A New Standard in Digital Forensics The Fastest Forensic Imaging

A New Standard in Digital Forensics
The Fastest Forensic Imaging Solution
Available
Image and verify from 4 source drives to
5 destinations
Fast forensic imaging at 20GB/min
Image to or from a network location
ulti-task. Perform image, wipe, hash tasks
M
concurrently
arallel imaging. Image the same source drive
P
to multiple destinations using different imaging
formats
eb-based user interface. Allows remote access
W
using a web browser
Without exception, the fastest and most technologically advanced forensic imaging solution available.
Feature-packed, power-rich performance in a space-saving footprint that provides expandability to meet future
technology advances. This unparalleled solution is designed for demanding forensic imaging tasks and sets a new
standard of excellence in digital forensic data imaging solutions.
F E AT U R E S
­n The Falcon is the fastest forensic imaging
solution available, with imaging speeds of
20GB/min*. Meets future hard drive speed
improvements with SAS/SATA-3 6GB/s maximum
rated speed of 37GB/min.
­n Image and verify to multiple image formats;
native copy, dd image, e01, ex01 and file-based
copy. E01 features user-selectable compression
levels. Uses SHA1, SHA256 or MD5 authentication
­n Supports EXT4 or NTFS destination file format
­n Multiple imaging ports. Write-protected source
ports include 2 SAS/SATA, 1 USB 3.0, 1 Firewire.
Destination ports include 2 SAS/SATA, 2 USB
3.0 and 1 Firewire. A Gigabit Ethernet port for­
network Connectivity is available. USB source
and destination can be converted to SATA using a
USB to SATA converter.
­n Image
to or from a network location. Use the
Falcon to image to a network location using CIFS
protocol and/or image from a network location­
using iSCSI. Users can use iSCSI as a source or­
destination drive.
­n Use a web browser to manage all operations
remotely. Easily connect to a networked Falcon­
­
www.logicube.com
from your laptop or desktop using a web browser.
The interface features automatic page scaling for
iPad type devices.
­n Image from a desktop or laptop PC without removing the hard drive. Create a forensic bootable USB
flash drive that allows the user to image a source
drive from a computer on the same network without­
booting the computer’s native operating system.
It also allows drives connected to the networked
computer (or directly connected to each other using
a network cable) to appear as a destination drive
without removing the drive from the computer.
­n Image from a MAC™. Image from a MAC™
system booted in “target disk mode” using the
write-blocked Firewire port on Falcon. The MAC’s
internal drive is seen as a “source” drive. MACs
with either Firewire or Thunderbolt ports can be
connected to the Falcon, a Thunderbolt to Firewire
adapter is required.
n Multi-task.
Shorten the evidence collection
process with the ability to wipe one­
destination drive while imaging to another, or­
image from multiple source drives to multiple­
destinations. Perform up to five tasks concurrently.
­n P arallel Imaging. Perform multiple imaging
tasks from the same source drive to multiple­
19755 Nordhoff Place, Chatsworth, CA 91311 U.S.A.
Toll-free (in U.S. only): 888.494.8832 n Tel: 818.700.8488 n Fax: 818.700.8466
destinations using different imaging formats.
Clone to a network location or a destination drive in
mirror copy format while simultaneously imaging
in e01 or dd format to a different destination drive
­n Concurrent Image+Verify (patent-pending). The
Falcon takes advantage of destination drives
that are faster than the source drive and begins­
verification while the imaging process is occurring.
Duration of total image plus verification process
time may be reduced by up to half.
support
for
SAS/SATA/USB/FW
storage devices. Adapters are included with­
Falcon to support 1.8”/2.5”/3.5” IDE and 1.8”ZIF
and microSATA drive interfaces. Optional adapters
are available for eSATA, mSATA and compact flash
drives. An optional SCSI module provides support
for 1 SCSI source and 1 destination drive.
n Built-in
­n The Falcon can perform a forensic, filter-based file
copy. Filter and then image specific file types by file
extension such as .PDF, .doc, .jpeg, .mov, etc.
­n Secure sensitive evidence data with whole drive
AES 256 bit Encryption. Decryption can be
performed using the Falcon or by using open
source software programs such as FreeOTFE or
TrueCrypt.
A New Standard in Digital Forensics
The Fastest Forensic Imaging Solution
Available
F E AT U R E S c o n t ’ d
­n Multi-pass wipe (DoD specifications) or use
secure erase to wipe drives.
