Logicube Falcon-NEO Installation and operating instructions

Application Note
Falcon-NEO System Restore v3.2u3 Page 1 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
Falcon®-NEO System Restore
1.0 INTRODUCTION ........................................................................................................................ 1
2.0 WARNING: LOG FILES WILL BE DELETED .......................................................................... 2
2.1 REQUIREMENTS FOR BACKING UP THE LOG FILES –FALCON-NEO DOES NOT BOOT........................................2
2.2 BACKING UP THE LOG FILES –FALCON-NEO DOES NOT BOOT........................................................................2
3.0 USING A BOOTABLE USB FLASH DRIVE WITH THE SYSTEM RESTORE ......................... 3
4.1 REQUIREMENTS ..............................................................................................................................................3
4.2 CREATING THE RECOVERY USB FLASH DRIVE..................................................................................................4
4.3 USING THE RECOVERY FLASH DRIVE ................................................................................................................7
4.0 USING THE BUILT-IN SYSTEM RESTORE ........................................................................... 9
3.1 BUILT-IN SYSTEM RESTORE (STEP-BY-STEP)...................................................................................................9
5.0 FIRMWARE UPDATE ........................................................................................................... 12
1.0 Introduction
This document provides instructions on how to perform a system restore on the Forensic Falcon-NEO. There
are two ways to restore the Falcon-NEO:
•Using a bootable USB flash drive with the system restore
•Using the built-in system restore

Application Note
Falcon-NEO System Restore v3.2u3 Page 2 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
2.0 WARNING: Log files will be deleted
Performing the system restore will delete all of the log files. If desired, the log files can be backed up before the
recovery process.
If the Falcon-NEO boots up properly, the audit log files can be backed up easily. See Section 3.7.1 (Viewing or
exporting logs) or Section 3.7.4 (Accessing logs over a network) in the user’s manual on how to back up the
log files if the Falcon-NEO boots up properly.
If the Falcon-NEO does not boot up properly, there is a possibility the log files may be backed up by following
the steps in this section.
2.1 Requirements for backing up the log files –Falcon-NEO does not boot
•The Falcon-NEO connected to a network
•A computer with a Secure FTP (SFTP) client (E.g. FileZilla or WinSCP) connected to the same
network
2.2 Backing up the log files –Falcon-NEO does not boot
The outlined steps in this section use an open-source SFTP client called FileZilla. Other SFTP clients
can be used.
1. Make sure the Logicube device is connected to a network accessible by the computer with the
SFTP client and if there is an error message, leave the error message on the screen.
2. Open FileZilla. Similar to the screenshot below, enter the following information then click the
Quickconnect button:
•Host: The IP address or hostname of the Logicube device.
•Username: logicube
•Password: logicube
•Port: 22
3. A window may appear labeled Unknown host key. If this window appears, click the OK button.

Application Note
Falcon-NEO System Restore v3.2u3 Page 3 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
4. On the right window pane, change the ‘Remote site’ to /var/log/ong_audit then press the Enter
key.
5. On the left window pane, change the ‘Local site’ to where you want to download the files. In the
example below, it will be downloaded to C:\Downloads.
6. On the right side (Remote site), the /var/log/ong_audit directory has all of the log files. Highlight
all the files and folders. There are two ways to download the files:
a. Right-click the mouse button and select Download, or
b. While holding down the left mouse button, drag and drop the Evm* files to the left
window pane.
7. The log files should now be backed up to your computer.
3.0 Using a bootable USB flash drive with the system restore
For each software release of the Falcon-NEO, a new system restore is available.
4.1 Requirements
•Your own 8 GB or larger capacity USB flash drive
•A computer with a Windows Operating System
•A wired USB keyboard

Application Note
Falcon-NEO System Restore v3.2u3 Page 4 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
4.2 Creating the recovery USB flash drive
Here are the steps to prepare the flash drive with the software necessary to be bootable:
It is recommended to use Chrome or Firefox
to download the files. Internet Explorer and
Edge do not download *.img files properly.
1. Go to http://updates.logicube.com/falcon-neo-recovery. Look for the following two files:
•The Falcon-NEO image file (a file with a *.img extension)
•win32diskimager-v1.0.0-binary.zip –An open source tool used for writing images to
USB flash drives or SD/CF cards
Balena Etcher may be used instead of
Win32DiskImager. The instructions in
this section are for Win32DiskImager.
2. Download both files. If the image file will not download, right-click on the link and use the ‘Save
Target As…’ or ‘Save Link As’ option and make sure it is saved with the *.img file extension.
3. Extract all the files in the win32diskimager-v1.0.0-binary.zip file to a folder or directory of your
choosing.
4. Connect a USB flash drive that is at least 8 GB in capacity to the computer where the software
was downloaded. It is recommended that all other USB drives are unplugged.
The contents of the USB flash drive will be overwritten. If there is data
on the USB flash drive that should not be deleted, back up the contents
of the USB flash drive or use another USB flash drive for this procedure.
5. In the win32diskimager-v1.0.0-binary folder where the software was extracted, run the file
Win32DiskImager.exe. The Win32 Disk Imager window will appear.

Application Note
Falcon-NEO System Restore v3.2u3 Page 5 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
6. Click the folder icon to select a disk image.
7. In the folder where the files were downloaded (in step 2), select the recovery file and click the
Open icon. Note the screenshot below shows a different file name.
8. The Image file should now be seen in the Win32 Disk Imager screen under ‘Image File’.

