Falcon®-NEO2
The Falcon-NEO2 is the groundbreaking follow-on to the Falcon®-NEO, which has long been recognized as the “Best In Class” among all imagers. With Project VIC Validation and the Triage function, triage source drive files against VICS, Comma-Separated Values (CSV), and X-Ways Hash Databases. Multi-Factor Authentication (MFA) support is available using the YubiKey 5 FIPS authenticators. The built-in File Browser now supports Thumbnail view for easier viewing. Retooled and optimized with a powerful new engine, the Falcon-NEO2 is the first field imager to surpass 100GB/min E01 capture speeds. Its SAS-3 architecture (12 Gbps SAS) supports up to 5 simultaneous tasks with up to 10 source and 11 destination ports. Image SAS-3 SSDs at speeds up to 115GB/min, and PCIe drives at speeds exceeding 100GB/min. The USB ports on the Falcon-NEO2 are USB 3.2 Gen-2 (10Gbps), and two 10GbE ports continue to be available on Falcon-NEO2 for imaging to/from network repositories. The “Cloud Storage Acquisition” and “Mobile Device Capture” are standard and available on the Falcon-NEO2, along with physical and logical support for AFF4.
- Built-In, native SAS-3 (12 Gbps) support for 4 Source and 4 Destination ports; total of 10 Sources and 11 Destinations
- VICS Data Compliant; Import and Triage of VICS Hash Databases
- NEW: Import/convert VICS, Comma Separated Value, and X-Ways hash databases using the Graphical User Interface (GUI) for Triage
- NEW: Support for Non-Logicube-formatted destination drives
- Support for Multi-Factor Authentication (MFA) to network repositories
- Concurrent Image+Verify, a Logicube invention since 2013
- Thumbnail viewing of images in built-in file browser for easier triage
- Support for AFF4 Physical and Logical drive captures
- Support for Thunderbolt-3 drives on Source and Destination; 40 Gbps
- 2 USB 3.2 Gen 2 (10 Gbps) Source ports and 4 USB 3.2 Gen 2 (10 Gbps) Destination ports
- SSD Imaging at speeds up to 115 GB/min; PCIe cloning exceeding 100 GB/min
- 5-to-5 simultaneous independent NVMe drive Source to Destination captures
- Standard and built-in Mobile Device and Cloud Storage acquisition support
- Multi-task. Image and Hash from up to 5 sources simultaneously
- Network capture via 2x 10 GbE ports. Capture to/from network locations with support for CIFS/iSCSI, network traffic, VOIP, and Internet activity
“…it is indeed the finding of this assessment that no other digital forensic imager has ever reached the levels set by the Falcon®-NEO2 in terms of the breadth and multiplicity of its features, functions, capabilities, technologies, and certainly its imaging speeds.” — Read the complete article here.
Features
High Speed Imaging
The Falcon-NEO2 achieves imaging from SAS-3 SSDs to SAS-3 SSDs at speeds up to 115GB/min. Clone PCIe to PCIe at speeds exceeding 100GB/min.
Source Ports
- 4 SAS/SATA drives supported with 1 port
- 2 USB 3.2 (Gen 2, can be converted to SATA using an optional USB to SATA adapter)
- 1 PCIe
- 2 I/O ports for use with optional I/O cards including Thunderbolt™3/USB-C
Destination Ports
- 4 SAS/SATA drives supported with 1 port
- 4 USB 3.2 (Gen 2, can be converted to SATA using an optional USB to SATA adapter)
- 1 PCIe
- 1 I/O port for use with optional I/O cards including Thunderbolt™3/USB-C
AFF4 Physical and Logical Imaging
Supports both physical and logical AFF4 imaging. Image source drives to AFF4 (Advanced Forensic File Format 4), an open-source format for digital evidence and data.
Triage
VICS Data Compliant. Import VICS Hash Databases and triage source drive files against the VICS hash Databases.
Multi-Factor Authentication (MFA)
Utilize a YubiKey 5 FIPS series of authenticators to connect to a shared Active Directory network resource securely.
Thumbnail View
View source drive images in a thumbnail view using the built-in File Browser.
Cloud Storage Acquisition
Now included as a standard feature. Allows users to acquire files from OneDrive, Dropbox, or Google Drive. Capture to any destination drive or network repository.
