IMAGING
Logicube Falcon
®
-Neo User’s Manual 45
Verification Method/Verify – One of two screens will appear:
YES / NO – Select YES to hash the Destination and verify that hash with the
selected Source hash.
NO / PRIMARY / BOTH – Select PRIMARY to verify just one hash value (For
example, if SHA-1 or MD5 was selected in the image process). Select Both to
verify both SHA-1 and MD5 if the SHA-1+MD5 hash was selected in the image
process.
4.3.5 File Image Method Settings
The File Image Method Settings screen allows the user to select a file image output. One
of four different images methods can be selected:
DD – Raw image files readable by many forensic programs.
E01 – Compressed or uncompressed EnCase legacy evidence file format.
EX01 – Compressed or uncompressed EnCase evidence file format.
DMG – Raw disk image files commonly used in Mac OS X.
SEGMENT SIZE – Allows the user to set the output segment size (file size).
Choose from the following segment sizes: 2 GB, 4 GB (Default), 8 GB, 16 GB, or
Whole Disk.
DD, E01, EX01, and DMG files created on the
Destination may be smaller than the selected Segment
Size if compression is on. For example, if 4GB segment
size is selected, some files may be less than 4GB.
COMPRESSION –Available for E01 and EX01 only. Set compression to either ON or OFF.
4.3.6 Clone Method Settings
When Drive to Drive mode is selected, Clone Method Settings will appear on the top-
right of the Settings screen. The Clone Method Settings screen has three settings:
Length – Set the percentage or number of blocks to clone. For forensic purposes,
this is typically set to 100% of the Source.
Master Start – Set the percentage or number of blocks from the start of the
Source (Master). For forensic purposes, this is typically set to 0%, or the
beginning of the Source (Master).
Target Start – Set the percentage or number of blocks from the start of the
Destination (Target). For forensic purposes, this is typically set to 0%, or the
beginning of the Destination (Target).
The specific number of blocks
can be set for each of the options
by tapping the: icon.