Application Note
Falcon-NEO System Restore v3.2u3 Page 6 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
9. Under ‘Device’, select the drive letter for the USB flash drive that was connected during step 3
then click the Write icon.
10. A confirmation screen will appear. Make sure that the “Target Device” is set to the correct drive
letter. If it is the correct drive letter, click Yes to continue. If it is showing the wrong drive letter,
click No. This will take you back to the previous screen where you can select the correct drive
letter (back to step 9).
11. The USB flash drive is now being prepared and the progress bar should be advancing.
12. When it is finished, a prompt should appear stating the write was
successful. Click the OK icon to continue. Close the Win32 Disk
Imager window. The USB flash drive is now ready to be used.
13. Disconnect the USB flash drive from the computer.

Application Note
Falcon-NEO System Restore v3.2u3 Page 7 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
4.3 Using the recovery flash drive
1. Turn the Falcon-NEO OFF and disconnect all drives (and any drive adapters) connected to all
source and destination ports.
2. Insert the recovery USB flash drive to one of the front USB ports.
3. Connect a USB keyboard to the other front USB port.
4. Turn the Falcon-NEO on. The Falcon-NEO will display a logo, then beep.
5. Immediately after the beep, press and release the F7 key. A boot menu should appear.
6. Using the arrow keys on the keyboard, select the USB flash drive with UEFI in the front of the
name of the USB flash drive. Do not select “UEFI OS:” if it is available.
7. The System Restore will load. When the System Recovery fully loads, the following screen will
appear. Tap Restore.

Application Note
Falcon-NEO System Restore v3.2u3 Page 8 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
8. A confirmation screen will appear. Tap Yes to continue with the System Restore.
9. The system restore will begin. The entire process may take up to 10 (ten) minutes to complete.
10. When finished, the following screen will appear. Tap OK.
11. The main System Restore screen will apper. Tap Power Off.

Application Note
Falcon-NEO System Restore v3.2u3 Page 9 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
12. A confirmation screen will appear. Tap Yes.
13. The Falcon-NEO should gracefully shut down and will turn itself off. The System Restore
process should now be complete. Disconnect the USB keyboard and turn the Falcon-NEO on to
make sure it boots properly.
14. The latest software should now installed. Follow Section 5.0 to check for a firmware update.
4.0 Using the built-in system restore
Use this method only if you have previously performed the System Restore
version 3.2u3. If you are not sure whether you have previously performed
the System Restore version 3.2u3, please use the method in Section 4.0.
The Falcon-NEO has a built-in system restore. This method requires a USB keyboard.
3.1 Built-in system restore (step-by-step)
1. Disconnect all drives and adapters connected to the Source or Destination ports.
2. Connect a USB keyboard to one of the two front USB ports.
3. Turn the Falcon-NEO on. The Falcon-NEO will display a logo, then beep, then on the top-left of
the screen a 3, 2, 1 countdown will appear
4. When the 3, 2, 1 countdown appears, press and release the Esc key on the keyboard. A grub
bootloader menu will appear.
5. Use the arrow keys on the keyboard and highlight System Recovery then press the Enter key.

Application Note
Falcon-NEO System Restore v3.2u3 Page 10 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
6. After the System Recovery loads, the following screen should appear. Tap Restore to continue.
If you see text that shows Continue with system restore
operation? (y/n) instead of the GUI as seen above, stop and follow
the instructions in Section 4.0 to use a bootable USB flash drive.
7. A confirmation screen will appear. Tap Yes to continue with the System Restore.
8. The system restore will begin. The entire process may take up to 10 (ten) minutes to complete.

Application Note
Falcon-NEO System Restore v3.2u3 Page 11 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
9. When finished, the following screen will appear. Tap OK.
10. The main System Restore screen will appear. Tap Power Off.
11. A confirmation screen will appear. Tap Yes.
12. The Falcon-NEO should gracefully shut down and will turn itself off. The System Restore
process should now be complete. Disconnect the USB keyboard and turn the Falcon-NEO on to
make sure it boots properly.
13. The latest software should now installed. Follow Section 5.0 to check for a firmware update.

Application Note
Falcon-NEO System Restore v3.2u3 Page 12 of 12
Revised date: December 2020
Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:[phone]• fax:[phone]
www.logicube.com
5.0 Firmware Update
Falcon-NEO software releases may contain a firmware update. This section provides instructions on how to
check if a firmware update is available, and how to perform the firmware update.
1. After the System Restore (and after restarting the Falcon-NEO), from the main menu, locate and tap
Software Updates on the left side.
2. Tap the Firmware Update tab. One of two screens will appear:
a. FIRMWARE UPGRADE AVAILABLE –Tap the Update icon. A message will appear: “FIRMWARE
UPDATE COULD TAKE UP TO A FEW MINUTES TO COMPLETE; PLEASE DO NOT INTERRUPT
POWER DURING THIS TIME. ON COMPLETION THE UNIT WILL AUTO-RESTART AND CONFIRM
THE UPDATE.” Tap the OK icon to start the firmware update process.
When the OK icon is tapped, the screen may appear
to do nothing. Do not keep tapping the OK icon. The
firmware update will take no more than 60 seconds.
b. FIRMWARE UPGRADE NOT AVAILABLE –This message will appear if the device does not
require a firmware update. No further action is necessary if this message appears.