Concurrent Image+Verify
Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image+verify process time may be reduced by up to half.
Multi-Task
Image simultaneously from multiple sources to multiple destinations including a network repository. Supports imaging to one location while simultaneously hashing and/or wiping a second drive. Perform up to 5 tasks concurrently. Little or no speed degradation when imaging from two sources to two destinations.
Thunderbolt3/USB-C support
An optional I/O card supports imaging directly to/from Thunderbolt 3/USB-C and USB 3.1 Gen 2 external drives and storage enclosures. The card connects to the Falcon-NEO2’s 2 write-blocked source I/O ports or 1 destination I/O port. Organizations can take advantage of Thunderbolt 3 technology’s fast transfer speeds when imaging directly to large capacity Thunderbolt 3 RAID storage enclosures for evidence data collection. The I/O card does not currently support imaging in TDM from Mac systems, please refer to the Falcon-NEO2 users’ manual on how to image from Mac systems in TDM using the USB ports or our iSCSI boot device.
Mobile Device Capture
Acquire critical digital evidence from mobile devices, including Apple iPhones, iPads, Android phones and tablets with an optional renewable software subscription. Capture SMS, MMS, photos, videos. Supports up to iOS version 16.x and Android 4.0 and up.
Image from a Mac Computer
Image from a Mac computer with USB-C ports using a USB-C to USB-A cable and Target Disk Mode. Users can also image from Mac computers using Logicube’s USB boot device. Create a forensic bootable USB flash drive to image a source drive from a Mac on the same network without booting the computer’s native OS. The Falcon-NEO2 supports imaging from MacBook Pro systems and supports imaging from Mac computers that use the Apple T2 Security Chip by using file to file mode or using the Mac computer’s Disk Utility.
Logical Imaging feature
Shortens acquisition time. Create a logical image by using pre-set filters, custom filters, file signature filters, and/or keyword search function to select and acquire only the specific files you need. An MFT report can be generated that contains a potential deleted file list. Format output to L01, LX01, ZIP or directory tree. Users can browse and view directly on the built-in display or manage and view on a networked Falcon-NEO2 from your laptop/desktop using a web browser.
Encryption Detection
Whole disk and partition level encryption detection. Easily identify Source drives with possible encryption.
BitLocker, Opal, VeraCrypt, and TrueCrypt Decryption Support
Decrypt partitions (requires the recovery key or password) and then image the selected partition. BEK (BitLocker Encryption Key) file is supported to unlock FIPS-compliant BitLocker encryption.
APFS Support
Supports logical imaging (using file to file mode) from drives formatted to APFS (Apple File System). Requires use of Advanced set-up, reference the users’ manual for complete information. The Falcon-NEO2 can also view and browse APFS files using the built-in file browser feature.
Image from Desktop/Laptops
Create a forensic bootable USB flash drive to image a source drive from a computer on the same network without booting the computer’s native OS. Supports Surface Pro 4 and above laptops.
Two 10 GbE Network Ports
Two 10 GbE network ports provide fast network imaging. Image to/from a network repository using CIFs protocol or iSCSI. Users can connect to a 10GbE NAS and connect to your network using the 2nd 10GbE port to minimize bottlenecks.
File Browser/Write-Blocked Drive Preview
Preview drive contents directly on the Falcon-NEO2. The file browser feature provides logical access to source or destination drives and network repositories connected to Falcon-NEO2. Users can view the drive’s partitions and contents and view text files, jpeg, PDF, XML, HTML files. Users can also view the contents of .dd, e01, ex01, dmg, L01 image files created by Falcon-NEO2. Other methods to preview include using the file browser feature and Falcon-NEO2’s web browser on a PC/laptop or preview over a network via SMB or iSCSI (as an iSCSI target). 3rd party analysis tools can be used with SMB or iSCSI methods.
Parallel Imaging
Simultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01, ex01, dd or dmg format.
Network Traffic Capture
Capture network traffic, internet activity and VOIP. Sniff data on a network and store captured packets on a hard drive connected to Falcon-NEO2. The data is saved and stored to a *.pcapnpg file format which can be opened by various software programs such as Wireshark. Chain destination feature allows spanning to multiple destinations.
