Logicube Falcon
®
-NEO User’s Manual 103
7: Drive Encryption and Decryption
7.0 Drive Encryption/Decryption - Introduction
The Falcon-NEO can secure sensitive evidence data with whole disk drive encryption using the NIST
recommended XTS-AES-256 cipher mode. Destination drives that are encrypted by the Falcon-NEO can
be temporarily decrypted by using the Falcon-NEO or third-party software (VeraCrypt, TrueCrypt, or
FreeOTFE).
In the System Settings screen, there is an Encryption tab used to configure the Falcon-NEO for
encryption. There are up to four (4) parameters that must be configured before encryption can be used.
These parameters are necessary to decrypt and read the Destination drive and can be configured in the
Encryption page on the Falcon-NEO:
Cipher Mode – Users can choose between TC-XTS, CBC, ECB, or VCRYPT cipher modes.
VCRYPT cipher mode can be decrypted
using the Falcon-NEO or VeraCrypt.
TC-XTS cipher mode can be decrypted
using the Falcon-NEO or TrueCrypt.
CBC or ECB cipher modes can be decrypted
using the Falcon-NEO or FreeOTFE.
The Falcon-NEO encrypts drives using AES-256 encryption regardless
of what cipher mode is used. If TC-XTS is used, Falcon-NEO uses a
TrueCrypt friendly format and does not use TrueCrypt to encrypt the
drive. The encryption key is not stored on the Destination drive.
Cipher – At this time, only the AES-256 cipher is supported.
IV Generation – Initialization Vector. Unavailable when VCRYPT or TC-XTS cipher mode is
selected. If CBC or ECB cipher mode is selected, users can choose between PLAIN64 and
ESSIV:SHA256.
Encryption (Password or Key) – Users must choose their own encryption password/key.
Remember the password used to encrypt the
Destination drive! Logicube cannot retrieve or
unlock the encrypted drive without the password.
7.1 Encrypting a Destination
To encrypt a Destination, the Encryption settings must be set, then the drive will need to be formatted
using the Falcon-NEO. These steps must be performed prior to an Imaging operation.