Logicube Forensic Falcon User Manual

TYPES OF OPERATIONS
Logicube Forensic Falcon™ User’s Manual 60
d. File to Drive – Restores DD, E01, EX01 images created by the Falcon to another
drive
Details on the different screens found in the Imaging operation can be found in Chapter
5: Imaging.
2. HASH/VERIFY – Perform a SHA1, SHA-256, or MD5 hash of a drive or verifies a case’s
(image) file hash.
3. WIPE/FORMAT – This type of operation is used to erase, wipe, and/or format drives.
There are three main settings:
 Secure Erase – Sends a command to the drive instructing it to perform a secure
erase based on the drive manufacturer’s specifications.
 Wipe Patterns – Allows the user to set a specific pattern to use for wiping the
drive. The number of passes is customizable (up to 7 passes) along with the type
of data written for each pass. In addition, a 7-pass DoD wipe can be set.
 Format – Formats the Destination using the EXT4 file system or NT file system
(NTFS) either with or without AES-256 encryption.
4. PUSH – The network Push feature gives users the ability to push evidence files from
destination drives connected to the Falcon or from a Falcon repository to a network
location. The Push feature provides a more secure method than simply copying and
pasting to the analysis computer by performing an MD5 or SHA hash during the push
process. Additionally users can select to verify the file transfer to ensure data integrity.
Network users can then quickly preview data or copy data to a local drive or to any
other directory on the network. The Falcon will create a log file for each push process.
5. TASK MACRO – Set up to nine (9) different tasks to perform sequentially (one after
another). For example, a macro can be set to perform these tasks in order: Wipe, image,
hash, push, then wipe again.
6. USB DEVICE – Allows the user to view the contents of any drive connected to the Falcon
from a computer connected via USB. When using this type of operation, all drives
connected to the Falcon are write-protected.
7. FILE BROWSER – Preview the contents of all connected Source or Destination drives on
the Falcon. The Falcon will show all viewable partitions and the contents of each
partition.
8. LOGS – Display logs of each task that has been performed on the Falcon.
9. STATISTICS – This will display information about the Falcon including the current
software installed. In addition, the Statistics screen has an Advanced Drive Statistics tab
that shows raw S.M.A.R.T. data on any drive connected to the Falcon.
10. MANAGE REPOSITORIES – Allows the user to add a network location as a repository
that can be used as a Destination for imaging or pushing images (or a Source when using
the File to File mode).
11. SYSTEM SETTINGS – This mode allows changes to the system settings on the Falcon
which include the following:

Logicube Forensic Falcon Specifications

General

Brand	Logicube
Model	Forensic Falcon
Category	Storage
Language	English