Imaging To Or From A Network; Hash / Verify; Step-By-Step Instructions - Drive Hash Or Case Verify - Logicube F-FALCON-SA User Manual

Hard drive forensics tool

Table of Contents

3.1.2 Imaging to or from a network

A network repository or location must be set in order for the Falcon to be able

to image to or from a network repository/location.

For details on how to add a network repository/location, please see

6.0.10

of this manual.

A hash or verify operation can be performed to any drive connected to the

Falcon. Performing a hash or verify task will instruct the Falcon to calculate the

hash for the specified drive or validate the hash value for that drive. There are

two modes available:



DRIVE HASH – This mode will hash any connected drive on an active Source or

Destination port. This mode is Logical Block Address (LBA) based and will hash drives

based on the number of LBAs. If multiple drives are selected to be hashed, the Falcon

will hash up to the LBA value of the smallest capacity drive. If drives with different

capacities need to be hashed, it is recommended to start one task per drive.



CASE VERIFY – This mode will hash cases created by the Falcon (DD, E01, Ex01) for

verification purposes. There are two settings for this mode:

o Primary – This will verify the primary hash of the image.

o Both – This will verify both primary and second hash of the image.

3.2.1 Step-by-step instructions – Drive Hash or Case Verify

Logicube Forensic Falcon™ User's Manual

Imaging speeds over a network is affected by many different

factors including (but not limited to): infrastructure, capacity,

architecture, and traffic.

QUICK START

Section

Table of Contents

Do you have a question about the F-FALCON-SA and is the answer not in the manual?

Forensic falcon