Logicube Falcon-NEO User manual

Logicube Falcon®-NEO User’s Manual I
Falcon®-NEO User’s Manual
Logicube, Inc.
Chatsworth, CA 91311
USA
Phone: [phone]
Fax: [phone]
Version: 2.0
Date: 01/22/2019
MAN-FALCON-NEO

Logicube Falcon®-NEO User’s Manual I
Limitation of Liability and Warranty Information
Logicube Disclaimer
LOGICUBE IS NOT LIABLE FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING, BUT NOT
LIMITED TO PROPERTY DAMAGE, LOSS OF TIME OR DATA FROM USE OF A LOGICUBE PRODUCT, OR ANY
OTHER DAMAGES RESULTING FROM PRODUCT MALFUNCTION OR FAILURE OF (INCLUDING WITHOUT
LIMITATION, THOSE RESULTING FROM: (1) RELIANCE ON THE MATERIALS PRESENTED, (2) COSTS OF
REPLACEMENT GOODS, (3) LOSS OF USE, DATA OR PROFITS, (4) DELAYS OR BUSINESS INTERRUPTIONS,
(5) AND ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE (OR FROM DELAYS IN SERVICING OR INABILITY TO RENDER SERVICE ON ANY) LOGICUBE
PRODUCT.
LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ALL PRODUCTS. HOWEVER, THE
CUSTOMER IS RESPONSIBLE TO VERIFY THAT THE OUTPUT OF LOGICUBE PRODUCT MEETS THE
CUSTOMER’S QUALITY REQUIREMENT. THE CUSTOMER FURTHER ACKNOWLEDGES THAT IMPROPER
OPERATION OF LOGICUBE PRODUCT AND/OR SOFTWARE, OR HARDWARE PROBLEMS, CAN CAUSE LOSS
OF DATA, DEFECTIVE FORMATTING, OR DATA LOADING. LOGICUBE WILL MAKE EFFORTS TO SOLVE OR
REPAIR ANY PROBLEMS IDENTIFIED BY CUSTOMER, EITHER UNDER WARRANTY OR ON A TIME AND
MATERIALS BASIS.
Warranty
DISCLAIMER
IMPORTANT - PLEASE READ THE TERMS OF THIS AGREEMENT CAREFULLY. BY INSTALLING OR USING
LOGICUBE PRODUCTS, YOU AGREE TO BE BOUND BY THIS AGREEMENT.
IN NO EVENT WILL LOGICUBE BE LIABLE (WHETHER UNDER THIS AGREEMENT, RESULTING FROM THE
PERFORMANCE OR USE OF LOGICUBE PRODUCTS, OR OTHERWISE) FOR ANY AMOUNTS REPRESENTING
LOSS OF PROFITS, LOSS OR INACCURACY OF DATA, LOSS OR DELAYS OF BUSINESS, LOSS OF TIME,
COSTS OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES, OR TECHNOLOGY, PROPERTY DAMAGE,
OR INDIRECT, CONSEQUENTIAL, OR PUNITIVE DAMAGES OF A PURCHASER OR USER OF LOGICUBE
PRODUCTS OR ANY THIRD PARTY. LOGICUBE’S AGGREGATE LIABILITY IN CONTRACT, TORT, OR
OTHERWISE (WHETHER UNDER THIS AGREEMENT, RESULTING FROM THE PERFORMANCE OR USE OF
LOGICUBE PRODUCTS, OR OTHERWISE) TO A PURCHASER OR USER OF LOGICUBE PRODUCTS SHALL BE
LIMITED TO THE AMOUNT PAID BY THE PURCHASER FOR THE LOGICUBE PRODUCT. THIS LIMITATION OF
LIABILITY WILL BE EFFECTIVE EVEN IF LOGICUBE HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH
DAMAGES.
LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ITS PRODUCTS. HOWEVER, THE
PURCHASER IS RESPONSIBLE FOR VERIFYING THAT THE OUTPUT OF A LOGICUBE PRODUCT MEETS THE
PURCHASER’S REQUIREMENTS. THE PURCHASER FURTHER ACKNOWLEDGES THAT IMPROPER

Logicube Falcon® -NEO User’s Manual II
OPERATION OF LOGICUBE PRODUCTS CAN CAUSE LOSS OF DATA, DEFECTIVE FORMATTING, OR
DEFECTIVE DATA LOADING. LOGICUBE WILL MAKE EFFORTS TO SOLVE OR REPAIR ANY PROBLEMS
IDENTIFIED BY PURCHASER, EITHER UNDER THE WARRANTY SET FORTH BELOW OR ON A TIME AND
MATERIALS BASIS.
