Logicube Forensic Falcon User Manual

INTRODUCTION
Logicube Forensic Falcon™ User’s Manual 2
Users can browse and view directly on the Falcon display, or manage and view on a networked
Falcon from your laptop/desktop using a web browser.
 Built in support for SAS/SATA/USB/FireWire storage devices. Adapters are included with Falcon
to support 1.8”/2.5”/3.5” IDE and 1.8” ZIF and microSATA drive interfaces. Optional adapter are
available for eSATA, mSATA, and CompactFlash drives. An optional SCSI module provides
support for 1 SCSI source and 1 Destination drive.
 PCIe Support. Support for M.2 PCIe and M.2 NVMe type SSDs and mini-PCIe and PCIe express
cards is provided using an optional express card adapter combined with specific interface
adapters.
 CD/DVD/Blu-ray Imaging. The Falcon can image CD/DVD/Blu-ray media by using a USB optical
drive connected to the USB port on the Falcon. The Falcon supports multi-session CD/DVDs.
 Image to or from a network location or an external storage device. Use the Falcon to image to
a network location using CIFS protocol and/ or image from a network location using iSCSI. Users
can use iSCSI as a source or destination drive. Image to an external storage device (such as a
NAS) using the Gigabit Ethernet, USB3.0 or SAS/ SATA connection.
 Write-blocked preview/triage hard drive contents. Use the Falcon as a write-blocker. The file
browser feature provides write-blocked access to source or destination drives connected to
Falcon. View the drive’s partitions and contents and view text files, jpeg, PDF, XML, or HTML
files. File types such as .doc and .xls can be viewed by connecting Falcon to a network, download
and view on a PC. Users can also preview source or destination drives using the USB connection
from the Falcon to a computer, or by using the SMB protocol. The iSCSI protocol can be used to
preview source drives.
 Web browser. Connect to a networked Falcon from your laptop/desktop using a web browser to
manage all operations remotely. Features automatic page scaling for iPad type devices.
 Image from a desktop or laptop PC without removing the hard drive. Create a forensic bootable
USB flash drive to image a source drive from a computer on the same network without booting
the computer’s native O/S.
 Image from a MAC™ system booted in “target disk mode” using the write-blocked FireWire port
on Falcon. MACs with either FireWire or Thunderbolt ports can be connected to the Falcon, a
Thunderbolt to FireWire adapter is required.
 Multi-task. Image from multiple source drives to multiple destination drives or wipe one
destination drive while imaging to another. Perform up to five tasks concurrently.
 Parallel Imaging. Perform multiple imaging tasks from the same source drive to multiple
destinations using different imaging formats.
 Concurrent Image+Verify. The Falcon begins verification during the imaging process. Duration
of total image plus verification process time may be reduced by up to half.
 Secure sensitive evidence data with whole drive AES 256 bit Encryption. Decrypt using the
Falcon or by using open source software programs such as VeraCrypt, FreeOTFE or TrueCrypt
 Fast multi-pass wipe (DoD specifications) or use secure erase to wipe drives, wipe at speeds of
up to 27GB/min.
 Network Push feature. Push evidence files from connected destination drives or from a Falcon
repository to a network location. The Falcon performs an MD5 or SHA hash during the push
process, a log file is generated for each push process.

Logicube Forensic Falcon Specifications

General

Brand	Logicube
Model	Forensic Falcon
Category	Storage
Language	English