QUICK START
Logicube Forensic Falcon™ User’s Manual 21
3.1.2 Imaging to or from a network
A network repository or location must be set in order for the Falcon to be able
to image to or from a network repository/location.
For details on how to add a network repository/location, please see Section
6.0.10 of this manual.
Imaging speeds over a network is affected by many different
factors including (but not limited to): infrastructure, capacity,
architecture, and traffic.
3.2 Hash / Verify
A hash or verify operation can be performed to any drive connected to the
Falcon. Performing a hash or verify task will instruct the Falcon to calculate the
hash for the specified drive or validate the hash value for that drive. There are
two modes available:
DRIVE HASH – This mode will hash any connected drive on an active Source or
Destination port. This mode is Logical Block Address (LBA) based and will hash drives
based on the number of LBAs. If multiple drives are selected to be hashed, the Falcon
will hash up to the LBA value of the smallest capacity drive. If drives with different
capacities need to be hashed, it is recommended to start one task per drive.
CASE VERIFY – This mode will hash cases created by the Falcon (DD, E01, Ex01) for
verification purposes. There are two settings for this mode:
o Primary – This will verify the primary hash of the image.
o Both – This will verify both primary and second hash of the image.
3.2.1 Step-by-step instructions – Drive Hash or Case Verify
To Next Page
Loading...
Need help?
General
