Logicube F-FALCON-SA User manual

Logicube Forensic Falcon™ User Manual I
Forensic Falcon™User’s Manual
PART # F-FALCON-SA
Logicube, Inc.
Chatsworth, CA 91311
USA
Phone: [phone]
Fax: [phone]
Version: 3.1
Date: 01/31/17
MAN-FALCON

Logicube Forensic Falcon™ User Manual I
Limitation of Liability and Warranty Information
Logicube Disclaimer
LOGICUBE IS NOT LIABLE FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING, BUT NOT
LIMITED TO PROPERTY DAMAGE, LOSS OF TIME OR DATA FROM USE OF A LOGICUBE PRODUCT, OR ANY
OTHER DAMAGES RESULTING FROM PRODUCT MALFUNCTION OR FAILURE OF (INCLUDING WITHOUT
LIMITATION, THOSE RESULTING FROM: (1) RELIANCE ON THE MATERIALS PRESENTED, (2) COSTS OF
REPLACEMENT GOODS, (3) LOSS OF USE, DATA OR PROFITS, (4) DELAYS OR BUSINESS INTERRUPTIONS, (5)
AND ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
(OR FROM DELAYS IN SERVICING OR INABILITY TO RENDER SERVICE ON ANY) LOGICUBE PRODUCT.
LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ALL PRODUCTS. HOWEVER, THE
CUSTOMER IS RESPONSIBLE TO VERIFY THAT THE OUTPUT OF LOGICUBE PRODUCT MEETS THE
CUSTOMER’S QUALITY REQUIREMENT. THE CUSTOMER FURTHER ACKNOWLEDGES THAT IMPROPER
OPERATION OF LOGICUBE PRODUCT AND/OR SOFTWARE, OR HARDWARE PROBLEMS, CAN CAUSE LOSS
OF DATA, DEFECTIVE FORMATTING, OR DATA LOADING. LOGICUBE WILL MAKE EFFORTS TO SOLVE OR
REPAIR ANY PROBLEMS IDENTIFIED BY CUSTOMER, EITHER UNDER WARRANTY OR ON A TIME AND
MATERIALS BASIS.
Warranty
DISCLAIMER
IMPORTANT - PLEASE READ THE TERMS OF THIS AGREEMENT CAREFULLY. BY INSTALLING OR USING
LOGICUBE PRODUCTS, YOU AGREE TO BE BOUND BY THIS AGREEMENT.
IN NO EVENT WILL LOGICUBE BE LIABLE (WHETHER UNDER THIS AGREEMENT, RESULTING FROM THE
PERFORMANCE OR USE OF LOGICUBE PRODUCTS, OR OTHERWISE) FOR ANY AMOUNTS REPRESENTING
LOSS OF PROFITS, LOSS OR INACCURACY OF DATA, LOSS OR DELAYS OF BUSINESS, LOSS OF TIME, COSTS
OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES, OR TECHNOLOGY, PROPERTY DAMAGE, OR
INDIRECT, CONSEQUENTIAL, OR PUNITIVE DAMAGES OF A PURCHASER OR USER OF LOGICUBE PRODUCTS
OR ANY THIRD PARTY. LOGICUBE’S AGGREGATE LIABILITY IN CONTRACT, TORT, OR OTHERWISE
(WHETHER UNDER THIS AGREEMENT, RESULTING FROM THE PERFORMANCE OR USE OF LOGICUBE
PRODUCTS, OR OTHERWISE) TO A PURCHASER OR USER OF LOGICUBE PRODUCTS SHALL BE LIMITED TO
THE AMOUNT PAID BY THE PURCHASER FOR THE LOGICUBE PRODUCT. THIS LIMITATION OF LIABILITY
WILL BE EFFECTIVE EVEN IF LOGICUBE HAS BEEN ADVISED OF THE POSSIBILITY OF ANY SUCH DAMAGES.
LOGICUBE MAKES EVERY EFFORT TO ENSURE PROPER OPERATION OF ITS PRODUCTS. HOWEVER, THE
PURCHASER IS RESPONSIBLE FOR VERIFYING THAT THE OUTPUT OF A LOGICUBE PRODUCT MEETS THE
PURCHASER’S REQUIREMENTS. THE PURCHASER FURTHER ACKNOWLEDGES THAT IMPROPER OPERATION
OF LOGICUBE PRODUCTS CAN CAUSE LOSS OF DATA, DEFECTIVE FORMATTING, OR DEFECTIVE DATA
LOADING. LOGICUBE WILL MAKE EFFORTS TO SOLVE OR REPAIR ANY PROBLEMS IDENTIFIED BY
PURCHASER, EITHER UNDER THE WARRANTY SET FORTH BELOW OR ON A TIME AND MATERIALS BASIS.

