A Future-Focused, Next-Generation Digital Forensic Imager. Unmatched Performance Designed to Streamline Evidence Collection Processes

A future-focused, next-generation digital forensic imager. Unmatched performance designed to streamline evidence collection processes

Extremely fast forensic imaging speed surpassing 50GB/min. Clone PCIe to PCIe at speeds of 69GB/min Image and verify from 4 source drives to 6 destinations for ultra-efficient imaging Targeted Imaging feature creates a logical image to capture only specific files needed and shorten acquisition time. Use Partition Imaging feature to select and image specific partitions on the source drive Concurrent Image+Verify feature. Verification begins while the imaging process is occurring. Duration of total image plus verification process time may be reduced by up to half Image to or from a network location using two 10GbE connections for fast network imaging performance Network capture. Capture network traffic, VOIP, internet activity Multi-task. Image from multiple sources simultaneously. Little or no speed degradation when imaging from two sources to two destinations The next-generation of our ground-breaking Falcon® forensic imager, the Falcon®-NEO has been engineered specifically for digital forensic investigations. Delivering high performance and advanced features, the Falcon-NEO is designed to meet the challenges of digital investigations head-on. Efficient and secure digital evidence collection is accomplished with a feature-set that provides sophisticated functionality with a goal to shorten acquisition time. Future-focused, the Falcon-NEO sets new standards in digital forensic imaging technology.

FEATURES

n The Falcon®-NEO is an extremely fast forensic n Networking Feature. Use the Falcon-NEO to to a network location or a destination drive using imaging solution. It achieves imaging speeds image to a network location using CIFS protocol mirror copy mode while simultaneously imaging in surpassing 50GB/min and can clone PCIe to PCIe and/or image from a network location using iSCSI. e01 or .dd format to a different destination drive. at speeds of 69GB/min. Users can use iSCSI as a source or destination drive. n Targeted Imaging/Logical Imaging feature n Image and verify to multiple image formats; Image to an external storage device such as a NAS, shortens acquisition time. Create a logical native copy, .dd image, .dmg image, e01 and ex01. using the Gigabit Ethernet, USB 3.0 or SAS/SATA image by using pre-set filters, custom filters, file The Falcon-NEO provides MD5, SHA1, SHA256, connection. signature filters, and/or keyword search function and dual hash (MD5+SHA1) authentication at n Network Capture. Capture network traffic, to select and acquire only the specific files you extremely fast speeds. internet activity and VOIP. Sniff data on a need. An MFT report can be generated that n Falcon-NEO formats destination drives to NTFS, network and store captured packets on a hard contains a potential deleted file list. Format output exFAT, EXT4, or FAT32 file systems. The unit drive connected to Falcon-NEO. to LX01, ZIP or directory tree. Users can browse supports imaging from source drives formatted to n Multi-Task. Image simultaneously from and view directly on the Falcon-NEO display, or any major file system. multiple sources to multiple destinations manage and view on a networked Falcon-NEO from your laptop/desktop using a web browser. n Four Write-blocked source ports include 2 SAS/ including a network repository. Supports SATA, 1 USB 3.0, 1 PCIe. Six Destination ports imaging to one location while simultaneously n Partition Imaging. Select and image specific include 2 SAS/SATA, 2 SATA, 1 USB 3.0 and 1 PCIe. hashing and/or wiping a second drive. Users partitions on the source drive. All destination ports are built-in to the unit, no can perform up to 5 tasks concurrently. Little n Write-Blocked Drive Preview. Preview drive additional module or bay attachments required. or no speed degradation when imaging from contents directly on the Falcon®-NEO. The file two sources to two destinations. n Two 10GbE network ports provide state-of-the-art browser feature provides logical access to source connectivity for fast network imaging performance. n Task Macro. Set specific tasks to be performed or destination drives connected to Falcon-NEO. sequentially; first wipe the destination drive then Users can view the drive’s partitions and contents n I/O card ports. Designed for the future, the hash the source drive then image the source drive. and view text files, jpeg, PDF, XML, HTML files. Falcon-NEO includes 2 source I/O card ports All tasks within the Macro will be performed au- Other methods to preview include using the file and 1 destination I/O port to support new tomatically. browser feature and Falcon-NEO’s web browser on interface technologies as they arrive on the n Parallel Imaging. Perform multiple imaging a PC/laptop or preview over a network via SMB or market. Thunderbolt/USB 3.1 Gen 2/USB-C iSCSI (as an iSCSI target). 3rd party analysis tools I/O card planned for Q4 2018. tasks from the same source drive to multiple destinations using different imaging formats. Clone can be used with SMB or iSCSI methods.

