Logicube Falcon-NEO User manual

Logicube Falcon®-NEO User’s Manual I
Falcon®-NEO User’s Manual
Logicube, Inc.
Chatsworth, CA 91311
USA
Phone: [phone]
Fax: [phone]
Version: 1.0
Date: 03/28/2018
MAN-FALCON-NEO

Logicube Falcon®-NEO User’s Manual I
Limitation of Liability and Warranty Information
Logicube Disclaimer
LOGICUBE IS NOT LIABLE FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING,
BUT NOT LIMITED TO PROPERTY DAMAGE, LOSS OF TIME OR DATA FROM USE OF A LOGICUBE
PRODUCT, OR ANY OTHER DAMAGES RESULTING FROM PRODUCT MALFUNCTION OR FAILURE
OF (INCLUDING WITHOUT LIMITATION, THOSE RESULTING FROM: (1) RELIANCE ON THE
MATERIALS PRESENTED, (2) COSTS OF REPLACEMENT GOODS, (3) LOSS OF USE, DATA OR
PROFITS, (4) DELAYS OR BUSINESS INTERRUPTIONS, (5) AND ANY THEORY OF LIABILITY, ARISING
OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE (OR FROM DELAYS IN
SERVICING OR INABILITY TO RENDER SERVICE ON ANY) LOGICUBE PRODUCT.
LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ALL PRODUCTS.
HOWEVER, THE CUSTOMER IS RESPONSIBLE TO VERIFY THAT THE OUTPUT OF LOGICUBE
PRODUCT MEETS THE CUSTOMER’S QUALITY REQUIREMENT. THE CUSTOMER FURTHER
ACKNOWLEDGES THAT IMPROPER OPERATION OF LOGICUBE PRODUCT AND/OR SOFTWARE,
OR HARDWARE PROBLEMS, CAN CAUSE LOSS OF DATA, DEFECTIVE FORMATTING, OR DATA
LOADING. LOGICUBE WILL MAKE EFFORTS TO SOLVE OR REPAIR ANY PROBLEMS IDENTIFIED BY
CUSTOMER, EITHER UNDER WARRANTY OR ON A TIME AND MATERIALS BASIS.
Warranty
DISCLAIMER
IMPORTANT - PLEASE READ THE TERMS OF THIS AGREEMENT CAREFULLY. BY INSTALLING OR
USING LOGICUBE PRODUCTS, YOU AGREE TO BE BOUND BY THIS AGREEMENT.
IN NO EVENT WILL LOGICUBE BE LIABLE (WHETHER UNDER THIS AGREEMENT, RESULTING FROM
THE PERFORMANCE OR USE OF LOGICUBE PRODUCTS, OR OTHERWISE) FOR ANY AMOUNTS
REPRESENTING LOSS OF PROFITS, LOSS OR INACCURACY OF DATA, LOSS OR DELAYS OF
BUSINESS, LOSS OF TIME, COSTS OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES, OR
TECHNOLOGY, PROPERTY DAMAGE, OR INDIRECT, CONSEQUENTIAL, OR PUNITIVE DAMAGES OF
A PURCHASER OR USER OF LOGICUBE PRODUCTS OR ANY THIRD PARTY. LOGICUBE’S
AGGREGATE LIABILITY IN CONTRACT, TORT, OR OTHERWISE (WHETHER UNDER THIS
AGREEMENT, RESULTING FROM THE PERFORMANCE OR USE OF LOGICUBE PRODUCTS, OR
OTHERWISE) TO A PURCHASER OR USER OF LOGICUBE PRODUCTS SHALL BE LIMITED TO THE
AMOUNT PAID BY THE PURCHASER FOR THE LOGICUBE PRODUCT. THIS LIMITATION OF
LIABILITY WILL BE EFFECTIVE EVEN IF LOGICUBE HAS BEEN ADVISED OF THE POSSIBILITY OF ANY
SUCH DAMAGES.
LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ITS PRODUCTS.
HOWEVER, THE PURCHASER IS RESPONSIBLE FOR VERIFYING THAT THE OUTPUT OF A LOGICUBE

Logicube Falcon® -NEO User’s Manual II
PRODUCT MEETS THE PURCHASER’S REQUIREMENTS. THE PURCHASER FURTHER
ACKNOWLEDGES THAT IMPROPER OPERATION OF LOGICUBE PRODUCTS CAN CAUSE LOSS OF
DATA, DEFECTIVE FORMATTING, OR DEFECTIVE DATA LOADING. LOGICUBE WILL MAKE EFFORTS
TO SOLVE OR REPAIR ANY PROBLEMS IDENTIFIED BY PURCHASER, EITHER UNDER THE
WARRANTY SET FORTH BELOW OR ON A TIME AND MATERIALS BASIS.