Logicube Forensic Falcon™ User’s Manual II
LIMITED WARRANTY
FOR ONE YEAR FROM THE DATE OF SALE (THE “WARRANTY PERIOD”) LOGICUBE WARRANTS THAT THE
PRODUCT (EXCLUDING CABLES, ADAPTERS, AND OTHER “CONSUMABLE” ITEMS) IS FREE FROM
MANUFACTURING DEFECTS IN MATERIAL AND WORKMANSHIP. THIS LIMITED WARRANTY COVERS
DEFECTS ENCOUNTERED IN THE NORMAL USE OF THE PRODUCT DURING THE WARRANTY PERIOD AND
DOES NOT APPLY TO: PRODUCTS DAMAGED DUE TO PHYSICAL ABUSE, MISHANDLING, ACCIDENT,
NEGLIGENCE, OR FAILURE TO FOLLOW ALL OPERATING INSTRUCTIONS CONTAINED IN THE OPERATING
MANUAL; PRODUCTS WHICH ARE MODIFIED; PRODUCTS WHICH ARE USED IN ANY MANNER OTHER THAN
THE MANNER FOR WHICH THEY WERE INTENDED, AS SET FORTH IN THE OPERATING MANUAL; PRODUCTS
WHICH ARE DAMAGED OR DEFECTS CAUSED BY THE USE OF UNAUTHORIZED PARTS OR BY
UNAUTHORIZED SERVICE; PRODUCTS DAMAGED DUE TO UNSUITABLE OPERATING OR PHYSICAL
CONDITIONS DIFFERING FROM THOSE RECOMMENDED IN THE OPERATING MANUAL OR PRODUCT
SPECIFICATIONS PROVIDED BY LOGICUBE; ANY PRODUCT WHICH HAS HAD ANY OF ITS SERIAL NUMBERS
ALTERED OR REMOVED; OR ANY PRODUCT DAMAGED DUE TO IMPROPER PACKAGING OF THE WARRANTY
RETURN TO LOGICUBE. AT LOGICUBE’S OPTION, ANY PRODUCT PROVEN TO BE DEFECTIVE WITHIN THE
WARRANTY PERIOD WILL EITHER BE REPAIRED OR REPLACED USING NEW OR REFURBISHED
COMPONENTS AT NO COST. THIS WARRANTY IS THE SOLE AND EXCLUSIVE REMEDY FOR DEFECTIVE
PRODUCTS. IF A PRODUCT IS HAS BECOME OBSOLETE OR IS NO LONGER SUPPORTED BY LOGICUBE THE
PRODUCT MAY BE REPLACED WITH AN EQUIVALENT OR SUCCESSOR PRODUCT AT LOGICUBE’S
DISCRETION. THIS WARRANTY EXTENDS ONLY TO THE END PURCHASER OF LOGICUBE PRODUCTS. THIS
WARRANTY DOES NOT APPLY TO, AND IS NOT FOR THE BENEFIT OF, RESELLERS OR DISTRIBUTORS OF
LOGICUBE PRODUCTS. UNLESS OTHERWISE AGREED IN WRITING BY LOGICUBE, NO WARRANTY IS
PROVIDED TO RESELLERS OR DISTRIBUTORS OF LOGICUBE PRODUCTS.
IN ORDER TO RECEIVE WARRANTY SERVICES CONTACT LOGICUBE’S TECHNICAL SUPPORT DEPARTMENT
VIA PHONE OR E-MAIL. PRODUCTS RETURNED TO LOGICUBE FOR REPAIR UNDER WARRANTY MUST
REFERENCE A LOGICUBE RETURN MATERIAL AUTHORIZATION NUMBER (“RMA”). ANY PRODUCT RECEIVED
BY LOGICUBE WITHOUT AN RMA# WILL BE REFUSED AND RETURNED TO PURCHASER. THE PURCHASER
MUST CONTACT LOGICUBE’S TECHNICAL SUPPORT DEPARTMENT VIA E-MAIL
([e-mail]) OR VIA PHONE AT [phone] OPT. 3 TO OBTAIN A VALID RMA#. THE
PURCHASER MAY BE REQUIRED TO PERFORM CERTAIN DIAGNOSTIC TESTS ON A PRODUCT PRIOR TO
LOGICUBE ISSUING AN RMA#. THE PURCHASER MUST PROVIDE THE PRODUCT MODEL, SERIAL NUMBER,
PURCHASER NAME AND ADDRESS, EMAIL ADDRESS AND A DESCRIPTION OF THE PROBLEM WITH AS
MUCH DETAIL AS POSSIBLE. AT LOGICUBE’S SOLE AND ABSOLUTE DISCRETION, REASONABLE TELEPHONE
AND EMAIL SUPPORT MAY ALSO BE AVAILABLE FOR THE LIFE OF THE PRODUCT AS DEFINED BY LOGICUBE.
EXCEPT AS OTHERWISE SPECIFICALLY PROVIDED IN THIS AGREEMENT, LOGICUBE PRODUCTS ARE
PROVIDED AS-IS AND AS-AVAILABLE, AND LOGICUBE DISCLAIMS ANY AND ALL OTHER WARRANTIES
(WHETHER EXPRESS, IMPLIED, OR STATUTORY) INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT OF THIRD PARTY
RIGHTS.
SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR
CONSEQUENTIAL DAMAGES, OR LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, SO THE
ABOVE LIMITATIONS OR EXCLUSIONS MAY NOT APPLY TO YOU. THIS WARRANTY GIVES YOU SPECIFIC
LEGAL RIGHTS, AND YOU MAY HAVE OTHER RIGHTS WHICH VARY FROM JURISDICTION TO JURISDICTION.
RoHS Certificate of Compliance
LOGICUBE PRODUCTS COMPLY WITH THE EUROPEAN UNION RESTRICTION OF THE USE OF CERTAIN
HAZARDOUS SUBSTANCES IN ELECTRONIC EQUIPMENT, ROHS DIRECTIVE (2002/95/EC).