LIMITED WARRANTY
FOR ONE YEAR FROM THE DATE OF SALE (THE “WARRANTY PERIOD”) LOGICUBE WARRANTS THAT THE
PRODUCT (EXCLUDING CABLES, ADAPTERS, AND OTHER “CONSUMABLE” ITEMS) IS FREE FROM
MANUFACTURING DEFECTS IN MATERIAL AND WORKMANSHIP. THIS LIMITED WARRANTY COVERS
DEFECTS ENCOUNTERED IN THE NORMAL USE OF THE PRODUCT DURING THE WARRANTY PERIOD AND
DOES NOT APPLY TO: PRODUCTS DAMAGED DUE TO PHYSICAL ABUSE, MISHANDLING, ACCIDENT,
NEGLIGENCE, OR FAILURE TO FOLLOW ALL OPERATING INSTRUCTIONS CONTAINED IN THE OPERATING
MANUAL; PRODUCTS WHICH ARE MODIFIED; PRODUCTS WHICH ARE USED IN ANY MANNER OTHER
THAN THE MANNER FOR WHICH THEY WERE INTENDED, AS SET FORTH IN THE OPERATING MANUAL;
PRODUCTS WHICH ARE DAMAGED OR DEFECTS CAUSED BY THE USE OF UNAUTHORIZED PARTS OR BY
UNAUTHORIZED SERVICE; PRODUCTS DAMAGED DUE TO UNSUITABLE OPERATING OR PHYSICAL
CONDITIONS DIFFERING FROM THOSE RECOMMENDED IN THE OPERATING MANUAL OR PRODUCT
SPECIFICATIONS PROVIDED BY LOGICUBE; ANY PRODUCT WHICH HAS HAD ANY OF ITS SERIAL
NUMBERS ALTERED OR REMOVED; OR ANY PRODUCT DAMAGED DUE TO IMPROPER PACKAGING OF
THE WARRANTY RETURN TO LOGICUBE. AT LOGICUBE’S OPTION, ANY PRODUCT PROVEN TO BE
DEFECTIVE WITHIN THE WARRANTY PERIOD WILL EITHER BE REPAIRED OR REPLACED USING NEW OR
REFURBISHED COMPONENTS AT NO COST. THIS WARRANTY IS THE SOLE AND EXCLUSIVE REMEDY FOR
DEFECTIVE PRODUCTS. IF A PRODUCT IS HAS BECOME OBSOLETE OR IS NO LONGER SUPPORTED BY
LOGICUBE THE PRODUCT MAY BE REPLACED WITH AN EQUIVALENT OR SUCCESSOR PRODUCT AT
LOGICUBE’S DISCRETION. THIS WARRANTY EXTENDS ONLY TO THE END PURCHASER OF LOGICUBE
PRODUCTS. THIS WARRANTY DOES NOT APPLY TO, AND IS NOT FOR THE BENEFIT OF, RESELLERS OR
DISTRIBUTORS OF LOGICUBE PRODUCTS. UNLESS OTHERWISE AGREED IN WRITING BY LOGICUBE, NO
WARRANTY IS PROVIDED TO RESELLERS OR DISTRIBUTORS OF LOGICUBE PRODUCTS.
IN ORDER TO RECEIVE WARRANTY SERVICES CONTACT LOGICUBE’S TECHNICAL SUPPORT DEPARTMENT
VIA PHONE OR E-MAIL. PRODUCTS RETURNED TO LOGICUBE FOR REPAIR UNDER WARRANTY MUST
REFERENCE A LOGICUBE RETURN MATERIAL AUTHORIZATION NUMBER (“RMA”). ANY PRODUCT
RECEIVED BY LOGICUBE WITHOUT AN RMA# WILL BE REFUSED AND RETURNED TO PURCHASER. THE
PURCHASER MUST CONTACT LOGICUBE’S TECHNICAL SUPPORT DEPARTMENT VIA E-MAIL
([e-mail]) OR VIA PHONE AT [phone] OPT. 3 TO OBTAIN A VALID RMA#.
THE PURCHASER MAY BE REQUIRED TO PERFORM CERTAIN DIAGNOSTIC TESTS ON A PRODUCT PRIOR
TO LOGICUBE ISSUING AN RMA#. THE PURCHASER MUST PROVIDE THE PRODUCT MODEL, SERIAL
NUMBER, PURCHASER NAME AND ADDRESS, EMAIL ADDRESS AND A DESCRIPTION OF THE PROBLEM
WITH AS MUCH DETAIL AS POSSIBLE. AT LOGICUBE’S SOLE AND ABSOLUTE DISCRETION, REASONABLE
TELEPHONE AND EMAIL SUPPORT MAY ALSO BE AVAILABLE FOR THE LIFE OF THE PRODUCT AS DEFINED
BY LOGICUBE.
EXCEPT AS OTHERWISE SPECIFICALLY PROVIDED IN THIS AGREEMENT, LOGICUBE PRODUCTS ARE
PROVIDED AS-IS AND AS-AVAILABLE, AND LOGICUBE DISCLAIMS ANY AND ALL OTHER WARRANTIES
(WHETHER EXPRESS, IMPLIED, OR STATUTORY) INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT OF THIRD PARTY
RIGHTS.
SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR
CONSEQUENTIAL DAMAGES, OR LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, SO THE

Logicube Falcon® -NEO User’s Manual III
ABOVE LIMITATIONS OR EXCLUSIONS MAY NOT APPLY TO YOU. THIS WARRANTY GIVES YOU SPECIFIC
LEGAL RIGHTS, AND YOU MAY HAVE OTHER RIGHTS WHICH VARY FROM JURISDICTION TO
JURISDICTION.
RoHS Certificate of Compliance
LOGICUBE PRODUCTS COMPLY WITH THE EUROPEAN UNION RESTRICTION OF THE USE OF CERTAIN
HAZARDOUS SUBSTANCES IN ELECTRONIC EQUIPMENT, ROHS DIRECTIVE (2002/95/EC).