LIMITED WARRANTY
FOR ONE YEAR FROM THE DATE OF SALE (THE “WARRANTY PERIOD”) LOGICUBE WARRANTS
THAT THE PRODUCT (EXCLUDING CABLES, ADAPTERS, AND OTHER “CONSUMABLE” ITEMS) IS
FREE FROM MANUFACTURING DEFECTS IN MATERIAL AND WORKMANSHIP. THIS LIMITED
WARRANTY COVERS DEFECTS ENCOUNTERED IN THE NORMAL USE OF THE PRODUCT DURING
THE WARRANTY PERIOD AND DOES NOT APPLY TO: PRODUCTS DAMAGED DUE TO PHYSICAL
ABUSE, MISHANDLING, ACCIDENT, NEGLIGENCE, OR FAILURE TO FOLLOW ALL OPERATING
INSTRUCTIONS CONTAINED IN THE OPERATING MANUAL; PRODUCTS WHICH ARE MODIFIED;
PRODUCTS WHICH ARE USED IN ANY MANNER OTHER THAN THE MANNER FOR WHICH THEY
WERE INTENDED, AS SET FORTH IN THE OPERATING MANUAL; PRODUCTS WHICH ARE
DAMAGED OR DEFECTS CAUSED BY THE USE OF UNAUTHORIZED PARTS OR BY UNAUTHORIZED
SERVICE; PRODUCTS DAMAGED DUE TO UNSUITABLE OPERATING OR PHYSICAL CONDITIONS
DIFFERING FROM THOSE RECOMMENDED IN THE OPERATING MANUAL OR PRODUCT
SPECIFICATIONS PROVIDED BY LOGICUBE; ANY PRODUCT WHICH HAS HAD ANY OF ITS SERIAL
NUMBERS ALTERED OR REMOVED; OR ANY PRODUCT DAMAGED DUE TO IMPROPER
PACKAGING OF THE WARRANTY RETURN TO LOGICUBE. AT LOGICUBE’S OPTION, ANY PRODUCT
PROVEN TO BE DEFECTIVE WITHIN THE WARRANTY PERIOD WILL EITHER BE REPAIRED OR
REPLACED USING NEW OR REFURBISHED COMPONENTS AT NO COST. THIS WARRANTY IS THE
SOLE AND EXCLUSIVE REMEDY FOR DEFECTIVE PRODUCTS. IF A PRODUCT IS HAS BECOME
OBSOLETE OR IS NO LONGER SUPPORTED BY LOGICUBE THE PRODUCT MAY BE REPLACED WITH
AN EQUIVALENT OR SUCCESSOR PRODUCT AT LOGICUBE’S DISCRETION. THIS WARRANTY
EXTENDS ONLY TO THE END PURCHASER OF LOGICUBE PRODUCTS. THIS WARRANTY DOES NOT
APPLY TO, AND IS NOT FOR THE BENEFIT OF, RESELLERS OR DISTRIBUTORS OF LOGICUBE
PRODUCTS. UNLESS OTHERWISE AGREED IN WRITING BY LOGICUBE, NO WARRANTY IS
PROVIDED TO RESELLERS OR DISTRIBUTORS OF LOGICUBE PRODUCTS.
IN ORDER TO RECEIVE WARRANTY SERVICES CONTACT LOGICUBE’S TECHNICAL SUPPORT
DEPARTMENT VIA PHONE OR E-MAIL. PRODUCTS RETURNED TO LOGICUBE FOR REPAIR UNDER
WARRANTY MUST REFERENCE A LOGICUBE RETURN MATERIAL AUTHORIZATION NUMBER
(“RMA”). ANY PRODUCT RECEIVED BY LOGICUBE WITHOUT AN RMA# WILL BE REFUSED AND
RETURNED TO PURCHASER. THE PURCHASER MUST CONTACT LOGICUBE’S TECHNICAL SUPPORT
DEPARTMENT VIA E-MAIL ([e-mail]) OR VIA PHONE AT [phone]
OPT. 3 TO OBTAIN A VALID RMA#. THE PURCHASER MAY BE REQUIRED TO PERFORM CERTAIN
DIAGNOSTIC TESTS ON A PRODUCT PRIOR TO LOGICUBE ISSUING AN RMA#. THE PURCHASER
MUST PROVIDE THE PRODUCT MODEL, SERIAL NUMBER, PURCHASER NAME AND ADDRESS,
EMAIL ADDRESS AND A DESCRIPTION OF THE PROBLEM WITH AS MUCH DETAIL AS POSSIBLE.
AT LOGICUBE’S SOLE AND ABSOLUTE DISCRETION, REASONABLE TELEPHONE AND EMAIL
SUPPORT MAY ALSO BE AVAILABLE FOR THE LIFE OF THE PRODUCT AS DEFINED BY LOGICUBE.
EXCEPT AS OTHERWISE SPECIFICALLY PROVIDED IN THIS AGREEMENT, LOGICUBE PRODUCTS
ARE PROVIDED AS-IS AND AS-AVAILABLE, AND LOGICUBE DISCLAIMS ANY AND ALL OTHER
WARRANTIES (WHETHER EXPRESS, IMPLIED, OR STATUTORY) INCLUDING, WITHOUT

Logicube Falcon® -NEO User’s Manual III
LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
OR NONINFRINGEMENT OF THIRD PARTY RIGHTS.
SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR
CONSEQUENTIAL DAMAGES, OR LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS,
SO THE ABOVE LIMITATIONS OR EXCLUSIONS MAY NOT APPLY TO YOU. THIS WARRANTY GIVES
YOU SPECIFIC LEGAL RIGHTS, AND YOU MAY HAVE OTHER RIGHTS WHICH VARY FROM
JURISDICTION TO JURISDICTION.