Logicube Forensic Falcon™ User’s Manual III
THE ROHS DIRECTIVE PROHIBITS THE SALE OF CERTAIN ELECTRONIC EQUIPMENT CONTAINING SOME
HAZARDOUS SUBSTANCES SUCH AS MERCURY, LEAD, CADMIUM, HEXAVALENT CHROMIUM AND CERTAIN
FLAME-RETARDANTS IN THE EUROPEAN UNION. THIS DIRECTIVE APPLIES TO ELECTRONIC PRODUCTS
PLACED ON THE EU MARKET AFTER JULY 1, 2006.
Logicube Technical Support Contact Information
1. By website: www.logicube.com
2. By email: [e-mail]
3. By telephone: 1 - [phone] ext. 3 between the hours of 7am –5pm PST, Monday through
Friday, excluding U.S. legal holidays.

Logicube Forensic Falcon™ User Manual I
Table of Contents
FORENSIC FALCON™ USER’S MANUAL ...........................................................................I
LIMITATION OF LIABILITY AND WARRANTY INFORMATION ...........................................I
LOGICUBE DISCLAIMER ........................................................................................................................ I
WARRANTY ....................................................................................................................................... I
ROHS CERTIFICATE OF COMPLIANCE..................................................................................................... II
LOGICUBE TECHNICAL SUPPORT CONTACT INFORMATION........................................................................ III
TABLE OF CONTENTS.....................................................................................................I
1: INTRODUCTION ......................................................................................................1
1.0 INTRODUCTION TO THE LOGICUBE FALCON ..................................................................................... 1
1.1 FEATURES ................................................................................................................................. 1
1.2 IN THE BOX ............................................................................................................................... 3
1.3 OPTIONS................................................................................................................................... 4
1.4 SPECIFICATIONS.......................................................................................................................... 4
2: GETTING STARTED..................................................................................................7
2.0 OVERVIEW OF THE FALCON .......................................................................................................... 7
2.1 TURNING THE FALCON ON AND OFF ............................................................................................... 9
2.2 CONNECTING VARIOUS DRIVE TYPES............................................................................................... 9
2.2.1 Connecting Source Drives .............................................................................................. 9
2.2.2 Connecting Destination Drives..................................................................................... 10
2.2.3 Connecting USB 3.0 Drives........................................................................................... 11
2.2.4 Using USB/FireWire/eSATA enclosures ....................................................................... 11
2.2.5 Connecting SATA Drives using a USB-to-SATA adapter ............................................... 11
2.2.6 Connecting PCIe/mPCIe/M.2 drives............................................................................. 12
2.2.7 Connecting an external Optical Drive (CD/DVD/Blu-ray)............................................. 12
2.3 THE USER INTERFACE................................................................................................................. 12
2.4 TOUCH SCREEN ........................................................................................................................ 13
2.5 HDMI.................................................................................................................................... 13
3: QUICK START........................................................................................................ 14
3.0 QUICK START GUIDE ................................................................................................................. 14
3.1 IMAGING................................................................................................................................. 14
3.1.1 Step-by-step instructions –Imaging ............................................................................ 16
3.1.1.1 Blank Disk Check................................................................................................... 18
3.1.1.2 Drive Spanning...................................................................................................... 19
3.1.2 Imaging to or from a network...................................................................................... 21
3.2 HASH /VERIFY......................................................................................................................... 21