THE ROHS DIRECTIVE PROHIBITS THE SALE OF CERTAIN ELECTRONIC EQUIPMENT CONTAINING SOME
HAZARDOUS SUBSTANCES SUCH AS MERCURY, LEAD, CADMIUM, HEXAVALENT CHROMIUM AND
CERTAIN FLAME-RETARDANTS IN THE EUROPEAN UNION. THIS DIRECTIVE APPLIES TO ELECTRONIC
PRODUCTS PLACED ON THE EU MARKET AFTER JULY 1, 2006.
Logicube Technical Support Contact Information
By website: www.logicube.com
By email: [e-mail]
By telephone: +1 - [phone] ext. 3 between the hours of 8 a.m. –5 p.m. PT, Monday through
Friday, excluding U.S. legal holidays.

Logicube Falcon®-NEO User’s Manual I
Table of Contents
FALCON®-NEO USER’S MANUAL......................................................................... I
LIMITATION OF LIABILITY AND WARRANTY INFORMATION.......................................... I
LOGICUBE DISCLAIMER.................................................................................................................................... I
WARRANTY................................................................................................................................................... I
ROHS CERTIFICATE OF COMPLIANCE ............................................................................................................... III
LOGICUBE TECHNICAL SUPPORT CONTACT INFORMATION ................................................................................... III
TABLE OF CONTENTS ................................................................................................... I
1: INTRODUCTION..................................................................................................... 1
1.0 INTRODUCTION TO THE LOGICUBE FALCON-NEO ........................................................................................ 1
1.1 FEATURES............................................................................................................................................. 1
1.2 IN THE BOX........................................................................................................................................... 4
1.3 OPTIONS .............................................................................................................................................. 4
1.4 SPECIFICATIONS ..................................................................................................................................... 5
2: GETTING STARTED................................................................................................. 6
2.0 OVERVIEW OF THE FALCON-NEO ............................................................................................................. 6
2.1 TURNING THE FALCON-NEO ON AND OFF ................................................................................................. 8
2.2CONNECTING VARIOUS DRIVE TYPES......................................................................................................... 8
2.2.1 Connecting Source Drives............................................................................................. 8
2.2.2 Connecting Destination Drives..................................................................................... 9
2.2.3 Using USB/eSATA Drives or Enclosures...................................................................... 10
2.2.4 Connecting M.2/PCIe/mPCIe Drives........................................................................... 11
2.2.5 Connecting an External Optical Drive (CD/DVD/Blu-ray)........................................... 11
2.3 THE USER INTERFACE............................................................................................................................ 11
2.4 FRONT AND REAR PORTS....................................................................................................................... 12
2.4.1 Front Ports..................................................................................................................12
2.4.2 Rear Ports ................................................................................................................... 12
2.4.2.1 DC IN Power Ports ...............................................................................................12
2.4.2.2 Dual 10GbE Ports ................................................................................................12
2.4.2.3 HDMI ...................................................................................................................13
2.5 TOUCH SCREEN ................................................................................................................................... 13
3: QUICK START ...................................................................................................... 14
3.0 QUICK START GUIDE............................................................................................................................. 14
3.0.1 ATA Security Locked Drives ........................................................................................14
3.1 IMAGING ............................................................................................................................................ 16
3.1.1 Step-By-Step Instructions –Imaging ..........................................................................17

Logicube Falcon® -NEO User’s Manual II
3.1.2 Imaging BitLocker Encrypted Drives...........................................................................18
3.1.3 Targeted/Logical Imaging...........................................................................................20
3.1.4 Imaging To or From a Network................................................................................... 21
3.1.5 Imaging Net Traffic..................................................................................................... 21
3.1.6 Parallel Imaging .......................................................................................................... 22
3.1.7 Drive Spanning............................................................................................................ 23
3.1.8 Blank Disk Check.........................................................................................................24
3.2 HASH /VERIFY .................................................................................................................................... 24
3.2.1 Step-By-Step Instructions –Drive Hash or Case Verify .............................................. 25
3.3 WIPE/FORMAT.................................................................................................................................... 26
3.3.1 Step-By-Step Instructions –Wipe/Format .................................................................26
3.4 PUSH ................................................................................................................................................. 27
3.4.1 Step-By-Step Instructions - Push ................................................................................ 28
3.5 TASK MACRO ...................................................................................................................................... 29
3.5.1 Step-By-Step Instructions –Task Macros................................................................... 29
3.6 FILE BROWSER..................................................................................................................................... 30
3.6.1 Step-By-Step Instructions –File Browser ................................................................... 30
3.7 LOGS ................................................................................................................................................. 30
3.7.1 Step-By-Step Instructions –Viewing or Exporting Logs ............................................. 31
3.7.2 Deleting Log Files........................................................................................................32
3.7.3 Accessing the Logs Over a Network ........................................................................... 33
3.8 STATISTICS.......................................................................................................................................... 34
3.9 MANAGE REPOSITORIES........................................................................................................................ 35
3.10 SYSTEM SETTINGS .............................................................................................................................. 35
3.11 NETWORK SETTINGS........................................................................................................................... 36
3.12 SOFTWARE UPDATES .......................................................................................................................... 36
3.13 POWER OFF...................................................................................................................................... 36
4: IMAGING ............................................................................................................ 37
4.0 IMAGING -INTRODUCTION .................................................................................................................... 37
4.1 MODE................................................................................................................................................ 37
4.2 SOURCE OR CASE ................................................................................................................................. 38
4.3 SETTINGS............................................................................................................................................ 38
4.3.1 Case Info..................................................................................................................... 39
4.3.2 HPA/DCO/ACS3/TRIM ................................................................................................40
4.3.2.1 DRIVE TRIM .........................................................................................................40
4.3.3 Error Handling ............................................................................................................43
4.3.3.1 Error Granularity .................................................................................................43
4.3.3.2 Reverse Read....................................................................................................... 43
4.3.4 Hash/Verification Method.......................................................................................... 44
4.3.5 File Image Method Settings........................................................................................ 45