Network Services
Users can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI, Iperf and Ping, for security purposes.
Image Restore
File to drive mode restores dd,dmg,e01,ex01 images created by the Falcon-NEO2 to another drive.
Task Macro
Allows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive. Set up to five Macros with up to 9 operations/tasks for each macro.
Network Push Feature
Push evidence files from destination drives connected to the Falcon-NEO2 or from a Falcon-NEO2 repository to a network location. The Push feature provides a more secure method than simply copying and pasting to the analysis computer by performing an MD5 or SHA hash during the push process. Additionally, users can select to verify the file transfer to ensure data integrity. Network users can then quickly preview data or copy data to a local drive or to any other directory on the network. The Falcon-NEO2 generates a log file for each push process.
Web Browser/Remote Operation
An easy to use and intuitive interface allows you to connect to the Falcon-NEO2 from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad, iPhone, and Android devices.
Wipe
Wipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min. Supports the ATA Sanitize command. Complies with NIST 800-88 guidelines. User selectable option to verify wipe pass value during the wipe process.
Resume Feature
For drive to drive or drive to file cloning tasks that get interrupted (for example, due to a power loss or if task is aborted) giving the user the option to resume or restart.
Encryption
Secure sensitive evidence data with open-source whole drive NIST-recommended XTS-AES-256 encryption cipher mode. Decryption can be performed using the Falcon-NEO2 or by using a free open source decryption software such as VeraCrypt, TrueCrypt. or FreeOTFE.
ATA Security
Unlock and clone ATA Security locked drives. Temporarily unlock drives and then clone, hash or wipe. Requires ATA Security password to unlock.
Multiple Imaging Formats
The Falcon-NEO2 images and verifies to the following formats: native or mirror copy, dd image,.dmg image, e01, ex01. The Falcon-NEO2 supports MD5, SHA1, SHA256 and dual-hash authentication.
File Systems
Falcon-NEO2 formats destination drives to NTFS, exFAT, HFS+, EXT4, EXT3, EXT2 or FAT32 file systems. The unit supports imaging from source drives formatted to any major file system.
Audit Trail Reporting/Log Files
Provides detailed information on each operation. Log files can be viewed on Falcon-NEO2 or from a web browser, exported to XML, HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when connected to Falcon-NEO2 from a web browser.
Image to External Storage Device
The Falcon-NEO2 allows you to image to an external storage device such as a NAS, using the 10 GbE ports, USB 3.2 or via the SAS/SATA connection.
Drive Time-out Feature
Users can set a specific time-out for connected hard drives. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives.
Reverse Read
Skip past a bad sector (based on error granularity settings) then read backwards, potentially capturing data that may not necessarily be read when skipping the entire block.
Drive Trim
Manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive.
PCIe Support
Support for M.2 PCIe NVMe SSDs, mini-PCIe and PCIe express cards is provided using optional adapters.
User Profiles/Configurations
Administrators can save configuration settings and set password-protected user profiles.
Broad Interface Support
Built-in support for SAS/SATA/USB/PCIe storage devices. Supports eSATA, mSATA and microSATA interfaces with adapters included with Falcon-NEO2. Optional adapters are available for 1.8″/2.5″/3.5″ IDE, 1.8″ IDE ZIF and flash drives. Supports SCSI, and FireWire with optional modules.
Capture Path Selection
Add folders to the destination repository and then select and image to the named folder. Empty folders can be deleted and folders can be renamed.
HPA/DCO/ACS3 Capture
Detect and capture Host Protected Areas (HPA), Device Configuration Overlay (DCO) and Accessible Max Address (ACS3) hidden areas on the source drive.
Removable Storage Drive
OS and audit trail/log files are stored on an internal drive. This drive is easily removed for secure/classified locations.
Error Handling
Drive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found the sector will be skipped by default. Changing the granularity allows more sectors to be skipped. There are 3 options (512 Bytes, 4096 Bytes, 64 KIB). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the entire cluster (4096 bytes or 8 sectors) will be skipped.
Partition Imaging
Select and image specific partitions on the source drive.
SCSI Module Support
The SCSI Module option expands the capability of the Forensic Falcon-NEO2 by providing support for imaging from and to SCSI hard drives. The Module connects seamlessly to the PCIe ports and provides 1 SCSI source port (write-protected) or 1 SCSI destination port.