Logicube Forensic Falcon™ User’s Manual II
3.2.1 Step-by-step instructions –Drive Hash or Case Verify ................................................ 21
3.3 WIPE/FORMAT ........................................................................................................................ 22
3.3.1 Step-by-step instructions –Wipe/Format ................................................................... 23
3.4 PUSH...................................................................................................................................... 25
3.4.1 Step-by-step instructions - Push.................................................................................. 25
3.5 TASK MACROS ......................................................................................................................... 26
3.5.1 Step-by-step instructions –Task Macros..................................................................... 26
3.6 USB DEVICE (VIEWING DRIVE CONTENTS IN WINDOWS)................................................................. 27
2.7.1 Step-by-step instructions –USB Device..................................................................... 27
3.7 FILE BROWSER ......................................................................................................................... 28
3.7.1 Step-by-step instructions –File Browser ..................................................................... 28
3.8 LOGS...................................................................................................................................... 28
3.8.1 Step-by-step instructions –Viewing or exporting logs ................................................ 29
3.8.2 Deleting log files........................................................................................................... 30
3.8.3 Accessing the logs over a network............................................................................... 31
3.9 STATISTICS .............................................................................................................................. 32
3.10 MANAGE REPOSITORIES .......................................................................................................... 32
3.11 SYSTEM SETTINGS................................................................................................................... 32
3.12 NETWORK SETTINGS ............................................................................................................... 33
3.13 SOFTWARE UPDATES............................................................................................................... 33
3.14 POWER OFF .......................................................................................................................... 33
4: PREVIEWING DRIVES ............................................................................................ 34
4.0 PREVIEWING DRIVES -INTRODUCTION ......................................................................................... 34
4.1 FILE BROWSER ......................................................................................................................... 35
4.2 COMPUTER +FILE BROWSER...................................................................................................... 36
4.3 USB....................................................................................................................................... 37
4.4 SMB...................................................................................................................................... 37
4.5 ISCSI...................................................................................................................................... 38
5: IMAGING.............................................................................................................. 39
5.0 IMAGING -INTRODUCTION......................................................................................................... 39
5.0.1 Mode............................................................................................................................ 39
5.0.2 Source or Case ............................................................................................................. 40
5.0.3 Settings......................................................................................................................... 42
5.0.3.1 Case Info ............................................................................................................... 42
5.0.3.2 HPA/DCO/TRIM .................................................................................................... 44
5.0.3.2.1 Drive Trim .................................................................................................................................. 44
5.0.3.3 Error Handling....................................................................................................... 47
5.0.3.4 Clone Method Settings.......................................................................................... 48
5.0.3.5 File Image Method Settings.................................................................................. 48
5.0.3.6 Filter Settings........................................................................................................ 50
5.0.3.6.1 Path Filter Notes ......................................................................................................................... 51
5.0.3.7 Root Directory....................................................................................................... 53
5.0.3.8 Output Format...................................................................................................... 54
5.0.3.9 Hash/Verification Method .................................................................................... 54
5.0.3.10 Verify Hash.......................................................................................................... 55
5.0.4 Destination / Image File............................................................................................... 56

Logicube Forensic Falcon™ User’s Manual III
5.1 STARTING THE IMAGING OPERATION ........................................................................................... 57
6: TYPES OF OPERATIONS ......................................................................................... 59
6.0 TYPES OF OPERATIONS -INTRODUCTION ...................................................................................... 59
6.0.1 Imaging......................................................................................................................... 61
6.0.2 Hash / Verify ................................................................................................................ 61
6.0.2.1 Mode..................................................................................................................... 62
6.0.2.2 Drives .................................................................................................................... 63
6.0.2.3 Settings ................................................................................................................. 63
6.0.2.3.1 Drive Hash Settings ...................................................................................................................... 63
6.0.2.3.2 Case Verify Settings.................................................................................................................... 65
6.0.2.4 Case Info ............................................................................................................... 66
6.0.3 Wipe / Format.............................................................................................................. 67
6.0.3.1 Destination ........................................................................................................... 67
6.0.3.2 Settings ................................................................................................................. 68
6.0.3.2.1 Secure Erase................................................................................................................................ 68
6.0.3.2.2 Wipe Patterns.............................................................................................................................. 69
6.0.3.2.3 Format......................................................................................................................................... 72
6.0.3.3 Case Info ............................................................................................................... 73
6.0.4 Push.............................................................................................................................. 74
6.0.4.1 Source ................................................................................................................... 75
6.0.4.2 Settings ................................................................................................................. 75
6.0.4.3 Destination ........................................................................................................... 75
6.0.5 Task Macro................................................................................................................... 76
6.0.5.1 Tasks ..................................................................................................................... 76
6.0.6 USB Device ................................................................................................................... 79
6.0.6.1 Settings ................................................................................................................. 80
6.0.7 File Browser ................................................................................................................. 81
6.0.7.1 Viewing files from the web interface.................................................................... 84
6.0.7.2 Important notes about using the File Browser ..................................................... 84
6.0.8 Logs .............................................................................................................................. 85
6.0.9 Statistics....................................................................................................................... 86
6.0.10 Manage Repositories .................................................................................................86
6.0.10.1 Add/Remove ....................................................................................................... 87
6.0.10.2 iSCSI .................................................................................................................... 90
6.0.11 System Settings.......................................................................................................... 91
6.0.11.1 User Profiles/Configurations............................................................................... 91
6.0.11.2 Passwords........................................................................................................... 93
6.0.11.2.1 Additional information for Config Lock................................................................................... 94
6.0.11.2.2 Forgotten password or config lock key ..................................................................................... 97
6.0.11.3 Encryption Settings ............................................................................................. 98
6.0.11.4 Language/Time Zone.......................................................................................... 99
6.0.11.4.1 Language................................................................................................................................... 99
6.0.11.4.2 Time Zone................................................................................................................................. 99
6.0.11.5 Display .............................................................................................................. 100
6.0.11.6 Notifications ..................................................................................................... 101
6.0.12 Network Settings......................................................................................................101
6.0.12.1 Services ............................................................................................................. 102
6.0.12.2 HTTP Proxy.......................................................................................................... 102
6.0.12.2.1 Server...................................................................................................................................... 103