RoHS Certificate of Compliance
LOGICUBE PRODUCTS COMPLY WITH THE EUROPEAN UNION RESTRICTION OF THE USE OF
CERTAIN HAZARDOUS SUBSTANCES IN ELECTRONIC EQUIPMENT, ROHS DIRECTIVE
(2002/95/EC).
THE ROHS DIRECTIVE PROHIBITS THE SALE OF CERTAIN ELECTRONIC EQUIPMENT CONTAINING
SOME HAZARDOUS SUBSTANCES SUCH AS MERCURY, LEAD, CADMIUM, HEXAVALENT
CHROMIUM AND CERTAIN FLAME-RETARDANTS IN THE EUROPEAN UNION. THIS DIRECTIVE
APPLIES TO ELECTRONIC PRODUCTS PLACED ON THE EU MARKET AFTER JULY 1, 2006.
Logicube Technical Support Contact Information
•By website: www.logicube.com
•By email: [e-mail]
•By telephone: +1 - [phone] ext. 3 between the hours of 8 a.m. –5 p.m. PT, Monday
through Friday, excluding U.S. legal holidays.

Logicube Falcon®-NEO User’s Manual I
Table of Contents
FALCON®-NEO USER’S MANUAL ..........................................................................I
LIMITATION OF LIABILITY AND WARRANTY INFORMATION ...........................................I
LOGICUBE DISCLAIMER ........................................................................................................................ I
WARRANTY ....................................................................................................................................... I
ROHS CERTIFICATE OF COMPLIANCE.................................................................................................... III
LOGICUBE TECHNICAL SUPPORT CONTACT INFORMATION........................................................................ III
TABLE OF CONTENTS.....................................................................................................I
1: INTRODUCTION ...................................................................................................... 1
1.0 INTRODUCTION TO THE LOGICUBE FALCON-NEO............................................................................. 1
1.1 FEATURES ................................................................................................................................. 1
1.2 IN THE BOX ............................................................................................................................... 4
1.3 OPTIONS................................................................................................................................... 4
1.4 SPECIFICATIONS.......................................................................................................................... 5
2: GETTING STARTED .................................................................................................. 6
2.0 OVERVIEW OF THE FALCON-NEO.................................................................................................. 6
2.1 TURNING THE FALCON-NEO ON AND OFF....................................................................................... 8
2.2CONNECTING VARIOUS DRIVE TYPES............................................................................................... 8
2.2.1 Connecting Source Drives .............................................................................................. 8
2.2.2 Connecting Destination Drives....................................................................................... 9
2.2.3 Using USB/eSATA drives or enclosures........................................................................ 10
2.2.4 Connecting M.2/PCIe/mPCIe drives............................................................................. 10
2.2.5 Connecting an external Optical Drive (CD/DVD/Blu-ray)............................................. 11
2.3 THE USER INTERFACE................................................................................................................. 11
2.4 FRONT AND REAR PORTS ............................................................................................................ 12
2.4.1 Front ports ................................................................................................................... 12
2.4.2 Rear ports..................................................................................................................... 12
2.4.2.1 DC IN power ports................................................................................................. 12
2.4.2.2 Dual 10GbE ports.................................................................................................. 12
2.4.2.3 HDMI..................................................................................................................... 12
2.5 TOUCH SCREEN ........................................................................................................................ 13
3: QUICK START........................................................................................................ 14
3.0 QUICK START GUIDE ................................................................................................................. 14
3.1 IMAGING................................................................................................................................. 14
3.1.1 Step-by-step instructions –Imaging ............................................................................ 15
3.1.2 Imaging BitLocker encrypted drives............................................................................. 17
3.1.3 Imaging Net Traffic....................................................................................................... 19
3.1.4 Imaging to or from a network...................................................................................... 20

Logicube Falcon® -NEO User’s Manual II
3.1.5 Parallel Imaging............................................................................................................ 20
3.1.6 Drive Spanning ............................................................................................................. 21
3.1.7 Blank Disk Check .......................................................................................................... 22
3.2 HASH /VERIFY......................................................................................................................... 22
3.2.1 Step-by-step instructions –Drive Hash or Case Verify ................................................ 23
3.3 WIPE/FORMAT ........................................................................................................................ 24
3.3.1 Step-by-step instructions –Wipe/Format ................................................................... 24
3.4 PUSH...................................................................................................................................... 25
3.4.1 Step-by-step instructions - Push .................................................................................. 26
3.5 TASK MACRO........................................................................................................................... 27
3.5.1 Step-by-step instructions –Task Macros..................................................................... 27
3.6 FILE BROWSER ......................................................................................................................... 28
3.6.1 Step-by-step instructions –File Browser ..................................................................... 28
3.7 LOGS...................................................................................................................................... 28
3.7.1 Step-by-step instructions –Viewing or exporting logs ................................................ 29
3.7.2 Deleting log files........................................................................................................... 30
3.7.3 Accessing the logs over a network............................................................................... 30
3.8 STATISTICS .............................................................................................................................. 32
3.9 MANAGE REPOSITORIES ............................................................................................................ 32
3.10 SYSTEM SETTINGS................................................................................................................... 33
3.11 NETWORK SETTINGS ............................................................................................................... 33
3.12 SOFTWARE UPDATES............................................................................................................... 33
3.13 POWER OFF .......................................................................................................................... 34
4: IMAGING.............................................................................................................. 35
4.0 IMAGING -INTRODUCTION......................................................................................................... 35
4.1 MODE .................................................................................................................................... 35
4.1.1 BitLocker encrypted drives .......................................................................................... 36
4.2 SOURCE OR CASE...................................................................................................................... 36
4.3 SETTINGS ................................................................................................................................ 37
4.3.1 Case Info....................................................................................................................... 37
