Name: Logicube Falcon-NEO
Brand: Logicube
Rating: 4 (1 reviews)

To Next Page

To Previous Page

QUICK START

Logicube Falcon

-Neo User’s Manual 16

3.1 Imaging

This type of operation allows the imaging of a Source drive to one or more

Destinations. There are six (6) different imaging modes and several settings to choose

from. These selections should be performed in order from left to right.

Details on the different screens

found in the Imaging operation can

be found in Chapter 4: Imaging.

DD, E01, EX01, and DMG files created on the Destination may be smaller than the

selected Segment size. For example, if 4GB segment size selected, some files may

be less than 4GB. This occurs when there is a lot of blank space on the Source drive.

 Drive to File – Images the Source to any of the following image output file formats: DD, E01,

EX01, or DMG. Compression is available for E01 and EX01 formats.

 File to File - (Targeted Imaging feature) – The Falcon-NEO can shorten acquisition time by

creating a logical image by using pre-set filters, custom filters, files signatures filter, and/or

keywords search function to select and acquire only the specific files needed. Output formats

available are: Directory tree, MFT report, L01 archive, LX01 archive, and ZIP archive. The MFT

report contains a list of deleted files (if present) that can potentially be restored or recovered.

 Partition to File (Logical Imaging) – Images one partition from the Source drive to any of the

following image output file formats: DD, E01, EX01, and DMG. Compression is available for E01

and EX01 formats. Also allows BitLocker decryption (requires the BitLocker passphrase/password

or recovery key) so the image file(s) created will not have encrypted data.

 Net Traffic to File – Captures network traffic, internet activity, and VOIP. Sniff data on a network

and store captured packets on a Destination drive connected to Falcon-NEO. Captured data are

saved to .pcapng file format.

 Drive to Drive – Performs a bit-for-bit copy of the Source producing an exact duplicate of the

Source drive. This is also known as a native copy or mirror copy.

 File to Drive (Image Restore) – Restores DD, E01, EX01, and DMG images created by the

Falcon-NEO to another drive.

Any HPA, DCO, or ACS3 can be unlocked when imaging with the following modes:

 Drive to File

 Partition to File

 Drive to Drive

The Falcon-NEO uses a concurrent Image+Verify process. When Verify is set, the Falcon-NEO images and

verifies concurrently and takes advantage of destination hard drives that may be faster than the source

hard drive. Duration of the total image process time may be reduced by up to half.

Logicube Falcon-NEO User Manual

Other manuals for Logicube Falcon-NEO