Logicube Forensic Falcon™ User’s Manual IV
6.0.12.2.2 Username/Password................................................................................................................ 103
6.0.13 Software Update...................................................................................................... 103
6.0.14 Power Off ................................................................................................................. 104
7: VIEWING EXT4 FORMATTED DESTINATION DRIVES IN WINDOWS........................ 105
7.0 VIEWING EXT4 FORMATTED DESTINATION DRIVES –INTRODUCTION .............................................. 105
7.0.1 Step-by-step instructions –Using Ext2fsd .................................................................105
8: DRIVE ENCRYPTION AND DECRYPTION................................................................ 108
8.0 DRIVE ENCRYPTION/DECRYPTION -INTRODUCTION...................................................................... 108
8.1 ENCRYPTING A DESTINATION.................................................................................................... 109
8.1.1 Step-by-step Instructions...........................................................................................109
8.1.2 Using previously encrypted Destination drives ......................................................... 110
8.2 DECRYPTING A FALCON ENCRYPTED DESTINATION DRIVE WITH A FALCON ........................................ 110
8.2.1 Step-by-step Instructions...........................................................................................110
8.3 DECRYPTING THE DRIVE WITHOUT A FALCON............................................................................... 112
8.3.1 Which decryption software to use?........................................................................... 112
8.3.2 Decrypting using VeraCrypt ....................................................................................... 112
8.3.3 Decrypting using TrueCrypt ....................................................................................... 115
8.3.4 Decrypting using FreeOTFE........................................................................................ 117
9: UPDATING THE FALCON SOFTWARE.................................................................... 121
9.0 LOADING NEW SOFTWARE....................................................................................................... 121
9.1 SOFTWARE LOADING INSTRUCTIONS .......................................................................................... 121
9.1.1 From Network –Via the web..................................................................................... 121
9.1.2 From USB Drive –Via software download.................................................................122
9.1.2.1 Extracting the software download on a computer with WinZip (or other third
party zip software) ........................................................................................................... 123
9.2 FIRMWARE LOADING INSTRUCTIONS.......................................................................................... 124
10: REMOTE OPERATION ........................................................................................ 125
10.0 REMOTE OPERATION -INTRODUCTION..................................................................................... 125
10.1 WEB INTERFACE................................................................................................................... 125
10.2 COMMAND LINE INTERFACE (CLI)...........................................................................................126
10.3 INSTALLING THE TELNET CLIENT IN WINDOWS ........................................................................... 126
10.3.1 Connecting via Telnet .............................................................................................. 126
10.3.2 Connecting via SSH................................................................................................... 127
10.4 ZERO CONFIGURATION NETWORKING (ZEROCONF).................................................................... 128
10.5 CONFIGURING THE FALCON WITH A STATIC IP ADDRESS...............................................................128
10.5.1 Step-by-step instructions –Static IP address........................................................... 128
10.6 COPYING USER PROFILES/CONFIGURATIONS FROM ONE FALCON TO ANOTHER ............................... 129
10.6.1 Step-by-step –Copying User Profiles/Configurations .............................................129
11: VIEWING SOURCE AND DESTINATION DRIVES OVER A NETWORK...................... 131
11.0 VIEWING DRIVES OVER A NETWORK -OVERVIEW ....................................................................... 131
11.1 VIEWING SOURCE OR DESTINATION DRIVES OVER THE NETWORK USING SMB ................................ 131
11.1.1 Step-by-step –Viewing Source or Destination drives.............................................. 131
11.2 VIEWING SOURCE DRIVES OVER THE NETWORK USING ISCSI ........................................................133