4.3.2 HPA/DCO/TRIM............................................................................................................ 38
4.3.2.1 DRIVE TRIM........................................................................................................... 38
4.3.3 Error Handling.............................................................................................................. 41
4.3.4 Hash/Verification Method ........................................................................................... 41
4.3.5 File Image Method Settings ......................................................................................... 42
4.3.6 Clone Method Settings ................................................................................................ 43
4.3.7 Verify Hash................................................................................................................... 43
4.3.8 Special Settings in File to File mode............................................................................. 43
4.3.8.1 Root Directory....................................................................................................... 43
4.3.8.2 Output Format...................................................................................................... 44
4.3.8.3 Filter Settings........................................................................................................ 44
4.3.8.3.1 Path Filter.................................................................................................................................... 44
4.3.8.3.2 Signature Based File Categories ................................................................................................. 46
4.3.8.3.3 Keywords .................................................................................................................................... 46
4.3.9 Special Settings in Net Traffic to File mode ................................................................. 46
4.4 DESTINATION/IMAGE FILE ......................................................................................................... 47
4.5 STARTING THE IMAGING OPERATION ........................................................................................... 48

Logicube Falcon® -NEO User’s Manual III
5: TYPES OF OPERATIONS ......................................................................................... 49
5.0 TYPES OF OPERATIONS -INTRODUCTION ...................................................................................... 49
5.1 IMAGING................................................................................................................................. 52
5.2 HASH /VERIFY......................................................................................................................... 52
5.2.1 Mode............................................................................................................................ 53
5.2.2 Drives ........................................................................................................................... 53
5.2.3 Settings......................................................................................................................... 54
5.2.3.1 Drive Hash Settings................................................................................................. 54
5.2.3.1.1 Hash Method............................................................................................................................... 55
5.2.3.1.2 Hash Values ................................................................................................................................ 55
5.2.3.1.3 LBA ............................................................................................................................................ 55
5.2.3.2 Case Verify ............................................................................................................ 56
5.2.4 Case Info....................................................................................................................... 56
5.3 WIPE /FORMAT....................................................................................................................... 56
5.3.1 Destination................................................................................................................... 57
5.3.2 Settings......................................................................................................................... 58
5.3.2.1 Secure Erase.......................................................................................................... 58
5.3.2.2 Wipe Patterns ....................................................................................................... 59
5.3.2.2.1 Mode ........................................................................................................................................... 59
5.3.2.2.2 HPA/DCO................................................................................................................................... 59
5.3.2.2.3 LBA ............................................................................................................................................ 59
5.3.2.2.4 PASSES ...................................................................................................................................... 60
5.3.2.3 Format .................................................................................................................. 61
5.3.3 Case Info....................................................................................................................... 62
5.4 PUSH...................................................................................................................................... 62
5.4.1 Source .......................................................................................................................... 63
5.4.2 Settings......................................................................................................................... 63
5.4.3 Destination................................................................................................................... 63
5.5 TASK MACRO........................................................................................................................... 64
5.5.1 Tasks............................................................................................................................. 64
5.6 FILE BROWSER ......................................................................................................................... 67
5.6.1 Viewing files from the web interface........................................................................... 69
5.6.2 Important notes about using the File Browser............................................................ 70
5.7 LOGS...................................................................................................................................... 70
5.8 STATISTICS .............................................................................................................................. 71
5.8.1 About Screen................................................................................................................ 71
5.8.2 Adv. Drive Statistics...................................................................................................... 72
5.8.3 Network Interface Stats ............................................................................................... 72
5.8.4 Debug Logs................................................................................................................... 72
5.8.5 Help.............................................................................................................................. 72
5.9 MANAGE REPOSITORIES ............................................................................................................ 72
5.9.1 Add/Remove ................................................................................................................ 73
5.9.2 iSCSI.............................................................................................................................. 75
5.9.3 Configuration ............................................................................................................... 76
5.10 SYSTEM SETTINGS................................................................................................................... 76
5.10.1 Profiles ....................................................................................................................... 76
5.10.2 Passwords .................................................................................................................. 78
5.10.2.1 Setting Key Passwords ........................................................................................ 79
5.10.2.1.1 Config Lock Notes .................................................................................................................... 80

Logicube Falcon® -NEO User’s Manual IV
5.10.2.1.2 Forgotten password for any keys .............................................................................................. 81
5.10.2.2 User Account Passwords..................................................................................... 82
5.10.3 Encryption.................................................................................................................. 83
