Logicube, Inc. Readme.Txt Release Date: 02/28/2020 === Software Update === Product Affected: Falcon Software version: v3.2u3 For the previous version history, please see the bottom of this document. Software release v3.2u3 adds the following update to the Falcon: 1. Fixed incorrect reporting of serial number for Kingston HyperX USB drive. 2. Fixed File to Drive issue with Ex01 images where image restore would show an error in the first % of the task. 3. Fixed Ex01 imaging issue when using Whole Disk setting with no compression. 4. Other bug fixes. === Installation Instructions === For complete instructions, please see the document titled: "Falcon SW Update Instructions" which can be found on the Forensic Falcon's support page at: http://www.logicube.com/knowledge/forensic-falcon. === Support === For assistance please contact Logicube tech support at: 818 700 8488 ext. 3, or by email to techsupport@logicube.com. Logicube tech support is available 7am-5pm PST, Monday through Friday, excluding U.S. legal holidays. Logicube Inc. 19755 Nordhoff Pl. Chatsworth, CA 91311 USA tel:818-700-8488 fax:818-435-0088 www.logicube.com === Version History === v3.2u1 (Release Date: 10/05/2017) - A new software release has been issued for the Forensic Falcon. This release incorporates a fix to resolve an issue where the Falcon may lock-up when connecting some BitLocker drives that were created using TPM (Trusted Platform Module) and older versions of windows operating systems. v3.2 (Release Date: 08/21/2017) - Added BitLocker decryption support. - Added Partition To File Cloning mode which can clone a partition to DD, E01, or EX01. This mode is also used to unlock a BitLocker encrypted volume or partition. See Section 3.1.2 in the new user's manual (manual version 3.2) for instructions on how to image BitLocker encrypted drives. - Encase and FTK now show the correct serial number when using the Falcon's "USB DEVICE" function. - Push task no longer requires an image to be selected. If no specific image is selected all images on the drive are pushed. - Minor bug fixes. v3.1 (Release Date: 01/31/2017) - Fixed issue when using a $ symbol in the password for Veracrypt encryption. - Fixed issue where Secure Erase resets to Off when the Format settings are accessed. - Added SHA-256 hash method for DD imaging. - Added Whole Disk segment size for E01 and EX01 imaging. - Added imaging from an external CD/DVD/Blu-ray (via USB connection) with multisession support. - Added Targeted Imaging Feature - Create a logical image by using pre-set filters, custom filters, file signature filters, and/or keyword search function to select and acquire only the specific files needed. Format output to LX01, ZIP or directory tree. Optionally, an MFT report can be generated that contains a potential deleted file list. - Minor bug fixes. v3.0u1 (Release Date: 06/14/2016) - File Browser now auto-refreshes/auto-updates when a drive is connected or disconnected. - Fixed issue where 'Mode' was selectable in HASH/VERIFY while a hash task was running. - Fixed label name issue in the software updates screen. - Fixed issue where a mouse pointer was showing when there is no mouse connected. - Fixed issue where repository names with uppercase letters caused error messages when using Imaging or Case Verify. - Language file updates. - Minor bug fixes. v3.0 (Release Date: 05/09/2016) - VeraCrypt support – Falcon now supports VeraCrypt encryption. VeraCrypt Destination drives encrypted by the Falcon can be decrypted using either the Falcon or VeraCrypt. - Image Restore – New Imaging mode that allows the restoration of DD, E01, or EX01 images created by the Falcon to its original file system. - Case Verification – New Hash mode used to verify/validate the hash value of cases/images created by the Falcon. - Dual Hash – Falcon now has the ability to perform both SHA-1 and MD5 hashes on DD, E01, and EX01 imaging. - End of task notifications – Audible notification can now be set. The notification can be set for successful tasks, failed tasks, or both. - Random Buffer option for custom wipe – A new option is available when performing a custom (pass-based) wipe on Destination drives. The Random Buffer option sets a random pattern which will be written to the Destination drive (instead of the same value on all sectors of the Destination drive). - Blank disk check - Tapping the Information icon (Drive Details) for each Destination drive will now show if the drive is blank (wiped). - Push function now supports case selection from drives connected to both source and destination ports. - Support for AHCI SSDs. - Security Improvements. - Improved Operating system security. - Improved USB export. - Minor bug fixes. v2.5 (Release Date: 09/30/2015) - Speed optimization for network based E01/EX01 captures. - On-screen numeric keypad now includes shift key support to show more accepted key characters. - Improved network auto-negotiation for better Local Area Network compatibility. - Minor bug fixes. v2.4u3 (Release Date: 09/16/2015) - Improved drive detection when