Logicube Forensic Falcon™ User’s Manual V
11.2.1 Configuring the iSCSI initiator –Windows 7, 8, and 8.1 .......................................... 133
12: OPTIONAL ADAPTERS ....................................................................................... 135
12.0 OPTIONAL ADAPTERS -INTRODUCTION ....................................................................................135
12.1 MSATA (MINI-SATA) DRIVES ................................................................................................ 135
12.2 ESATA DRIVES..................................................................................................................... 135
12.3 PCIE ADAPTER KIT (FOR M.2 AND PCIE).................................................................................. 136
12.3.1 M.2 PCIe AHCI or NVMe based SSDs .......................................................................136
12.3.2 M.2 SATA based SSDs............................................................................................... 137
12.3.3 Mini PCIe (mPCIe) SSDs............................................................................................ 138
12.3.4 mSATA SSDs .............................................................................................................139
12.4 USB 3.0 TO SATA ADAPTER.................................................................................................. 140
12.5 USB 3.0 HUB......................................................................................................................140
12.6 FLASH MEMORY READER....................................................................................................... 140
13: SCSI MODULE ................................................................................................... 142
13.0 SCSI MODULE -INTRODUCTION .............................................................................................142
13.1 INSTRUCTIONS -HOW TO ATTACH THE SCSI MODULE.................................................................144
13.2 TURNING THE FALCON WITH SCSI MODULE ON AND OFF............................................................. 145
13.3 CONNECTING DRIVES ............................................................................................................ 146
13.3.1 Connecting SCSI Source and Destination Drives...................................................... 147
14: USB BOOT CLIENT ............................................................................................. 148
14.0 USB BOOT CLIENT INTRODUCTION..........................................................................................148
15: PRINTING LOG FILES ......................................................................................... 149
15.0 PRINTING LOG FILES -INTRODUCTION...................................................................................... 149
15.1 PRINTING FROM THE WEB INTERFACE......................................................................................149
15.2 CONFIGURING A LOCAL OR NETWORKED PRINTER....................................................................... 149
15.2.1 Step-by-step –Configuring a local or networked printer ........................................ 149
16: SECURITY –CHANGING THE DEFAULT PASSWORDS........................................... 152
16.0 CHANGING THE DEFAULT PASSWORDS -INTRODUCTION .............................................................. 152
16.0.1 Changing both the logicube and it passwords......................................................... 152
16.0.2 Changing only the logicube password ..................................................................... 153
16.0.3 Changing only the it password................................................................................. 154
17: FREQUENTLY ASKED QUESTIONS ...................................................................... 155
17.0 FAQS................................................................................................................................. 155
19: INDEX............................................................................................................... 158
TECHNICAL SUPPORT INFORMATION ................................................................................................. 159
SOFTWARE ATTRIBUTION ................................................................................................................159

Logicube Forensic Falcon™ User’s Manual 1
1: Introduction
1.0 Introduction to the Logicube Falcon
Welcome to the Logicube Forensic Falcon™. Falcon sets a new standard in digital forensic imaging.
Without exception, the fastest and most technologically advanced forensic imaging solution available.
Feature-packed, power-rich performance in a space-saving footprint that provides expandability to meet
future technology advances. This unparalleled solution is designed for demanding forensic imaging tasks
and sets a new standard of excellence in digital forensic data imaging solutions.
1.1 Features
The Falcon is the fastest forensic imaging solution available, achieving speeds of over
30GB/min*.
Image and verify to the following formats: native copy, dd image, e01, ex01 and file-based
copy. Compression available for E01/Ex01 formats. Uses SHA1, SHA256, MD5 and dual-hash
(MD5+SHA1) authentication.
4 Source and 5 Destination ports. Write-protected source ports include 2 SAS/SATA, 1 USB 3.0,
and 1 FireWire. Destination ports include 2 SAS/SATA, 2 USB 3.0, and 1 FireWire. A Gigabit
Ethernet port for network connectivity is also available. USB source and destination can be
converted to SATA using a USB to SATA converter.
Targeted Imaging feature shortens acquisition time. Create a logical image by using pre-set
filters, custom filters, files signatures filter, and/or keywords search function to select and
acquire only the specific files you need. Optionally an MFT report can be generated, this report
contains a list of potentially undeletable files. Format output to LX01, ZIP or directory tree.

INTRODUCTION
Logicube Forensic Falcon™ User’s Manual 2
Users can browse and view directly on the Falcon display, or manage and view on a networked
Falcon from your laptop/desktop using a web browser.
Built in support for SAS/SATA/USB/FireWire storage devices. Adapters are included with Falcon
to support 1.8”/2.5”/3.5” IDE and 1.8” ZIF and microSATA drive interfaces. Optional adapter are
available for eSATA, mSATA, and CompactFlash drives. An optional SCSI module provides
support for 1 SCSI source and 1 Destination drive.
PCIe Support. Support for M.2 PCIe and M.2 NVMe type SSDs and mini-PCIe and PCIe express
cards is provided using an optional express card adapter combined with specific interface
adapters.
CD/DVD/Blu-ray Imaging. The Falcon can image CD/DVD/Blu-ray media by using a USB optical
drive connected to the USB port on the Falcon. The Falcon supports multi-session CD/DVDs.
Image to or from a network location or an external storage device. Use the Falcon to image to
a network location using CIFS protocol and/ or image from a network location using iSCSI. Users
can use iSCSI as a source or destination drive. Image to an external storage device (such as a
NAS) using the Gigabit Ethernet, USB3.0 or SAS/ SATA connection.
Write-blocked preview/triage hard drive contents. Use the Falcon as a write-blocker. The file
browser feature provides write-blocked access to source or destination drives connected to
Falcon. View the drive’s partitions and contents and view text files, jpeg, PDF, XML, or HTML
files. File types such as .doc and .xls can be viewed by connecting Falcon to a network, download
and view on a PC. Users can also preview source or destination drives using the USB connection
from the Falcon to a computer, or by using the SMB protocol. The iSCSI protocol can be used to
preview source drives.
Web browser. Connect to a networked Falcon from your laptop/desktop using a web browser to
manage all operations remotely. Features automatic page scaling for iPad type devices.
Image from a desktop or laptop PC without removing the hard drive. Create a forensic bootable
USB flash drive to image a source drive from a computer on the same network without booting
the computer’s native O/S.
Image from a MAC™ system booted in “target disk mode” using the write-blocked FireWire port
on Falcon. MACs with either FireWire or Thunderbolt ports can be connected to the Falcon, a
Thunderbolt to FireWire adapter is required.
Multi-task. Image from multiple source drives to multiple destination drives or wipe one
destination drive while imaging to another. Perform up to five tasks concurrently.
Parallel Imaging. Perform multiple imaging tasks from the same source drive to multiple
destinations using different imaging formats.
Concurrent Image+Verify. The Falcon begins verification during the imaging process. Duration
of total image plus verification process time may be reduced by up to half.
Secure sensitive evidence data with whole drive AES 256 bit Encryption. Decrypt using the
Falcon or by using open source software programs such as VeraCrypt, FreeOTFE or TrueCrypt
Fast multi-pass wipe (DoD specifications) or use secure erase to wipe drives, wipe at speeds of
up to 27GB/min.
Network Push feature. Push evidence files from connected destination drives or from a Falcon
repository to a network location. The Falcon performs an MD5 or SHA hash during the push
process, a log file is generated for each push process.