4.3.6 Clone Method Settings............................................................................................... 45
4.3.7 Verify Hash .................................................................................................................46
4.3.8 Special Settings in File to File mode ...........................................................................46
4.3.8.1 Root Directory .....................................................................................................46
4.3.8.2 Output Format ....................................................................................................46
4.3.8.3 Filter Settings ......................................................................................................47
4.3.8.3.1 Path Filter.................................................................................................................................. 48

Logicube Falcon® -NEO User’s Manual III
4.3.8.3.2 Date Filter................................................................................................................................. 49
4.3.8.3.3 File Signature............................................................................................................................ 50
4.3.8.3.4 Keywords.................................................................................................................................. 50
4.3.9 Special Settings in Net Traffic to File Mode................................................................ 51
4.3.9.1 Segment Size .......................................................................................................51
4.3.9.2 Number of Segments...........................................................................................51
4.3.9.3 Segment Ring Buffer............................................................................................51
4.3.9.4 Chain Destinations ..............................................................................................52
4.4 DESTINATION/IMAGE FILE..................................................................................................................... 52
4.5 STARTING THE IMAGING OPERATION....................................................................................................... 53
5: TYPES OF OPERATIONS........................................................................................ 55
5.0 TYPES OF OPERATIONS -INTRODUCTION.................................................................................................. 55
5.1 IMAGING ............................................................................................................................................ 58
5.2 HASH /VERIFY .................................................................................................................................... 58
5.2.1 Mode ..........................................................................................................................59
5.2.2 Drives.......................................................................................................................... 60
5.2.3 Settings.......................................................................................................................60
5.2.3.1 Drive Hash Settings ...............................................................................................60
5.2.3.1.1 Hash Method............................................................................................................................. 61
5.2.3.1.2 Hash Values.............................................................................................................................. 61
5.2.3.1.3 LBA.......................................................................................................................................... 62
5.2.3.2 Case Verify...........................................................................................................62
5.2.4 Case Info..................................................................................................................... 63
5.3 WIPE /FORMAT .................................................................................................................................. 63
5.3.1 Destination .................................................................................................................64
5.3.2 Settings....................................................................................................................... 64
5.3.2.1 Secure Erase ........................................................................................................65
5.3.2.2 Wipe Patterns......................................................................................................65
5.3.2.2.1 Mode......................................................................................................................................... 65
5.3.2.2.2 HPA/DCO/ACS3...................................................................................................................... 66
5.3.2.2.3 LBA .......................................................................................................................................... 66
5.3.2.2.4 PASSES.................................................................................................................................... 66
5.3.2.3 Format.................................................................................................................67
5.3.3 Case Info..................................................................................................................... 68
5.4 PUSH ................................................................................................................................................. 69
5.4.1 Source......................................................................................................................... 69
5.4.2 Settings....................................................................................................................... 70
5.4.3 Destination .................................................................................................................70
5.5 TASK MACRO ...................................................................................................................................... 70
5.5.1 Tasks ...........................................................................................................................71
5.6 FILE BROWSER..................................................................................................................................... 74
5.6.1 Viewing Files from the Web Interface........................................................................76
5.6.2 Important Notes About Using the File Browser......................................................... 77
5.7 LOGS ................................................................................................................................................. 77
5.8 STATISTICS.......................................................................................................................................... 78
5.8.1 About Screen .............................................................................................................. 78
5.8.2 Adv. Drive Statistics.................................................................................................... 79
5.8.3 Network Interface Stats..............................................................................................79
5.8.4 Debug Logs ................................................................................................................. 79

Logicube Falcon® -NEO User’s Manual IV
5.8.5 Help ............................................................................................................................ 79
5.9 MANAGE REPOSITORIES........................................................................................................................ 80
5.9.1 Add/Remove...............................................................................................................80
5.9.1.1 Adding a Repository Using CIFS or SMB..............................................................81
5.9.1.2 Deleting/Removing a Repository ........................................................................83
5.9.2 iSCSI ............................................................................................................................83
5.9.3 Configuration.............................................................................................................. 84
5.10 SYSTEM SETTINGS .............................................................................................................................. 84
5.10.1 Profiles...................................................................................................................... 85
5.10.2 Passwords.................................................................................................................86
5.10.2.1 Setting Key Passwords.......................................................................................87
5.10.2.1.1 Config Lock Notes.................................................................................................................. 88
5.10.2.1.2 Forgotten password for any keys ............................................................................................ 89
5.10.2.2 User Account Passwords ...................................................................................90
5.10.3 Encryption ................................................................................................................91
5.10.4 Language/Time Zone................................................................................................ 92
5.10.4.1 Language...........................................................................................................92
5.10.4.2 Time Zone..........................................................................................................93
5.10.5 Display ......................................................................................................................94
5.10.6 Notifications .............................................................................................................94
5.11 NETWORK SETTINGS........................................................................................................................... 95
5.11.1 Interfaces.................................................................................................................. 95
5.11.1.1 Configuring a Static IP address .........................................................................95