5.10.4 Language/Time Zone ................................................................................................. 84
5.10.4.1 Language ............................................................................................................ 84
5.10.4.2 Time Zone ........................................................................................................... 85
5.10.5 Display........................................................................................................................ 86
5.10.6 Notifications............................................................................................................... 86
5.11 NETWORK SETTINGS ............................................................................................................... 87
5.11.1 Interfaces ................................................................................................................... 87
5.11.1.1 Configuring a Static IP address........................................................................... 87
5.11.1.2 Enabling/Disabling Network Services................................................................. 88
5.11.2 HTTP Proxy................................................................................................................. 89
5.11.2.1 Server.................................................................................................................. 89
5.11.2.2 Username/Password .......................................................................................... 89
5.12 SOFTWARE UPDATE ................................................................................................................ 90
5.13 POWER OFF .......................................................................................................................... 90
6: PREVIEWING DRIVES ............................................................................................ 91
6.0 PREVIEWING DRIVES -INTRODUCTION ......................................................................................... 91
6.1 FILE BROWSER ......................................................................................................................... 92
6.2 COMPUTER +FILE BROWSER...................................................................................................... 92
6.3 SMB...................................................................................................................................... 92
6.4 ISCSI...................................................................................................................................... 93
7: DRIVE ENCRYPTION AND DECRYPTION.................................................................. 94
7.0 DRIVE ENCRYPTION/DECRYPTION -INTRODUCTION........................................................................ 94
7.1 ENCRYPTING A DESTINATION ...................................................................................................... 94
7.1.1 Step-by-step Instructions............................................................................................. 95
7.1.2 Using previously encrypted Destination drives ........................................................... 95
7.2 DECRYPTING A FALCON-NEO ENCRYPTED DRIVE WITH A FALCON-NEO............................................. 96
7.3 DECRYPTING THE DRIVE WITHOUT A FALCON-NEO ........................................................................ 97
7.3.1 Which decryption software to use?............................................................................. 98
7.3.2 Decrypting using VeraCrypt ......................................................................................... 98
7.3.3 Decrypting using TrueCrypt ....................................................................................... 100
7.3.4 Decrypting using FreeOTFE........................................................................................ 102
8: UPDATING/LOADING/RE-LOADING THE FALCON-NEO SOFTWARE....................... 107
8.0 UPDATING/LOADING/RE-LOADING SOFTWARE –INTRODUCTION................................................... 107
8.1 UPDATING/LOADING/RE-LOADING SOFTWARE INSTRUCTIONS....................................................... 107
8.1.1 From Network (Over the Internet) ............................................................................ 107
8.1.2 From USB Drive (Through a software file download) ................................................ 108
8.2 FIRMWARE LOADING INSTRUCTIONS.......................................................................................... 109
9: REMOTE OPERATION.......................................................................................... 110
9.0 REMOTE OPERATION -INTRODUCTION....................................................................................... 110
9.1 WEB INTERFACE..................................................................................................................... 110
9.2 COMMAND LINE INTERFACE (CLI)............................................................................................. 111

Logicube Falcon® -NEO User’s Manual V
9.2.1 Connecting via Telnet ................................................................................................ 111
9.2.2 Connecting via SSH..................................................................................................... 112
9.3 ZERO CONFIGURATION NETWORKING (ZEROCONF)...................................................................... 112
10: VIEWING SOURCE AND DESTINATION DRIVES OVER A NETWORK...................... 113
10.0 VIEWING DRIVES OVER A NETWORK –OVERVIEW....................................................................... 113
10.1 VIEWING SOURCE OR DESTINATION DRIVES OVER THE NETWORK USING SMB ................................ 113
10.1.1 Step-by-step –Viewing Source or Destination drives.............................................. 113
10.2 VIEWING SOURCE DRIVES OVER THE NETWORK USING ISCSI ........................................................ 115
10.2.1 Configuring the iSCSI initiator.................................................................................. 115
11: NET TRAFFIC IMAGING...................................................................................... 117
11.0 NET TRAFFIC INTRODUCTION.................................................................................................. 117
11.1 NET TRAFFIC SETTINGS.......................................................................................................... 117
11.2 NET TRAFFIC IMAGING NOTES................................................................................................. 118
12: VIEWING EXT4 FORMATTED DESTINATION DRIVES IN WINDOWS...................... 120
12.0 VIEWING EXT4 FORMATTED DESTINATION DRIVES -INTRODUCTION............................................. 120
12.0.1 Step-by-step instructions –Using Ext2fsd ............................................................... 120
13: USB BOOT CLIENT ............................................................................................. 123
13.0 USB BOOT CLIENT INTRODUCTION.......................................................................................... 123
13.1 REQUIREMENTS ................................................................................................................... 123
13.2 CREATING THE USB BOOT CLIENT ........................................................................................... 123
13.3 USING THE USB BOOT CLIENT................................................................................................ 126
14: PRINTING ......................................................................................................... 128
14.0 PRINTING –INTRODUCTION ................................................................................................... 128
14.1 PRINTING FROM THE WEB INTERFACE...................................................................................... 128
14.2 CONFIGURING A LOCAL OR NETWORKED PRINTER....................................................................... 128
14.2.1 Step-by-step –Configuring a local or networked printer ........................................ 128
15: FREQUENTLY ASKED QUESTIONS ...................................................................... 131
15.0 FAQS................................................................................................................................. 131
16: INDEX............................................................................................................... 134
TECHNICAL SUPPORT INFORMATION ................................................................................................. 135
SOFTWARE ATTRIBUTION ................................................................................................................ 135

Logicube Falcon®-NEO User’s Manual 1
1: Introduction
1.0 Introduction to the Logicube Falcon-NEO
The next-generation of our ground-breaking Falcon® forensic imager, the Falcon®-NEO has
been engineered specifically for digital forensic investigations. Delivering high performance and
advanced features, the Falcon-NEO is designed to meet the challenges of digital investigations
head-on. Efficient and secure digital evidence collection is accomplished with a feature-set that
provides sophisticated functionality with a goal to shorten acquisition time. Future-focused, the
Falcon-NEO sets new standards in digital forensic imaging technology.
