Article sections
Software Downloads
The latest software version for your Logicube product is listed below. We provide frequent software updates to add features and improve performance. The Falcon-NEO2 software can be updated directly from Falcon-NEO2 via an internet connection or you can download the software from our website to a USB drive and then upload it to the Falcon-NEO2. Please refer to the Falcon-NEO2 users manual, the readme.txt on this page or contact Logicube support for instructions. Included here as well as the application note for our USB (iSCSI) boot client that provides a software link and instructions on how to image from laptops without removing the hard drive.
Please note the software below is for the Falcon-NEO2 if you are looking for software for the Forensic Falcon-NEO please go to the Forensic Falcon-NEO Knowledge Base
If you need assistance in updating the software on your Logicube product please contact our technical support department at support@logicube.com or 818-700-8488.
Product Documentation
The latest product documentation for your Logicube product is listed below. This includes product manuals, technical or application notes, and other documentation to assist you while using your device. Click on any title to download the document as a PDF.
If you need assistance in downloading or any questions regarding these documents please contact our technical support department at techsupport@logicube.com or 818-700-8488.
Product FAQ
Q. What kind of databases are supported for the Triage function on the Falcon-NEO2?
A. Only VICS Hash Databases are supported with the Falcon-NEO2.
Q. Why is the number of bytes shown when I image a drive twice the size of my Source drive?
A. The number of bytes shown on the progress bar is not the actual size of the drive. This is the actual data being processed. When ‘Verify’ is set to “Yes”, the reported number will double.
Q. How many concurrent tasks can the Falcon-NEO2 run?
A. The Falcon-NEO2 can run up to 5 concurrent tasks.
Q. Can the Falcon-NEO2 image Linux partitions?
A. Yes. Falcon-NEO2 can image Linux partitions.
Q. Can the Falcon-NEO2 image the Apple File System (APFS), Hierarchical File System (HFS), or Hierarchical File System Plus (HFS+)?
A. Yes, Falcon-NEO2 can image APFS, HFS, and HFS+.
Q. Do Destination drives need to be wiped or formatted using the Falcon?
A. For Drive to File, File to File, Partition to File, and Net Traffic to File mode, the Falcon-NEO2 must be used to format Destination drives. This helps ensure the images and data are properly written to the Destination drive(s).
Q. How does the Falcon-NEO2 handle bad sectors found on the Source drive?
A. Falcon-NEO2 will retry the bad sector 7 times. After the 7th attempt, if the sector still cannot be read, it will skip that sector and list the sector in the log file.
Q. What operating system does Falcon-NEO2 use?
A. Falcon-NEO2 uses a Linux-based operating system, which provides increased stability and security over Windows-based systems.
Q. What file format does Falcon-NEO2 use when formatting destination drives?
A. Falcon-NEO2 can format destination drives using the following file systems: NTFS, EXT, exFAT, FAT32, or HFS+.
Q. Does imaging performance slow down when multiple drives are imaged simultaneously?
A. The slowest drive in the configuration limits performance; however, there should not be any significant speed penalty when imaging multiple drives.
Q. Does imaging performance slow down when multiple drives are imaged simultaneously?
A. The slowest drive in the configuration limits performance; however, there should not be any significant speed penalty when imaging multiple drives.
Q. Can I encrypt my evidence drives using the Falcon-NEO2? How do I decrypt drives encrypted with Falcon-NEO2
A. The Falcon-NEO2 provides AES 256 whole drive encryption. Users can choose between three different cipher modes and set their own password/key for the encrypted drive. They can decrypt a drive that was encrypted with Falcon-NEO2 by using the Falcon-NEO2 to decrypt or by using VeraCrypt, TrueCrypt, or FreeOTFE.
Q. If I am imaging to or from USB enclosures, will the Falcon-NEO2’s USB ports power my devices, or will an additional power source be required?
A. Each of the Falcon-NEO2’s USB ports meets the standard specification of up to 5V power. If your USB device requires higher power, an external power source will be necessary. Check with the manufacturer of your USB device to determine the exact power requirements.
Q. Can the Falcon-NEO2 image to or from a network destination?
A. Yes. The Falcon-NEO2 includes two 10GbE (Gigabit Ethernet) network connections. Users can designate a network share as a source or destination repository using SMB, CIFS, or iSCSI protocols.
Q. What is “Parallel Imaging”?
A. Parallel Imaging allows you to image from the same source drive to multiple destinations using different imaging modes. For example, an image to one Destination can be performed using E01, and at the same time, an image to another Destination drive using Mirror Image (bit-forbit). This is useful when there are multiple teams of investigators (one in a lab and one at another location but connected to a network) and you also need to provide a copy of the suspect's hard drive to those that require an exact mirror image (for example, to an attorney).
Q. Does the Falcon-NEO2 provide log files?
A. Yes, each operation/task produces a log file. The log file is viewable in an HTML format on the Falcon-NEO2 screen (or remotely on a PC). The log files can be exported to a thumb drive (the Falcon-NEO2 will export in XML, HTML, and PDF). XML log files can be customized using XML editors. The log files are stored on the internal drive within Falcon-NEO2 and are accessible by pressing the log file icon from the left-side navigation bar on the Falcon-NEO2 screen.
Q. Can I remove the internal drive (that contains the Operating System) for secure locations or SCIFs?
A. Often, investigators must work in a Sensitive Compartmented Information Facility (SCIF). These secure areas have very stringent requirements regarding the use of electronic devices to ensure sensitive information does not leave the confines of the SCIF. The Falcon-NEO2 has been designed with a removable internal hard drive. The Operating System, system settings, and log files are all stored on this internal drive. If an investigation requires that the FalconNEO2 be removed from the SCIF or transported to another location, the internal drive can be removed before leaving the facility.