5.11.1.2 Enabling/Disabling Network Services ...............................................................96
5.11.2 HTTP Proxy................................................................................................................97
5.11.2.1 Server ................................................................................................................97
5.11.2.2 Username/Password.........................................................................................97
5.12 SOFTWARE UPDATE............................................................................................................................ 97
5.13 POWER OFF...................................................................................................................................... 98
6: PREVIEWING DRIVES........................................................................................... 99
6.0 PREVIEWING DRIVES -INTRODUCTION..................................................................................................... 99
6.1 FILE BROWSER................................................................................................................................... 100
6.2 COMPUTER +FILE BROWSER ............................................................................................................... 100
6.3 SMB ............................................................................................................................................... 101
6.4 ISCSI ............................................................................................................................................... 101
7: DRIVE ENCRYPTION AND DECRYPTION .............................................................. 103
7.0 DRIVE ENCRYPTION/DECRYPTION -INTRODUCTION ................................................................................. 103
7.1 ENCRYPTING A DESTINATION ............................................................................................................... 103
7.1.1 Step-By-Step Instructions......................................................................................... 104
7.1.2 Using Previously Encrypted Destination Drives........................................................ 104
7.2 DECRYPTING A FALCON-NEO ENCRYPTED DRIVE WITH A FALCON-NEO...................................................... 105
7.3 DECRYPTING A FALCON-NEO ENCRYPTED DRIVE WITHOUT A FALCON-NEO................................................ 106
7.3.1 Which Decryption Software to Use? ........................................................................107
7.3.2 Decrypting Using VeraCrypt .....................................................................................107
7.3.3 Decrypting Using TrueCrypt ..................................................................................... 109
7.3.4 Decrypting using FreeOTFE ......................................................................................112

Logicube Falcon® -NEO User’s Manual V
8: UPDATING/LOADING/RE-LOADING SOFTWARE ................................................. 116
8.0 IMPORTANT NOTES ON UPDATING/LOADING/RE-LOADING SOFTWARE....................................................... 116
8.1 UPDATING/LOADING/RE-LOADING SOFTWARE –INTRODUCTION .............................................................. 116
8.2 UPDATING/LOADING/RE-LOADING SOFTWARE INSTRUCTIONS .................................................................. 116
8.2.1 From Network (Over the Internet)........................................................................... 117
8.2.2 From USB Drive (Through a Software File Download) .............................................117
8.3 FIRMWARE LOADING INSTRUCTIONS ..................................................................................................... 118
9: REMOTE OPERATION ........................................................................................ 120
9.0 REMOTE OPERATION -INTRODUCTION .................................................................................................. 120
9.1 WEB INTERFACE ................................................................................................................................ 120
9.2 COMMAND LINE INTERFACE (CLI)......................................................................................................... 121
9.2.1 Connecting via Telnet...............................................................................................121
9.2.2 Connecting via SSH................................................................................................... 121
9.3 ZERO CONFIGURATION NETWORKING (ZEROCONF) ................................................................................. 122
9.4 COPYING PROFILES FROM ONE FALCON-NEO TO ANOTHER...................................................................... 122
9.4.1 Step-By-Step –Copying Profiles ...............................................................................122
10: VIEWING SOURCE AND DESTINATION DRIVES OVER A NETWORK .................... 124
10.0 VIEWING DRIVES OVER A NETWORK –OVERVIEW................................................................................. 124
10.1 VIEWING SOURCE OR DESTINATION DRIVES OVER THE NETWORK USING SMB.......................................... 124
10.1.1 Step-By-Step –Viewing Source or Destination Drives ........................................... 124
10.2 VIEWING SOURCE DRIVES OVER THE NETWORK USING ISCSI.................................................................. 126
10.2.1 Configuring the iSCSI Initiator ................................................................................126
11: NET TRAFFIC IMAGING .................................................................................... 128
11.0 NET TRAFFIC INTRODUCTION ............................................................................................................. 128
11.1 NET TRAFFIC SETTINGS ..................................................................................................................... 128
11.2 NET TRAFFIC IMAGING NOTES............................................................................................................ 130
12: USB BOOT CLIENT............................................................................................ 131
12.0 USB BOOT CLIENT INTRODUCTION ..................................................................................................... 131
12.1 REQUIREMENTS ............................................................................................................................... 131
12.2 CREATING THE USB BOOT CLIENT ...................................................................................................... 131
12.3 USING THE USB BOOT CLIENT ........................................................................................................... 134
13: PRINTING........................................................................................................ 136
13.0 PRINTING –INTRODUCTION............................................................................................................... 136
13.1 PRINTING FROM THE WEB INTERFACE ................................................................................................. 136
13.2 CONFIGURING A LOCAL OR NETWORKED PRINTER ................................................................................. 136
13.2.1 Step-By-Step –Configuring a Local or Networked Printer..................................... 136
14: OPTIONS......................................................................................................... 138
14.0 OPTIONS –INTRODUCTION................................................................................................................ 138
14.1 THUNDERBOLT™3/USB-C I/O CARD................................................................................................. 138
14.1.1 Installing the Thunderbolt 3/USB-C I/O Card.........................................................139
14.2 FIREWIRE MODULE.......................................................................................................................... 141

Logicube Falcon® -NEO User’s Manual VI
14.2.1 Connecting/Disconnecting the FireWire Module...................................................142
14.2.2 Disconnecting the FireWire Module....................................................................... 143
14.3 FALCON-NEO SCSI MODULE ............................................................................................................ 143
14.3.1 Connecting the SCSI Module to the Falcon-NEO.................................................... 144
14.3.2 Disconnecting Drives from the SCSI Module..........................................................144
14.3.3 Disconnecting the SCSI Module.............................................................................. 145
14.4 USB 3.0 TO SATA ADAPTER ............................................................................................................. 146
14.4.1 USB Power Cable ....................................................................................................146
14.4.2 USB 3.0 to SATA Kit.................................................................................................147
15: FREQUENTLY ASKED QUESTIONS..................................................................... 148
15.0 FAQS............................................................................................................................................ 148
16: INDEX ............................................................................................................. 151
TECHNICAL SUPPORT INFORMATION............................................................................................................. 152
SOFTWARE ATTRIBUTION............................................................................................................................ 152

Logicube Falcon®-NEO User’s Manual 1
1: Introduction
1.0 Introduction to the Logicube Falcon-NEO
The next-generation of our ground-breaking Falcon® forensic imager, the Falcon®-NEO has been
engineered specifically for digital forensic investigations. Delivering high performance and advanced
features, the Falcon-NEO is designed to meet the challenges of digital investigations head-on. Efficient
and secure digital evidence collection is accomplished with a feature-set that provides sophisticated
functionality with a goal to shorten acquisition time. Future-focused, the Falcon-NEO sets new standards
in digital forensic imaging technology.
