, and Pi microSD routing require controlled impedance and continuous ground-reference planes.
• External connectors should be mechanically robust and placed for both portable and desktop enclosure access.

• If STM32MP257 remains in the design, provide boot media, DDR memory, PMIC/power sequencing, debug UART/JTAG/SWD as applicable, reset, clocks, and firmware recovery access; do not use a dedicated STM32 microSD slot unless later requested.
• Write-block firmware must enforce read-only behavior at the command layer, not just mount filesystems read-only.
• Pi Python3 malware/BadUSB scanning software must access the suspect device only through the internal-switch Ethernet API/data service.
• Logging should capture attached-device descriptors, serial/capacity where available, write attempts blocked, firmware version, timestamps, and acquisition state.
• Pi firmware/software should treat the write-block subsystem as the trusted boundary, not as a simple USB pass-through.
• BadUSB detection should include descriptor/interface analysis, especially HID keyboard, network adapter, serial adapter, and suspicious composite-device behavior.

• Single universal PCB for both portable and desktop enclosure variants.
• Board outline, mounting holes, connector edge locations, display/front-panel connections, cooling, and service-access needs are TBD.
• USB Type-A suspect input, USB-C power input, RJ45 PoE/Ethernet, micro-HDMI output, Pi CM5 microSD slot, 3-pin JST-XH LED/status header, and debug/service connectors should be placed on accessible edges.

• Use a PoE module rather than a discrete PoE PD converter.
• Use USB-C as power-only input.
• Use protected ORing/power muxing between PoE-derived 5 V and USB-C 5 V.
• Treat STM32H753 + USB3300 as a superseded USB2-only prototype path.
• Use Olimex iMX8MP-SOM-4GB-IND for USB3-capable evidence ingestion, with Controller 1 as fixed HOST and Controller 2 as fixed DEVICE/peripheral.
• Use an internal Gigabit Ethernet switch as the network fabric between external Ethernet/PoE, the write-block front end, and the Raspberry Pi.
• Use Microchip KSZ9893RNXC-TR as the first-choice internal Gigabit Ethernet switch IC.
• The Pi should not know or care that a USB device is physically attached; it talks to a service endpoint for read-only scan data and metadata.
• Keep only one microSD slot: J7 for the Raspberry Pi CM5 to read. The earlier STM32MP257 microSD recovery slot was removed.
• Use 8-layer controlled-impedance PCB stackup as the baseline; 6-layer is considered too risky for DDR4 + USB3 + HDMI + Gigabit Ethernet on this board.

• “Industry standard PoE” means IEEE 802.3at PoE+ unless corrected.
• USB-C input is 5 V sink only, no USB data and no USB PD unless later requested.
• Portable enclosure does not yet imply battery operation.
• The current project is not yet suitable for evidentiary/legal use until the write-block function is validated.

• Confirm CM4 or CM5 target.
• Source or create the exact Micro-HDMI Type-D or Mini-HDMI Type-C receptacle footprint/symbol, or decide to use a full-size HDMI connector instead.
• Define the 3-pin JST-XH LED header pinout and whether the external LEDs are simple discrete LEDs, RGB LED strip, addressable LEDs, or enclosure status board inputs.
• Attach/clone verified Amphenol Minitek127 connector footprints for the Olimex SOM connector set: 20021121-00040T4LF for GPIO1/2/3/5/6 and 20021121-00020T4LF for GPIO4; verify terminal-to-pad numbering and pin-1 orientation against the Olimex EVB before layout.
• Confirm Olimex SOM pinout for USB1/USB2 SuperSpeed pairs, USB1_ID GPIO1_IO10, USB2_ID GPIO1_IO11, VBUS sense/source pins, and available GPIOs for THREAT/MEDIA_READY.
• Verify KSZ9893RNXC-TR power rails, clocking, strapping, management interface, PHY/interface mode, and VLAN/private-subnet strategy from the datasheet.
• KSZ9893 management controller decision is reopened because the STM32 path has been removed; decide whether the Pi, Olimex SOM, or fixed straps configure the switch.
• Decide whether UASP must be supported or intentionally disabled/blocked.
• Define enclosure dimensions, mounting points, and connector locations.
• Add the Raspberry Pi CM5 connector/module block and wire J7 microSD nets to the CM5 SD interface pins.
• Define any display, buttons, storage, fan, battery, RTC, secure element, or tamper inputs.

• Architecture pivot: selected a USB2-only STM32H753 prototype for the write-block front end to reduce cost and remove external DDR. Removed STM32MP257, STPMIC25, DDR4, eMMC, QSPI NOR, and associated passives from the schematic. Added U2 STM32H753ZIT6 and wired the USB-A evidence connector's USB2 D+/D− path through ESD protection to the STM32H753, with STM32-controlled evidence VBUS switching.
• Initial user direction: single forensic-device mainboard for portable and desktop enclosures.
• Added Raspberry Pi CM4/CM5 direction.
• Added PoE module power and USB-C power-only input.
• Added USB 3.0 Type-A evidence input and STM32H753 write-block concept.
• Added feasibility warning: STM32H753 supports USB 2.0 FS/HS only, not USB 3.x SuperSpeed bridging.
• Added STM32MP257-class USB3-capable write-block front-end direction.
• Selected internal Gigabit Ethernet switch architecture for external Ethernet/PoE, Pi, and STM32MP257/write-block API traffic.
• Selected Microchip KSZ9893RNXC-TR as the internal Gigabit Ethernet switch IC.
• Added STM32MP257 support architecture baseline: STPMIC25APQR PMIC, 2x DDR4 SDRAM, eMMC, QSPI NOR, and microSD recovery connector. See the dedicated STM32MP257 Power Memory Architecture project file for details.
• Added external connector requirements and provisional schematic parts: J2 USB-C power input, J3 USB 3.x Type-A evidence input, J4 JST-XH 3-pin LED/status header, and J5 PoE RJ45 MagJack; micro-HDMI or mini-HDMI remains a sourcing/open footprint item, with full-size HDMI available only as a fallback if approved.
• Added J7 as the single microSD slot for Raspberry Pi CM5 access and removed the earlier STM32MP257 recovery microSD connector J1 to avoid duplicate card slots.
• Configured the PCB for an 8-layer high-speed stackup and marked current eMMC, QSPI, and Pi CM5 microSD nets as controlled-impedance/high-speed groups. USB3, HDMI, Ethernet, and DDR signal-pair constraints still need to be added after those nets are wired.
• Architecture pivot: selected Olimex iMX8MP-SOM-4GB-IND as the active USB3 write-block intake controller and removed/marked obsolete the STM32H753 + USB3300 ULPI prototype path. The existing imported BH40S/BH20S connector entries have 0 terminals and must be repaired/reimported before the SOM can be wired.