1.1 Features
•The Falcon®-NEO is an extremely fast forensic imaging solution. It achieves imaging
speeds surpassing 50GB/min and can clone PCIe to PCIe at speeds of 69GB/min.
•Image and verify to multiple image formats; native copy, .dd image, .dmg image, e01
and ex01. The Falcon-NEO provides MD5, SHA1, SHA256, and dual hash (MD5+SHA1)
authentication at extremely fast speeds.
•Falcon-NEO formats destination drives to NTFS, exFAT, EXT4, or FAT32 file systems. The
unit supports imaging from source drives formatted to any major file system.
•Four Write-blocked source ports include 2 SAS/SATA, 1 USB 3.0, 1 PCIe. Six
Destination ports include 2 SAS/SATA, 2 SATA, 1 USB 3.0 and 1 PCIe. All destination
ports are built-in to the unit, no additional module or bay attachments required.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 2
•Two 10GbE network ports provide state-of-the-art connectivity for fast network
imaging performance.
•I/O card ports. Designed for the future, the Falcon-NEO includes 2 source I/O card ports
and 1 destination I/O port to support new interface technologies as they arrive on the
market. Thunderbolt/USB 3.1 Gen 2/USB-C I/O card will be available in Q4 2018.
•Networking Feature. Use the Falcon-NEO to image to a network location using CIFS
protocol and/or image from a network location using iSCSI. Users can use iSCSI as a
source or destination drive. Image to an external storage device such as a NAS, using the
10 Gigabit Ethernet, USB 3.0 or SAS/SATA connection.
•Network Capture. Capture network traffic, internet activity and VOIP. Sniff data on a
network and store captured packets on a hard drive connected to Falcon-NEO.
•Multi-Task. Image simultaneously from multiple sources to multiple destinations
including a network repository. Supports imaging to one location while simultaneously
hashing and/or wiping a second drive. Users can perform up to 5 tasks concurrently. Little
or no speed degradation when imaging from two sources to two destinations.
•Parallel Imaging. Perform multiple imaging tasks from the same source drive to multiple
destinations using different imaging formats. Clone to a network location or a destination
drive using mirror copy mode while simultaneously imaging in e01 or .dd format to a
different destination drive.
•Targeted Imaging/Logical Imaging feature shortens acquisition time. Create a logical
image by using pre-set filters, custom filters, file signature filters, and/or keyword search
function to select and acquire only the specific files you need. An MFT report can be
generated that contains a potential deleted file list. Format output to LX01, ZIP or
directory tree. Users can browse and view directly on the Falcon-NEO display, or manage
and view on a networked Falcon-NEO from your laptop/desktop using a web browser.
•Partition Imaging. Select and image specific partitions on the source drive.
•Write-Blocked Drive Preview. Preview drive contents directly on the Falcon-NEO. The
file browser feature provides logical access to source or destination drives connected to
Falcon-NEO. Users can view the drive’s partitions and contents and view text files, jpeg,
PDF, XML, HTML files. Other methods to preview include using the file browser feature
and Falcon-NEO’s web browser on a PC/laptop or preview over a network via SMB or
iSCSI (as an iSCSI target). 3rd party analysis tools can be used with SMB or iSCSI methods.
•Broad interface support. The Falcon-NEO provides built-in support for
SAS/SATA/USB3/PCIe storage devices including solid state drives. PCIe drives require an
optional adapter kit. mSATA, micro SATA and eSATA drives are supported with adapters
included with the unit. IDE drives, and flash drives are supported with optional adapters.
Support for SCSI devices will be available with an optional module available in early
summer 2018.
•PCIe Support. Support for imaging to/from M.2 PCIe (SATA, AHCI, and NVME types),
PCIe and mini-PCIe express cards is available using the Falcon-NEO’s 4-lane PCIe source
and destination ports and optional adapters.
•Concurrent Image+Verify. Imaging and verifying concurrently takes advantage of
destination hard drives that may be faster than the source hard drive. Duration of total
image+verify process time may be reduced by up to half.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 3
•BitLocker Support. Image source drives that have been encrypted using BitLocker.
Decrypt partitions (requires the BitLocker password) and then image the selected
partitions.
•Secure sensitive evidence data with whole drive AES 256-bit Encryption. Decryption can
be performed using the Falcon-NEO or by using open source software programs such as
VeraCrypt, TrueCrypt or FreeOTFE.