1.1 Features
The Falcon®-NEO is an extremely fast forensic imaging solution. It achieves imaging speeds
surpassing 50GB/min and can clone PCIe to PCIe at speeds of 90 GB/min.
Image and verify to multiple image formats; native copy, .dd image, .dmg image, e01 and
ex01. The Falcon-NEO provides MD5, SHA1, SHA256, and dual hash (MD5+SHA1) authentication
at extremely fast speeds.
Falcon-NEO formats destination drives to NTFS, exFAT, EXT4, or FAT32 file systems. The unit
supports imaging from source drives formatted to any major file system.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 2
Four Write-blocked source ports include 2 SAS/SATA, 1 USB 3.0, 1 PCIe. Eight Destination
ports include 2 SAS/SATA, 2 SATA, 3 USB 3.0 and 1 PCIe. All destination ports are built-in to the
unit.
Thunderbolt™/USB 3.1 Gen 2/USB-C I/O card. The card can be installed in any of the Falcon-
NEO’s I/O card ports; two write-protected source I/O ports or 1 destination I/O port. The card
provides the ability to image directly to or from Thunderbolt external drives and enclosures and
also supports imaging to/from USB 3.1 Gen 2 external drives.
Two 10GbE network ports provide fast network imaging performance. Image to/from a network
repository using CIFS protocol or iSCSI. Connect to a 10GbE NAS as a source and connect to a
network using the 2nd 10GbE port to minimize bottlenecks. Two ports provide a secure method to
isolate the source network/NAS from the destination NAS/network.
Networking Feature. Use the Falcon-NEO to image to/from a network repository using CIFS
protocol or iSCSI. Image to an external storage device such as a NAS, using the 10 GbE, USB 3.0 or
SAS/SATA connection.
Network Capture. Capture network traffic, internet activity and VOIP. Sniff data on a network and
store captured packets on a hard drive connected to Falcon-NEO. Span the Net Traffic to File
images over two or more Destination drives. Captured data is saved to a .pcapng file format.
Multi-Task. Image simultaneously from multiple sources to multiple destinations including a
network repository. Supports imaging to one location while simultaneously hashing and/or
wiping a second drive. Users can perform up to 5 tasks concurrently. Little or no speed
degradation when imaging from two sources to two destinations.
Task Macro. Set specific tasks to be performed sequentially; first wipe the destination drive then
hash the source drive then image the source drive. All tasks within the macro will be performed
automatically.
Parallel Imaging. Perform multiple imaging tasks from the same source drive to multiple
destinations using different imaging formats.
Targeted Imaging/Logical Imaging shortens acquisition time. Create a logical image by using
pre-set filters, custom filters, file signature filters, and/or keyword search function to select and
acquire only the specific files you need. An MFT report can be generated that contains a potential
deleted file list. Format output to L01, LX01, ZIP or directory tree.
Partition Imaging. Select and image specific partitions on the source drive.
Write-Blocked Drive Preview. The file browser feature provides logical access to source or
destination drives connected to Falcon-NEO. Users can view the drive’s partitions and contents
and view text files, jpeg, PDF, XML, HTML files directly on the Falcon-NEO. Preview over a network
via SMB or iSCSI (as an iSCSI target). 3rd party analysis tools can be used with SMB or iSCSI
methods.
The Falcon-NEO provides built-in support for SAS/SATA/USB3/PCIe storage devices.
Thunderbolt™ external storage solutions are supported with an optional I/O card. PCIe M.2,
including NVMe drives, PCIe cards, IDE drives and flash drives are supported with optional
adapters. SCSI and FireWire® devices are supported with optional modules that connect to the
PCIe ports on Falcon-NEO. mSATA, micro SATA and eSATA drives are supported with adapters
included with the unit.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 3
Concurrent Image+Verify. Imaging and verifying concurrently takes advantage of destination
hard drives that may be faster than the source hard drive. Duration of total image+verify process
time may be reduced by up to half.
