QUICK START
Logicube Falcon
®
-Neo User’s Manual 25
DRIVE HASH – This mode will hash any connected drive on an active Source or Destination port.
This mode is Logical Block Address (LBA) based and will hash drives based on the number of
LBAs. If multiple drives are selected to be hashed, the Falcon-NEO will hash up to the LBA value of
the smallest capacity drive. If drives with different capacities need to be hashed, it is
recommended to start one task per drive.
CASE VERIFY – This mode will hash cases/images created by the Falcon-NEO (DD, E01, Ex01,
DMG) for verification purposes. There are two settings for this mode:
- Primary – This will verify the primary hash of the image. Use this if only on hash value
was selected when the case was imaged.
- Both – This will verify both primary (SHA-1) and second hash (MD5) of the image. Use
this if SHA1+MD5 was used when the case was imaged.
3.2.1 Step-By-Step Instructions – Drive Hash or Case Verify
1. Select Hash from the types of operation on the left side.
2. Tap the Modes icon and select the desired mode (Drive Hash or Case Verify).
3. Tap the Drives icon and select the drive(s) to be hashed then tap the OK icon.
4. Tap the Settings icon to choose the different settings based on the Mode. Details
for every setting can be found in Section 5.2.3.
5. Change any of the optional settings (LBA settings or percentage of the drive to
be hashed) if needed.
6. Optional: Tap Case Info to set the Case/File Name, Case ID, Examiner, Evidence
ID, or Case Notes.
7. When finished, the status will show “COMPLETED”. It is recommended to tap
Reset Task to reset the task, so the drive bays properly reset and not show as
being used or assigned for other tasks.
To Next Page
Loading...
Need help?
General