•Network Push Feature. Push evidence files from destination drives connected to Falcon-
NEO or from a Falcon-NEO repository to a network location. An MD5 or SHA hash is
performed during the push process.
•Image from a MAC with USB-C ports using a USB-C to USB-A cable and Target Disk
Mode. Users can also image from MACs using Logicube’s USB boot device. Create a
forensic bootable USB flash drive to image a source drive from a MAC on the same
network without booting the MAC’s native O/S. The Falcon-NEO supports imaging from
MacBook Pro systems.
•Image from a PC/laptop without removing hard drives. Create a forensic bootable
USB flash drive to image a source drive from a computer on the same network without
booting the computer’s native OS. Supports Surface Pro 4 and above laptops.
•Image restore feature. File to drive mode restores DD, DMG, E01, EX01 images created
by the Falcon-NEO to another drive.
•Remote Operation. Connect to a networked Falcon-NEO from your PC using a web
browser to manage all operations remotely. This feature provides automatic page scaling
for iPad type devices and authentication/password for increased security.
•Administrative feature allows users to save configuration settings and set password-
protected user profiles.
•Features an internal, removable storage drive that stores OS and audit trail/logs. The
drive is easily removed for secure/classified locations.
•Image from a CD/DVD/Blu-Ray. The Falcon-NEO can image CD/DVD/Blu-ray media by
using a USB optical drive connected to the USB port on the Falcon-NEO. Supports multi-
session CD/DVDs.
•Wipe drives to DoD specifications or use secure erase to wipe drives. Speeds of
30GB/min for SATA type drives and 72GB/min for PCIe drives.
•Audit Trail/Log files provide detailed information on each operation. Log files can be
viewed on Falcon-NEO or via a web browser, exported to XML, HTML or PDF format to a
USB enclosure. Users can print the log files directly from their PC when connected to
Falcon-NEO via a web browser.
•Quiet Operation. The Falcon-NEO has been designed to minimize noise during
operations
•Additional features include HPA/DCO capture, drive spanning, color touchscreen
display, HDMI port, two USB 3.0 host ports for keyboard, mouse or printer connectivity,
blank disk check feature, drive trim feature, and S.M.A.R.T. data.
* The Forensic Falcon-NEO achieves speeds surpassing 50GB/min using solid state “suspect”drives that contain a freshly
installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify
“on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used
during the imaging process may affect the achieved speeds.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 4
1.2 In the Box
The Falcon-NEO is shipped in a soft-sided carrying case that includes:
•The Logicube Falcon-NEO unit
•AC adapter/Power supply and US power cord
•QTY: 6 –SAS/SATA data & power cables
•QTY: 2 –CAT7 6FT network cables
•eSATA to SATA cable (18”)
•mSATA to SATA adapter
•micro SATA adapter
•QTY: 6 –6-pin power plugs for use with eSATA devices
•CD-ROM containing the user’s manual
1.3 Options
The following options are available for the Falcon-NEO:
•SCSI module. Available in early summer 2018, the module provides 1 write-blocked
source or destination port. Built in support for 68-pin SCSI drives.
•PCIe adapter kit. Includes adapters for M.2 PCIe, M.2 SATA, M.2 NVMe, mSATA, PCIe and
mini-PCIe cards.
•USB 3.0 4-port hub.
•USB 3.0 to SATA adapter allows you to connect SATA drives to the USB 3.0 ports.
•2.5”/3.5” IDE ,1.8” IDE to SATA, 1.8” ZIF adapters.
•Flash media reader
•18” extended length SAS/SATA cable set
•Extended 1-year and 2-year warranties
•Hard case (Pelican type)

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 5
1.4 Specifications
WARNINGS:
•Never connect a suspect drive to the Destination ports as data
may be overwritten.
•Incorrectly connecting the suspect drive to the system can result
in data on the suspect drive to be lost forever.
•Avoid dropping the Logicube device or subjecting it to sharp jolts.
When in use, place it on a flat surface.
•Keep the unit dry. If the Logicube device needs to be cleaned, use
a lightly damp, lint free cloth. Avoid using soap or other cleaning
agents particularly those containing bleach, ammonia, alcohol or
other harsh chemicals.
•Do not attempt to service or open the Logicube device. Doing so
may void the warranty. If the unit requires service, please
contact Logicube Technical Support for assistance.

Logicube Falcon®-NEO User’s Manual 6
2: Getting Started
2.0 Overview of the Falcon-NEO
Special Icons –Throughout this manual, there are two icons that can be
seen. Please pay close attention when any of these two icons are found.
These icons highlight additional information or importa`nt warnings on
specific topics.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 7

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 8
2.1 Turning the Falcon-NEO on and off
The Falcon-NEO has two DC IN ports located in the back of the device. Any of these two ports can
be used. The second DC IN port is available for possible future increases in power requirements.
The Falcon-NEO also comes with a 12V grounded, 21A (output DC) power supply that connects to
the back of the device. Attach the included power supply to the any one of the two DC power
ports in the back of the Falcon-NEO.
To turn the Falcon-NEO on, press and immediately release the power button located on the top
right corner of the Falcon-NEO. The Falcon-NEO will turn on and start the boot process.
It is normal for the fans to slow down
after the initial start-up sequence.