INTRODUCTION
Logicube Forensic Falcon™ User’s Manual 3
Image restore feature. File to drive mode restores DD, E01, EX01 images created by the Falcon
to another drive.
Task Macro. Set specific tasks to be performed sequentially; first wipe the destination drive then
hash the source drive then image the source drive. All tasks within the Macro will be performed
automatically.
Features an internal, removable storage drive that stores O/S and audit trail/logs. The drive is
easily removed for secure/classified locations.
Audit Trail/Log files provide detailed information on each operation. Log files can be viewed on
Falcon or via a web browser, exported in XML, HTML or PDF format to a USB enclosure. Users
can print the log files directly from their PC when connected to Falcon via a web browser.
Additional features include HPA/DCO capture, drive “trim” feature manipulates the DCO and
HPA areas of destination drives, create password- protected user profiles and save
configurations, drive “time-out” feature automatically puts drives in stand-by mode after a
specified idle time, “task completed” audible beep, blank disk check, drive spanning, 7” color
touch screen, two USB 2.0 host ports for keyboard, mouse or printer connectivity, and an HDMI
port to connect a projector or monitor.
*The Falcon achieves speeds of over 30GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random
data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard
drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.
1.2 In the Box
The complete Falcon system includes the following:
The Logicube Falcon unit
AC adapter/Power supply and power cable
1 USB 3.0 device cable
1 1.8” microSATA adapter
1 1.8” IDE ZIF to SATA adapter
1 2.5”/3.5” IDE to SATA adapter
1 1.8” IDE to SATA adapter
4 6-pin SATA power plugs
1 USB A female to USB mini-B 5 pin male adapter
1 USB A female to micro B male converter coupler adapter
CD-ROM containing the user’s manual
Carrying case

INTRODUCTION
Logicube Forensic Falcon™ User’s Manual 4
1.3 Options
The following options are available for the Forensic Falcon:
50-pin to 68-pin or 80-pin to 68-pin SCSI adapters for use with SCSI Module
eSATA to SATA cable converter
mSATA to SATA adapter
USB 3.0 to SATA Adapter
USB 3.0 4-port hub
PCIe adapter kit includes adapters for M.2 PCIe, M.2 NVMe, mSATA SSDs, PCie and mini-PCIe
cards
Flash Media Reader for compact flash cards, SD cards and other flash media
Hard-sided carrying case
1.4 Specifications

INTRODUCTION
Logicube Forensic Falcon™ User’s Manual 5
WARNINGS:
Never connect a suspect drive to the Destination ports of the Forensic Falcon as
data may be overwritten.
Incorrectly connecting the suspect drive to the system can result in data on the
suspect drive to be lost forever.
Avoid dropping the Logicube Forensic Falcon or subjecting it to sharp jolts.
When in use, place it on a flat surface.
Keep the unit dry. If the Forensic Falcon needs to be cleaned, use a lightly damp,
lint free cloth. Avoid using soap or other cleaning agents particularly those
containing bleach, ammonia, alcohol or other harsh chemicals.
Do not attempt to service or open the Logicube Forensic Falcon. Doing so may
void the warranty. If the unit requires service, please contact Logicube Technical
Support for assistance.

Logicube Forensic Falcon™ User’s Manual 7
2: Getting Started
2.0 Overview of the Falcon
Special Icons –Throughout this manual, there are two icons that can be seen.
Please pay close attention when any of these two icons are found. These icons highlight
additional information or important warnings on specific topics.