­n T he Network Push feature allows the user to
push evidence files from destination drives­
connected to the Falcon or from a Falcon­
repository, to a network location. A more secure
method than simply copying and pasting to the
analysis computer, the Falcon performs an MD5
or SHA hash during the push process. Users
can also verify the file transfer to insure data­
integrity. Network users can then quickly­
preview data or copy data to a local drive or to
any other directory on the network. The Falcon
generates a log file for each push process.
n Image
to an external storage device (such as a
NAS) using the Gigabit Ethernet, USB 3.0 or SAS/
SATA connection.
­n Supports Drive Spanning. Image from one
large capacity hard drive to two or more smaller­
capacity drives.
drive. Four cluster size settings are provided to­
determine number of sectors to be skipped when
a bad sector is found on the source drive.
source ports. All source ports
are write-blocked. Use the Falcon as an external­
write-blocker (via the USB 3.0 device port) for­
secure drive preview/image transfer.
­n Audit Trail/Log files provide detailed information
on each operation. Log files can be viewed on
Falcon or via a web browser, exported to XML,
HTML or PDF format to a USB enclosure. Users
can print the log files directly from their PC when
connected to Falcon via a web browser.
n Write-protected
­n Drive “time-out” feature sets a specific time-
out for hard drives connected to Falcon. After a
specified amount of idle time the drive will be
automatically put into standby mode, powering
down the drives
­n Tasks Macro feature. Set specific tasks to be
performed sequentially, for example, first wipe
the destination drive then hash the source drive
then image the source drive. Set-up your Macro,
press start and all tasks within the Macro will be
performed automatically.
­n Drive trim feature. Allows the Falcon to
manipulate the DCO and HPA area of the­
destination drive so that the destination drive’s
total native capacity matches the source drive.­
­n Set password-protected user profiles and
save configurations. A convenient administrative­
function provides the ability to create profiles with
default settings.
n Additional
­n Features an internal, removable storage drive
that stores O/S and audit trail/logs. The drive is
easily removed for secure/classified locations. ­n Error Granularity Setting. Users have more
features include HPA/DCO capture,
drive spanning, large 7” color touch screen­
display, on-screen keyboard, two USB 2.0­
host ports for keyboard, mouse or printer­
connectivity, and an HDMI port to connect a­
projector or monitor.
control over error handling on the source
*The falcon achieves 20GB/min imaging speed using solid state drives in native copy and in e01/Ex01 image format. Your results may vary depending on the specification and condition of the hard drive
used as well as the mode, image format and settings used during the imaging process.
In The Box
The following items are included with the Forensic Falcon:
­n Power supply & power cord
­ 1 Firewire cable
n
­ 1 CAT6 network cable
n
­ 4 SAS/SATA cables
n
­ 1 USB 3.0 type A cable
n
­n 1 USB 3.0 device cable
­ 1.8” microSATA adapter
n
­ 1.8” IDE ZIF to SATA adapter
n
­ 2.5”/3.5” IDE to SATA adapter
n
­ 1.8” IDE to SATA adapter
n
­n 4 6-pin SATA power plugs
­ 1 USB A female to USB mini-B 5 pin male adapter
n
­ 1 USB A female to micro B male converter coupler adapter
n
­ CD-ROM with software & users’ manual
n
­ Carrying case
n
O ptions
The following options are available for the Forensic Falcon:
­n SCSI Module provides 1 write-protected source port and
­n 80-pin SCSI adapter for use with SCSI Module
1 destination port. Built-in support for 68-pin SCSI drives ­n eSATA cable
­ 50-pin SCSI adapter for use with SCSI Module
n
­n mSATA adapter
­n Flash Media Reader for compact flash cards,
SD cards and other flash media
­n USB 3.0 to SATA Adapter
­ USB 3.0 4-port Hub
n
S P E C I F I C AT I O N S
Power Requirements
Power
Consumption
Operating Temperature
Relative
Humidity
12 VDC < 140W with drives
0 to 40°C 20% to 80%
12 Amp
(32 to 104°F)
www.logicube.com
Net
Dimensions
Weight
Agency
Approvals
2.4lbs/1.09k 8.5” W X 3” H X6.25” D 9lbs/4.3k with
21.6cm X 7.6cm X15.9cm
case & shipping box
RoHs compliant FCC Part 15 Class A
CE
19755 Nordhoff Place, Chatsworth, CA 91311 U.S.A.
Toll-free (in U.S. only): 888.494.8832 n Tel: 818.700.8488 n Fax: 818.700.8466