Logicube Falcon-NEO User Manual page 13

Concurrent Image+Verify. Imaging and verifying concurrently takes advantage of destination

hard drives that may be faster than the source hard drive. Duration of total image+verify process
time may be reduced by up to half.
BitLocker Support. Image source drives that have been encrypted using BitLocker. Decrypt

partitions (requires the BitLocker password) and then image the selected partitions.
Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST

recommended XTS-AES-256 cipher mode. Decryption can be performed using the Falcon-NEO
or by using open source software programs such as VeraCrypt, TrueCrypt or FreeOTFE.
Network Push Feature. Push evidence files from destination drives connected to Falcon-NEO or

from a Falcon-NEO repository to a network location. An MD5 or SHA hash is performed during
the push process.
Image from a Mac® computer with USB-C ports using a USB-C to USB-A cable and Target

Disk Mode. Users can also image from Mac computers using Logicube's USB boot device. Create
a forensic bootable USB flash drive to image a source drive from a Mac on the same network
without booting the Mac computer's native OS. The Falcon-NEO supports imaging from
MacBook Pro® systems.
Image from a PC/laptop without removing hard drives. Create a forensic bootable USB flash

drive to image a source drive from a computer on the same network without booting the
computer's native OS. Supports Surface Pro 4 and above tablets.
Reverse Read settings instructs the Falcon-NEO to skip past a bad sector (based on error

granularity settings) then read backwards, potentially capturing data that may not necessarily be
read when skipping the entire block.
Image Restore. File to drive mode restores DD, DMG, E01, EX01 images created by the Falcon-

NEO to another drive.
Remote Operation. Connect to a networked Falcon-NEO from your PC using a web browser to

manage all operations remotely. This feature provides automatic page scaling for iPad type
devices and authentication/password for increased security.
Features an internal, removable storage drive that stores OS and audit trail/logs. The drive is

easily removed for secure/classified locations.
Wipe drives to DoD specifications or use secure erase to wipe drives. Speeds of 30GB/min for

SATA type drives and 72GB/min for PCIe drives.
Audit Trail/Log files provide detailed information on each operation. Log files can be viewed on

Falcon-NEO or via a web browser, exported to XML, HTML or PDF format to a USB enclosure.
Users can print the log files directly from their PC when connected to Falcon-NEO via a web
browser.
Additional features include HPA/DCO capture, save configuration settings and set password-

protected user profiles, image from CD/DVD/Blu-Ray media, drive spanning, color touchscreen
display, HDMI port, USB 3.0 ports can be used for keyboard, mouse, or printer connectivity, blank
disk check feature, drive trim feature, and S.M.A.R.T. data.
* The Forensic Falcon-NEO achieves speeds surpassing 50GB/min using solid state "suspect" drives that contain a freshly installed
Windows "X" OS and random data. Settings used are e01/ex01 image format, with compression and with verify "on". The
specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging
process may affect the achieved speeds.
®
-Neo User's Manual
Logicube Falcon
GETTING STARTED
3