BitLocker Support. Image source drives that have been encrypted using BitLocker. Decrypt
partitions (requires the BitLocker password) and then image the selected partitions.
Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST
recommended XTS-AES-256 cipher mode. Decryption can be performed using the Falcon-NEO
or by using open source software programs such as VeraCrypt, TrueCrypt or FreeOTFE.
Network Push Feature. Push evidence files from destination drives connected to Falcon-NEO or
from a Falcon-NEO repository to a network location. An MD5 or SHA hash is performed during
the push process.
Image from a Mac® computer with USB-C ports using a USB-C to USB-A cable and Target
Disk Mode. Users can also image from Mac computers using Logicube’s USB boot device. Create
a forensic bootable USB flash drive to image a source drive from a Mac on the same network
without booting the Mac computer’s native OS. The Falcon-NEO supports imaging from
MacBook Pro® systems.
Image from a PC/laptop without removing hard drives. Create a forensic bootable USB flash
drive to image a source drive from a computer on the same network without booting the
computer’s native OS. Supports Surface Pro 4 and above tablets.
Reverse Read settings instructs the Falcon-NEO to skip past a bad sector (based on error
granularity settings) then read backwards, potentially capturing data that may not necessarily be
read when skipping the entire block.
Image Restore. File to drive mode restores DD, DMG, E01, EX01 images created by the Falcon-
NEO to another drive.
Remote Operation. Connect to a networked Falcon-NEO from your PC using a web browser to
manage all operations remotely. This feature provides automatic page scaling for iPad type
devices and authentication/password for increased security.
Features an internal, removable storage drive that stores OS and audit trail/logs. The drive is
easily removed for secure/classified locations.
Wipe drives to DoD specifications or use secure erase to wipe drives. Speeds of 30GB/min for
SATA type drives and 72GB/min for PCIe drives.
Audit Trail/Log files provide detailed information on each operation. Log files can be viewed on
Falcon-NEO or via a web browser, exported to XML, HTML or PDF format to a USB enclosure.
Users can print the log files directly from their PC when connected to Falcon-NEO via a web
browser.
Additional features include HPA/DCO capture, save configuration settings and set password-
protected user profiles, image from CD/DVD/Blu-Ray media, drive spanning, color touchscreen
display, HDMI port, USB 3.0 ports can be used for keyboard, mouse, or printer connectivity, blank
disk check feature, drive trim feature, and S.M.A.R.T. data.
* The Forensic Falcon-NEO achieves speeds surpassing 50GB/min using solid state “suspect”drives that contain a freshly installed
Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The
specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging
process may affect the achieved speeds.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 4
1.2 In the Box
The Falcon-NEO is shipped in a soft-sided carrying case that includes:
The Logicube Falcon-NEO unit
AC adapter/Power supply and US power cord
QTY: 6 –SAS/SATA data & power cables
QTY: 2 –CAT7 6FT network cables
eSATA to SATA cable (18”)
mSATA to SATA adapter
micro SATA adapter
QTY: 6 –6-pin power plugs for use with eSATA devices
CD-ROM containing the user’s manual
1.3 Options
The following options are available for the Falcon-NEO:
SCSI module. The module provides 1 SCSI port that can be used as either source (write-protected)
or destination. Provides support for 68-pin SCSI drives, with optional adapters available for 80-pin
and 50-pin drives.
FireWire® module. The module provides 1 FireWire® port that can be used as either source
(write-protected) or destination. Connects to the PCIe ports on the Falcon-NEO.
The Thunderbolt™ 3/USB-C I/O card provides support for Thunderbolt storage enclosures.
Connects to any of Falcon-NEOs I/O ports, including two write-protected source I/O ports and 1
destination I/O port.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 5
PCIe adapter kit. Includes adapters for M.2 PCIe, M.2 SATA, M.2 NVMe, mSATA, PCIe and mini-
PCIe cards.
USB 3.0 4-port hub.
USB 3.0 to SATA adapter allows you to connect SATA drives to the USB 3.0 ports.
USB Power Cable. Eliminates the need for additional power supplies when using USB to SATA
adapters connected to USB ports on the Falcon-NEO. Connect up to 3 USB to SATA adapters.
Available as a kit bundled with 3 USB 3.0 to SATA adapters.
2.5”/3.5” IDE ,1.8” IDE to SATA, 1.8” ZIF adapters.
Flash media reader
18” extended length SAS/SATA cable set
Extended 1-year and 2-year warranties
Hard case (Pelican type)
1.4 Specifications
WARNINGS:
Never connect a suspect drive to the Destination ports as data
may be overwritten.
Incorrectly connecting the suspect drive to the system can result
in data on the suspect drive to be lost forever.
Avoid dropping the Logicube device or subjecting it to sharp jolts.
When in use, place it on a flat surface.
Keep the unit dry. If the Logicube device needs to be cleaned, use
a lightly damp, lint free cloth. Avoid using soap or other cleaning
agents particularly those containing bleach, ammonia, alcohol or
other harsh chemicals.
Do not attempt to service or open the Logicube device. Doing so
may void the warranty. If the unit requires service, please
contact Logicube Technical Support for assistance.