Toll-free (in U.S. only): 888.494.8832 n Tel: 818.700.8488 n Fax: 818.700.8466 www.logicube.com A future-focused, next-generation digital forensic imager. Unmatched performance designed to streamline evidence collection processes

FEATURES cont’d

n Broad interface support. The Falcon-NEO provides n Network Push Feature. Push evidence files n Administrative feature allows users to save built-in support for SAS/SATA/USB3/PCIe storage from destination drives connected to Falcon-NEO configuration settings and set password-protected devices including solid state drives. PCIe drives or from a Falcon-NEO repository to a network user profiles. require an optional adapter kit. mSATA, microSATA location. An MD5 or SHA hash is performed during n and eSATA drives are supported with adapters the push process. Features an internal, removable storage drive that included with the unit. IDE drives, and flash drives stores O/S and audit trail/logs. The drive is easily n Image from a MAC with USB-C ports using a removed for secure/classified locations. are supported with optional adapters. Support for USB-C to USB-A cable and Target Disk Mode. SCSI devices will be available with an optional Users can also image from MACs using Logicube’s n Image from a CD/DVD Blu-Ray. The Falcon-NEO module available in early summer 2018. USB boot device. Create a forensic bootable USB can image CD/DVD/Blu-ray media by using a USB n PCIe Support. Support for imaging to/from M.2 flash drive to image a source drive from a MAC optical drive connected to the USB port on the PCIe (SATA, AHCI, and NVME types), PCIe and on the same network without booting the MAC’s Falcon-NEO. Supports multi-session CD/DVDs. mini-PCIe express cards is available using the native O/S. The Falcon-NEO supports imaging from n Wipe drives to DoD specificationsor use secure Falcon-NEO’s 4-lane PCIe source and destination MacBook Pro systems. erase to wipe drives. Speeds of 30GB/min for SATA ports and optional adapters. n Image from a PC/laptop without removing hard type drives and 72GB/min for PCIe drives. n Concurrent Image+Verify. Imaging and verifying drives. Create a forensic bootable USB flash drive n concurrently takes advantage of destination hard to image a source drive from a computer on the Audit Trail/Log files provide detailed information drives that may be faster than the source hard same network without booting the computer’s on each operation. Log files can be viewed on drive. Duration of total image+verify process time native O/S. Supports Surface Pro 4 and above Falcon-NEO or via a web browser, exported to XML, may be reduced by up to half. laptops. HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when n BitLocker Support. Image source drives that have n Image restore feature. File to drive mode connected to Falcon-NEO via a web browser. been encrypted using BitLocker. Decrypt partitions restores DD, DMG, E01, EX01 images created by the (requires the BitLocker password ) and then image Falcon-NEO to another drive. n Quiet Operation. The Falcon-NEO has been the selected partitions. designed to minimize noise during operations n Remote Operation. Connect to a networked Falcon- n Secure sensitive evidence data with whole NEO from your PC using a web browser to man- n Additional features include HPA/DCO capture, drive AES 256 bit Encryption. Decryption can be age all operations remotely. This feature provides drive spanning, color touchscreen display, HDMI performed using the Falcon-NEO or by using open automatic page scaling for iPAD type devices and port, two USB 3.0 host ports for keyboard, mouse source software programs such as VeraCrypt, authentication/password for increased security. or printer connectivity, blank disk check feature, TrueCrypt or FreeOTFE. drive trim feature, and S.M.A.R.T. data.

*The Forensic Falcon-NEO achieves speeds surpassing 50GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.

OPTIONS

n SCSI Module. Available in early summer, 2018, the module n USB 3.0 4-port hub n 18” extended length SAS/SATA cable set provides 1 write-blocked source or destination port. Built in n USB 3.0 to SATA adapter allows you to connect n Extended 1 year and 2 year warranties support for 68-pin SCSI drives SATA drives to the USB 3.0 ports n Hard case (Pelican type) n PCIe adapter kit. Includes adapters for M.2 PCIe, M.2 SATA, n 2.5”/3.5” IDE , 1.8” IDE to SATA, 1.8” ZIF adapters M.2 NVMe, mSATA, PCIe and mini-PCIe cards n Flash media reader

IN THE BOX The Falcon-NEO is shipped in a soft-sided carrying case that includes: n Power supply & US power cord n eSATA to SATA cable (18”) n 6 6-pin SATA power plugs for eSATA drives n 6 SAS/SATA data & power cables n mSATA to SATA adapter n Users’ manual on CD-ROM n 2 CAT7 network cables n microSATA adapter

SPECIFICATIONS

Power Power Operating Relative Net Dimensions Agency Requirements Consumption Temperature Humidity Weight Approvals

12 VDC, grounded, < 200W with drives 0 to 40°C 20% to 80% 3.0lbs/1.36k 10” X 6.75” X 3.25” RoHs compliant 21 AMP (32 to 104°F) 25.4cm X17.1cm X 8.2cm FCC Part 15 Class A CE PENDING

Toll-free (in U.S. only): 888.494.8832 n Tel: 818.700.8488 n Fax: 818.700.8466 www.logicube.com