IMAGING
Logicube Falcon
®
-Neo User’s Manual 38
File to File (Targeted Imaging feature) – Create logical images by using preset filters, custom
filters, files signatures filter, and/or keywords search function to select and acquire only the
specific files needed. Output formats available are: LX01, ZIP or directory tree. Optionally an MFT
report can be generated, which contains a list of deleted files (if present) that can potentially be
restored or recovered.
Partition to File (Logical Imaging) – Images one partition from the Source drive to any of the
following image output file formats: DD, E01, or EX01. Compression is available for E01 and EX01
formats. Also allows BitLocker decryption (requires the BitLocker password) so the image file(s)
created will not have encrypted data. Since BitLocker encrypts volumes, and a volume is a
formatted partition, unlocking the BitLocker encrypted volume requires going through the
Partition to File mode.
Net Traffic to File – Falcon-Neo can capture network traffic data using the Net Traffic to File
imaging mode. Network traffic that can be captured can include local network activity, internet
activity, and VOIP activity. The data is saved and stored to a *.pcanpg file format.
Drive to Drive – Performs a bit-for-bit copy of the Source producing an exact duplicate of the
Source drive.
File to Drive (Image Restore) – Restores DD, E01, EX01, and DMG images created by the Falcon-
NEO.
4.2 Source or Case
When Drive to Drive, Drive to File, or Partition to File mode is selected, the Source window will show
all drives connected to the Source positions. Tap this icon to select the Source drive to be imaged. Falcon-
NEO will list all the drives connected to the Source position(s).
When File to File mode is selected, the Source window will show all drives connected to the Source
positions and any repository added with the Source role (Source or Both Source and Destination).
When Net Traffic to File mode is selected, the Source Interface window will appear showing both LAN
ports (LAN 1, LAN 2).
When File to Drive mode is selected, the Case window will show all drives (connected to Source or
Destination) that have DD, E01, or Ex01 images created by the Falcon-NEO.
The (More Info) icon displays more information
on the drive. The drive details window will appear
showing information about the drive.
4.3 Settings
Tap the Settings icon to change the image settings. Depending on the selected mode, different screens
will appear.
Case Info – Available in all modes. See Section 4.3.1.
HPA/DCO/ACS3/TRIM – Available in the following modes: (Trim is available only in Drive to
Drive mode). See Section 4.3.2.
To Next Page
Loading...
Need help?
General