Logicube Falcon®-NEO User’s Manual 6
2: Getting Started
2.0 Overview of the Falcon-NEO
Special Icons –Throughout this manual, there are two icons that can be seen. Please
pay close attention when any of these two icons are found. These icons highlight
additional information or importa`nt warnings on specific topics.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 7

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 8
2.1 Turning the Falcon-NEO On and Off
The Falcon-NEO has two DC IN ports located in the back of the device. Any of these two ports can be
used. The second DC IN port is available for possible future increases in power requirements.
The Falcon-NEO also comes with a 12V grounded, 21A (output DC) power supply that connects to the
back of the device. Attach the included power supply to the any one of the two DC power ports in the
back of the Falcon-NEO.
To turn the Falcon-NEO on, press and immediately release the power button located on the top right
corner of the Falcon-NEO. The Falcon-NEO will turn on and start the boot process.
It is normal for the fans
to slow down after the
initial start-up sequence.
There are two ways of turning the Falcon-NEO off:
1. Press and immediately release the power button on the top right corner of the Falcon-NEO. The
Falcon-NEO will begin the shutdown process and after a few seconds, the display and fans will
turn off.
2. Using the Graphical User Interface (GUI) either on the touch screen or via a browser through a
remote connection, navigate to the Power Off screen and tap the Power Off icon.
2.2 Connecting Various Drive Types
The Falcon-NEO supports a variety of drive types including the following types:
SATA
1.8” Micro SATA
M.2 (NVMe, AHCI, and SATA –optional)
USB
2.5” and 3.5” PATA/IDE (optional)
mPCIe (optional)
SAS
1.8” ZIF (optional)
SCSI (optional)
eSATA
1.8” PATA/IDE (optional)
FireWire (optional)
mSATA
Flash media (optional)
Thunderbolt drives and enclosures
(optional)
When connecting/disconnecting drives using drive adapters, it is
recommended to keep the drive connected to the adapter, then
connect/disconnect the adapter to/from the SAS/SATA cable, or
connect/disconnect the SAS/SATA cable from the drive bay.
2.2.1 Connecting Source Drives
Source drives (also called suspect drives) must be connected to the left side of the
Falcon-NEO. These ports are write-protected and are labeled as follows:
SAS_S1 –SAS/SATA data port for the Source 1 position.
SAS_S2 –SAS/SATA data port for the Source 2 position.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 9
USB_S1 –USB 3.0 Source port.
PCIe_S1 –PCIe Source port (Depending on the type of PCIe drive, the optional
PCIe kit, part number F-ADP-PCI-FN-KT may be required).
Not labeled: Two 6-pin power ports for SAS_S1 and SAS_S2 that have lines
corresponding to the proper data port.
Not labeled: Two I/O ports for use with optional Logicube I/O expansion cards.
The Falcon-NEO Source ports are hot swappable (including the PCIe ports).
Although the Falcon-NEO ports are hot swappable, some drives
are not hot swappable. Please check with the drive manufacturer
to find out if the drive being used does not support hot swapping.
Source drives do not have to be connected in any order. For example, a single SATA
Source drive does not have to be connected to the SAS_S1 port. It can be connected to
the SAS_S2 port without having anything connected to the SAS_S1 port.
Never connect a suspect or Source drive to the
Destination ports of the Falcon-NEO. Data may be
overwritten if a drive is connected to a Destination port.
Any combination of drives can be connected. For example, one SAS drive, one SATA
drive, one USB drive, and one PCIe drive can all be connected at the same time.
2.2.2 Connecting Destination Drives
Destination drives (also called evidence drives) must be connected to the right side of the
Falcon-NEO. These ports are labeled as follows:
SAS_D1 –SAS/SATA data port for the Destination 1 position.
SAS_D2 –SAS/SATA data port for the Destination 2 position.
SATA_D3 –SATA only data port for the Destination 3 position.
SATA_D4 –SATA only data port for the Destination 4 position.
USB_D1 –USB 3.0 Destination port.

GETTING STARTED
Logicube Falcon®-Neo User’s Manual 10
PCIe_D1 –PCIe Destination port (Depending on the type of PCIe drive, the
optional PCIe kit, part number F-ADP-PCI-FN-KT may be required).
Not labeled: Four 6-pin power ports for SAS_D1, SAS_D2, SATA_D3, and
SATA_D4 that have lines corresponding to the proper data port.
Not labeled: One I/O port for use with optional Logicube I/O expansion cards.
Not shown: Two front USB 3.0 ports are
available as Destination ports or input device
ports for use with wired keyboards or mice.
The Falcon-NEO Destination ports are hot swappable (including the PCIe ports).
Although the Falcon-NEO ports are hot swappable, some drives
are not hot swappable. Please check with the drive manufacturer
to find out if the drive being used does not support hot swapping.
Destination drives do not have to be connected in order. For example, a single SATA
Destination drive does not have to be connected to the SAS_D1 port. It can be
connected to the SATA_D4 port without having anything connected to any of the other
ports.
Any combination of drives can be connected. For example, four SATA drives, one USB
drive, and one PCIe drive can all be connected at the same time.
Never connect a suspect or Source drive to the
Destination ports of the Falcon-NEO. Data may be
overwritten if a drive is connected to a Destination port.
2.2.3 Using USB/eSATA Drives or Enclosures
It is recommended to leave the drive inside the enclosure. These enclosures may have an
on-board controller that may be necessary to read the drive properly. Taking the drive
out of the enclosure could cause any device (including computers) not to read the drive
contents properly.