Extremely Fast ImagingThe Falcon is the fastest forensic imaging solution available, achieving speeds of 20GB/min*. The Falcon meets future hard drive speed improvements with SAS/SATA-3 6GB/s maximum rated speed of 37GB/min.
Multiple Image FormatsThe Falcon images and verifies to the following formats: native or mirror copy, dd image, e01, ex01 and file-based copy. e01 and ex01 feature user-selectable compression levels and the Falcon supports SHA1, SHA256 or MD5 authentication.
Multiple Imaging PortsWrite-protected source ports include:
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
1 SCSI ( using the SCSI Module Option)
Destination ports include:
2 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
1 SCSI (using the SCSI Module Option)
A Gigabit Ethernet port for network connectivity is built-in. An optional PCI express card interface (for new/future technologies such as Thunderbolt) is planned for future availability.In addition the unit includes a USB 3.0 device port for drive preview and two USB 2.0 host ports
Multi-taskImprove efficiency and shorten the evidence collection process with the ability to wipe one destination drive while imaging to another simultaneously, or image from multiple source drives to multiple destinations. Perform up to five tasks concurrently.
Web-based User InterfaceAn easy to use and intuitive interface allows you to connect to the Falcon from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.
Broad Interface SupportBuilt-in support for SAS/SATA/USB/Firewire storage devices. Supports 1.8″/2.5″/3.5″ IDE and 1.8″ IDE ZIF and microSATA interfaces with adapters included with Falcon. Optional adapters are available for eSATA, mSATA and flash drives.WipeWipe up to DoD specifications or use Secure Erase to erase drives.Image to External Storage DeviceThe Falcon allows you to image to an external storage device such as a NAS, using the Gigabit Ethernet port, USB 3.0 or via the SAS/SATA connection.
SCSI Module Option The SCSI Module Option expands the capability of the Forensic Falcon by providing support for imaging from and to SCSI hard drives. The Module connects seamlessly to the Falcon and provides 1 write-protected SCSI source port and 1 SCSI destination port. All Falcon features supported with this module.
Image From Desktop/Laptop PCs Users have the ability to image from a desktop or laptop computer without removing the hard drive from the computer. Create a forensic bootable USB flash drive using software that we have provided that allows the user to image a source drive from a computer on the same network without booting the native Operating System on the computer. It also allows drives connected to the networked computer (or directly connected to each other using a network cable) to appear as a destination drive without removing the drive from the computer. Forensic Falcon USB Boot Client Application NoteError Granularity SettingDrive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found Falcon will, by default skip that sector. Changing the granularity allows more sectors to be skipped. There are 4 options ( 512 Bytes, 4096 Bytes, 64 KIB, 128 KIB). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the Falcon will skip the entire cluster (or 4096 bytes or 8 sectors).Removable Storage DriveO/S and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations7″ Touch ScreenUses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.
HPA And DCO CaptureDetect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.
Compact SizeThe Falcon is light weight, at2.5lbs (1.09kg) and features a small footprint of 8.5″W X 3″H X 6.25″D (21.6cm X 7.6cm X 15.9cm)
Forensic, Filter-Based File CopyUsers can filter and then image by the file extension (such as .PDF, .xls, .JPEG, .mov etc.).EncryptionSecure sensitive evidence data with whole drive AES 256 bit encryption. Decryption can be performed using the Falcon or by using a free open source decryption software such as TrueCrypt http://www.truecrypt.org. or FreeOTFE (On The Fly Encryption), http://sourceforge.net/projects/freeotfe.mirror/.
Parallel ImagingSimultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01 format.
Concurrent Image+Verify (Patent-Pending)Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.
Image to or from a Network LocationUse the Falcon to image to a network location using CIFS protocol and/or image from a network location using iSCSI. The Falcon uses CIFS protocol to provide file system access and the highest level of security and control. Users can also use iSCSI as a source or destination drive.User Profiles/ConfigurationsAdministrators can save configuration settings and set password-protected user profiles. This feature is planned for a future update.
Drive Preview The Falcon features write-protected source ports. Use the Falcon as an external write-blocker using the USB 3.0 device port for secure drive preview/image transfer. Source drives can also be previewed over a network connection using an iSCSI intiator. Destination Drive BayAn optional destination drive bay module features an easy to use slide-in design and includes a locking door. This option is planned for a future release
Tasks MacroAllows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive.Set up to five Macros with up to 9 operations/tasks for each macro.
Network Frames CaptureCapture network frames to a PCAP file format. Decode using off the shelf tools, e.g. WireShark. This feature is planned for a future release.
Network Push FeaturePush evidence files from destination drives connected to the Falcon or from a Falcon repository to a network location. The Push feature provides a more secure method than simply copying and pasting to the analysis computer by performan an MD5 or SHA has during the push process. Additionally users can select to verify the file transfer to ensure data integrity. Network users can then quickly preview data or copy data to a local drive or to any other directory on the network. The Falcon generates a log file for each push process.
Drive SpanningCapture from one large capacity drive to two smaller capacity drives. USB Host PortsThe Falcon features two USB 2.0 host ports for keyboard, mouse or printer connectivity
HDMI Port An HDMI port is located on the back of the Falcon. This port can be used to connect the Falcon to a projector. Audit Trail ReportingGenerate and write to the internal storage drive for review and printing.The report is time-stamped.
One-year Standard WarrantyThe system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty ( total of 2 years) and a 2 year extended warranty (total of 3 years) are available.
In The Box The Falcon includes the following:
Power supply and power cord
1 Firewire cable
1 CAT6 network cable
4 SAS/SATA cables
1 USB 3.0 type “A’ cable
1 USB 3.0 device cable
1 USB A female to USB mini-B 5 pin male adapter
1 USB type A female to micro B male converter cable
4 6-pin SATA plugs
1 1.8″ microSATA adapter
1 1.8″ IDE ZIF adapter
1 2.5″/3.5″ IDE to SATA adapter
1 1.8″ IDE to SATA adapter
CD-ROM with software and a users manual
*The Falcon achieves 20GB/min imaging speed using solid state drives and in native/mirror and in e01/eX01 image formats . Your results may vary depending on the specification and condition of the hard drive used as well as the mode, image format and settings used during the imaging process.