FireWire Module Support
The FireWire Module option provides support for FireWire enclosures. The FireWire Module connects to the Falcon-NEO2’s PCIe ports and provides 1 FireWire source (write-protected) or destination port.
CD/DVD/BLU-RAY Imaging
Image CD/DVD/Blu-ray media by using a USB optical drive connected to the USB port on the Falcon-NEO2. Supports multi-session CD/DVDs.
Blank Disk Check
Verifies if the source or destination disk is empty or has been wiped.
Drive Spanning
Capture from one large capacity drive to two smaller capacity drives.
HDMI Port
An HDMI port is located on the back of the Falcon-NEO2. This port can be used to connect the Falcon-NEO2 to an HDMI external display.
Keyboard, Mouse
Any USB 3.2 port can be used for peripherals like a keyboard or mouse.
7″ Touchscreen
Uses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations.
One-Year Standard Warranty
The system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty (total of 2 years) and a 2 year extended warranty (total of 3 years) are available.
In The Box
- The Falcon-NEO2 includes the following:
- Power supply & U.S. power cord
- 2 4-in-1 SAS/SATA power & data cables
- 2 CAT 7 network cables
- eSATA to SATA cable
- mSATA to SATA adapter
- microSATA to SATA adapter
- USB male type-A to USB male type-C cable
- Soft-sided carrying case
Compact Size
The Falcon-NEO2 is light weight, at 3.35lbs (1.52kg) and features a small footprint of 10″ x 6.75″ x 3.25″ (254 mm x 171.45 mm x 82.55 mm).
*The Forensic Falcon-NEO2 achieves posted speeds using solid-state suspect drives that contain a freshly installed Windows 11 OS and random data and solid-state destination drives. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect and destination drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.
Specs
Power Requirements:
12 VDC Grounded 21 AMP
Power Consumption:
250W
Operating Temperature:
0-40 C (32-104 F)
Relative Humidity:
20% to 80% (no condensing)
Net Weight:
3.35 lbs (1.52 kg)
Dimensions:
10” x 6.75″ x 3.25” (254 mm x 171.45 mm x 82.55 mm)
Agency Approvals:
RoHs compliant
Accessories
PCIe Adapter Kit
Kit for M.2 PCIe, M.2 NVMe, M.2 SATA, PCIe and mini-PCIe cards. Includes 1 each: M.2 PCIe, M.2 SATA, Mini PCIe and PCIe extender cable.
M.2 NVMe to USB Adapter
10Gbps M.2 NVMe to USB Adapter. Includes USB-C to USB-C and USB-C to USB-A cables.
USB Flash Card Reader
Used for various flash media, including compact flash, SD cards.
USB3 to SATA Adapter
Convert USB 3.0 ports for use with SATA drives.
4-port USB 3.0 hub
Increase the number of USB 3.0 ports available.
2.5″/3.5″ IDE to SATA Adapter
2.5/3.5″ IDE to SATA adapter for 2.5″ or 3.5″ IDE/PATA drives.
1.8″ IDE to ZIF and ZIF to SATA Adapter
1.8″ IDE to ZIF and ZIF to SATA adapter pack for 1.8″ IDE/PATA drives.
USB SATA Kit
Includes 4 USB3 to SATA adapters, a power supply, and a 4-port power splitter cable for converting the any four USB ports from USB to SATA.
Falcon-NEO2 Hard case
Hard case (with laser-cut foam).
mSATA to SATA Adapter
mSATA to SATA adapter for mSATA type drives.
microSATA to SATA Adapter
microSATA to SATA adapter for microSATA drives.
U.2 NVMe to PCIe Adapter
U.2 NVMe to PCIe adapter for U.2 NVMe SSDs.
eSATA Cable
Cable for eSATA hard drives for eSATA drives.
SATA/SAS Data & Power Replacement Cable
SATA/SAS (12Gbps) data & power replacement cable (1-to-4).
50-pin to 68-pin SCSI adapter
For use with the Falcon-NEO2 SCSI Module Option.
80-pin to 68-pin SCSI adapter
For use with the Falcon-NEO2 SCSI Module Option.