There are two ways of turning the Falcon-NEO off:
1. Press and immediately release the power button on the top right corner of the Falcon-
NEO. The Falcon-NEO will begin its shut down process and after a few seconds, the
display and fans will turn off.
2. Using the Graphical User Interface (GUI) either on the touch screen or via a browser
through a remote connection, navigate to the Power Off screen and tap or click the
Power Off icon.
2.2 Connecting various drive types
The Falcon-NEO supports a variety of drive types including the following types:
•SATA
•USB
•SAS
•eSATA
•mSATA
•1.8” micro SATA
•2.5” and 3.5” PATA/IDE (optional)
•1.8” ZIF (optional)
•1.8” PATA/IDE (optional)
•Flash Media (optional)
•M.2 (NVMe, AHCI, and SATA variants - optional)
•mPCIe (optional)
2.2.1 Connecting Source Drives
Source drives (also called suspect drives) must be connected to the left side of
the Falcon-NEO. These ports are write-protected and are labeled as follows:
•SAS_S1 –SAS/SATA data port for the Source 1 position.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 9
•SAS_S2 –SAS/SATA data port for the Source 2 position.
•USB_S1 –USB 3.0 Source port.
•PCIe_S1 –PCIe Source port (Depending on the type of PCIe drive, the
optional PCIe kit, part number F-ADP-PCI-FN-KT may be required).
•Not labeled: Two 6-pin power ports for SAS_S1 and SAS_S2 that have
lines corresponding to the proper data port.
The Falcon-NEO Source ports are hot swappable (including the PCIe ports).
Some drives are not hot swappable. Please check
with the drive manufacturer to find out if the
drive being used does not support hot swapping.
Source drives do not have to be connected in any order. For example, a single
SATA Source drive does not have to be connected to the SAS_S1 port. It can be
connected to the SAS_S2 port without having anything connected to the SAS_S1
port.
Never connect a suspect or Source drive to the
Destination ports of the Falcon-NEO. Data may be
overwritten if a drive is connected to a Destination port.
Any combination of drives can be connected. For example, one SAS drive, one
SATA drive, one USB drive, and one PCIe drive can all be connected at the same
time.
2.2.2 Connecting Destination Drives
Destination drives (also called evidence drives) must be connected to the right
side of the Falcon-NEO. These ports are labeled as follows:
•SAS_D1 –SAS/SATA data port for the Destination 1 position.
•SAS_D2 –SAS/SATA data port for the Destination 2 position.
•SATA_D3 –SATA only data port for the Destination 3 position.
•SATA_D4 –SATA only data port for the Destination 4 position.
•USB_D1 –USB 3.0 Destination port.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 10
•PCIe_D1 –PCIe Destination port (Depending on the type of PCIe drive,
the optional PCIe kit, part number F-ADP-PCI-FN-KT may be required).
•Not labeled: Four 6-pin power ports for SAS_D1, SAS_D2, SATA_D3, and
SATA_D4 that have lines corresponding to the proper data port.
The Falcon-NEO Destination ports are hot swappable (including the PCIe ports).
Some drives are not hot swappable. Please check
with the drive manufacturer to find out if the
drive being used does not support hot swapping.
Destination drives do not have to be connected in order. For example, a single
SATA Destination drive does not have to be connected to the SAS_D1 port. It
can be connected to the SATA_D4 port without having anything connected to
any of the other ports.
Any combination of drives can be connected. For example, four SATA drives, one
USB drive, and one PCIe drive can all be connected at the same time.
Never connect a suspect or Source drive to the
Destination ports of the Falcon-NEO. Data may be
overwritten if a drive is connected to a Destination port.
2.2.3 Using USB/eSATA drives or enclosures
It is recommended to leave the drive inside the enclosure. These enclosures may
have an on-board controller that may be necessary to read the drive properly.
Taking the drive out of the enclosure could cause any device (including
computers) not to read the drive contents properly.
2.2.4 Connecting M.2/PCIe/mPCIe drives
An optional PCIe adapter kit (part number F-ADP-PCI-FN-KT) is available for the
Falcon-NEO which includes M.2 adapters, a mini PCIe adapter, and a PCIe
extender cable.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 11
2.2.5 Connecting an external Optical Drive (CD/DVD/Blu-ray)
An optical drive can be connected to the Source USB port. The Falcon-NEO can
then image the contents of the CD, DVD, or Blu-ray disc.
Although most USB optical drives should work, Logicube
has tested and qualified the following optical drive:
-Pioneer BDR-XS06
Multisession support: The Falcon-NEO supports imaging from
a multisession CD (as a Source). However, forensic analysis
software may not support reading the multisession data.
Please check with your forensic analysis software manufacturer
to find out if it supports reading multisession data from CDs.
2.3 The user interface
The user interface (UI) has been designed to quickly and easily input commands. It is simple and
intuitive showing common icons such as tasks, modes of operation, and scroll icons on the screen.
The UI is designed to be easily followed, going from left to right across the screen. The touch
screen also supports swipe gestures.
A –Operations/Tasks currently running (displays up to 5 total tasks)
B –Lock indicator/shortcut
C –Operations/Tasks
D –Add or delete tasks
E –Types of Operations