GETTING STARTED
Logicube Forensic Falcon™ User’s Manual 8

GETTING STARTED
Logicube Forensic Falcon™ User’s Manual 9
2.1 Turning the Falcon on and off
The Falcon comes with a 12V, 12.5A (output DC) power supply that connects to the back of the
device. Attach the included power supply to the Falcon’s DC power port in the back.
To turn the Falcon on, press and immediately release the top of the momentary on/off switch in
the back. The Falcon will turn on and start the boot process.
There are two ways of turning the Falcon off:
1. Press and immediately release the top of the momentary on/off switch in the back. The
Falcon will begin its shut down process and after a few seconds, the display and fans will
turn off.
2. Using the Graphical User Interface (GUI) either on the touch screen or via a browser
through a remote connection, navigate to the Power Off screen and tap or click the
Power Off icon.
2.2 Connecting various drive types
Cables and adapters are available for the following drive types:
SAS
SATA
USB
FireWire
1.8” microSATA
2.5” and 3.5” PATA/IDE
1.8” ZIF
1.8” PATA/IDE
eSATA (optional)
mSATA (optional)
Flash Media (optional)
PCIe (Source only –optional)
2.2.1 Connecting Source Drives
Source drives (also called suspect drives) must be connected to the left side of
the Falcon. These ports are write-protected and are labeled as follows:
SAS S1 –SAS/SATA data port for the Source 1 (S1) position.
SAS S2 –SAS/SATA data port for the Source 2 (S2) position.
PWR –power port for either Source 1 (S1) or Source 2 (S2) position.
USBS1 –USB 3.0 Source port.
FW S1 –FireWire Source port.
PCIe –Located in the back panel.

GETTING STARTED
Logicube Forensic Falcon™ User’s Manual 10
Source drives do not have to be connected in any order. For example, a single
SATA Source drive does not have to be connected to the SAS/SATA S1 port. It
can be connected to the SAS/SATA S2 port without having anything connected
to the S1 port.
Never connect a suspect or Source drive to the Destination
ports of the Falcon. Data may be overwritten if a drive is
connected to a Destination port.
Any combination of drives can be connected, up to 4 Source drives. For
example, one SAS drive, one SATA drive, one USB drive, and one FireWire drive
can all be connected at the same time.
2.2.2 Connecting Destination Drives
Destination drives (also called evidence drives) must be connected to the right
side of the Falcon. These ports are labeled as follows:
SAS D1 –SAS/SATA data port for the Destination 1 (D1) position.
SAS D2 –SAS/SATA data port for the Destination 2 (D2) position.
PWR –power port for either Destination 1 (D1) or Destination 2 (D2)
position.
USB D1/2 –USB 3.0 Destination port
FW D1 –FireWire Destination port
Destination drives do not have to be connected in order. For example, a single
SATA Destination drive does not have to be connected to the SAS/SATA D1 port.
It can be connected to the SAS/SATA D2 port without having anything
connected to the D1 port.
Any combination of drives can be connected, up to 5 Destination drives. For
example, one SAS drive, one SATA drive, two USB drives, and one FireWire drive
can all be connected at the same time.

GETTING STARTED
Logicube Forensic Falcon™ User’s Manual 11
The Falcon ports are hot swappable. Drives that are not being
used in any task (image, hash, wipe, etc.) can be disconnected any
time. Some drives are not hot swappable. Please check with the
drive manufacturer to find out if the drive being used does not
support hot swapping.
When disconnecting drives, it is very important to make
sure the drives are not being used on any task.
Disconnecting drives while the Falcon is using the drive for
a task may cause data loss.
2.2.3 Connecting USB 3.0 Drives
USB 3.0 is a new technology and USB 3.0 controller manufacturers may have
variations in device designs that have inconsistent adherence to USB 3.0
specification. This may result in non-detection of the USB 3.0 device on certain
equipment (including desktops, laptops or the Falcon). If a USB 3.0 device
cannot be detected on the Falcon USB ports we have found that using a USB 3.0
hub may stabilize and regulate the communication between the USB 3.0 device
and the Falcon, allowing the device to be detected properly. We have identified
and qualified a USB 3.0 hub which is available as an option. For more
information on the USB 3.0 hub, please see Section 12.5.
2.2.4 Using USB/FireWire/eSATA enclosures
When using USB, FireWire, and/or eSATA enclosures, it is highly recommended
to leave the drive inside the enclosure. USB enclosures typically have an on-
board controller that may be necessary to read the drive properly. Taking the
drive out of the enclosure could cause any device (including computers) not to
read the drive contents properly.
2.2.5 Connecting SATA Drives using a USB-to-SATA adapter
Logicube has qualified a USB 3.0 to SATA adapter for use with the Falcon. This
adapter provides the capability to connect SATA drives to the USB 3.0 ports on
the Falcon and uses a USB 3.0 to SATA converter. USB 3.0 is a new technology
and USB 3.0 controller manufacturers may have variations in device designs that
have inconsistent adherence to USB 3.0 specifications. This adapter and other
USB 3.0 enclosures may experience communication disruption between devices.
If the adapter is not detected properly we have found that using a USB 3.0 hub
may stabilize and regulate the communication between the Adapter or USB 3.0
enclosure, and the Falcon, allowing the device to be detected properly. For
more information on the USB 3.0 to SATA adapter, please see Section 12.4. For
more information on the USB 3.0 hub, please see Section 12.5.