exporting log files to USB drives connected to Falcon’s front USB ports. v2.4u1 (Release Date: 07/27/2015) - Date and Time now shows on the bottom right corner of the screen. - Improved File to File imaging - File to File can now image from a network source to a network destination. - Various bug fixes. v2.4 (Release Date: 04/10/2015) - Added: File browser - Preview text, html, pdf, and most common image files from Source or Destination drives directly on the Falcon's screen. - Added: Preview drives over the network using SMB. There are five (5) different ways of previewing drives connected to the Falcon. Information on all available methods can be found in SECTION 4 of the new user's guide (version 2.4.1) which can be downloaded from http://www.logicube.com/knowledge/forensic-falcon. - Added: Network Services page - Falcon now has the ability to block or disable certain network services for better security on the network. Blockable services include: SSH, Telnet, HTTP, CIFS/NETBIOS, iSCSI, Iperf, and Ping. - Added: Manage Repository edit function - Repositories can now be edited. This eliminates having to delete a repository, then re-add it when a folder, username, password, or domain/workgroup needs to be changed. - Added: Japanese language support. - Added: Network link speed is now displayed in the Falcon Statistics page. - Added: Refresh button on the Power Off page - This refreshes the on-screen GUI. - Improved: Push functionality - Falcon now has the ability to select one, multiple, or all cases to push. - Improved: Manage Repository password field - This password field has been improved to hide passwords when entered, for better security. - Improved: USB export performance. - Improved: Logs - Audit logs now show the expected hash (for Hash tasks), file filter value (for File-to-File imaging tasks), and the Vendor & Product values (for all tasks). Viewing logs on-screen is also improved to match PDF/HTML logs. - Various bug fixes. v2.3 (Release Date: 11/10/14) - Drive Trim – (Destination Drive Trim). This user selectable function allows the Falcon to manipulate the Device Configuration Overlay (DCO) and Host Protected Area (HPA) of the destination drive using the Device Configuration Set command for DCO and Set Max Address command for HPA so that the Destination drive’s total native capacity matches the Source drive. For detailed information, see section 4.0.3.5.1 of the user's manual. - Drive Inactivity Feature - A user selectable feature has been added to set a specific “time-out” for hard drives connected to Falcon. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives. - Added 'go to 0%' and 'go to 100%' buttons in all LBA settings screens. - Log file sections now match the same order as seen on the Falcon’s GUI. - Improved error handling and error reporting for Wipe/Clone/Imaging/Hash operations. - Improved detection of drives connected to USB Source and Destination ports. - Improved handling and reporting of drive serial numbers when using the F-USB2SATAU adapter. - Various bug fixes. v2.2.1u1 (Release Date: 09/28/2014) - Improved handling of bad sectors when using SAS and/or USB drives. v2.2.1 (Release Date: 09/08/2014) - Resolved issue where E01 and EX01 images could not be mounted properly in Forensic Analysis software. - Resolved issue where E01/EX01 image tasks with compression set higher than default would hang or crash. - Resolved issue where FireWire devices are not being mounted or are being mounted and seen as 0 bytes. v2.2 (Release Date: 08/14/14) - Improved User Interface (UI) responsiveness. - Error granularity for handling bad sectors (See section 4.0.3.3 of the user's manual). - Optimized software update process. Future software updates (if updating from this software version) will complete faster. - Improved handling of initialization errors. - Progress screen now shows the number of bad sectors encountered during the operation. - Log files on the Destination drives (when using E01, EX01, or DD) are now named after the Case/File Name in the Case Information screen (if a name is entered). - Secure Erase setting no longer changes from OFF to ON when changing a Wipe Pattern mode. - DoD wipe can now only be started with 7 configured passes. - Various bug fixes. v2.1.2rc08 (Release Date: 08/12/14) - Minor bug fixes. v2.1.2rc04 (Release Date: 04/16/14) - Improved file system detection for destination/repository drives to ensure the file system is supported (NTFS or EXT4). - Various bug fixes. v2.1rc09 (Release Date: 03/31/14) - Log Files will now be saved to the destination disk in PDF & HTML (DD, E01, and EX01 only). - Added "whole disk" option for segment size when performing Drive to File operation in DD mode. - Destination drives can now be previewed over the network. - Improved Task Macro data entry for easier management of tasks lists. - Users can now delete all images in a repository using the "delete all" command in the CLI. - Various minor bug fixes. v2.0u01 (Release Date: 12/20/13) - PDF output added to log files - Log files are now available in HTML, PDF, and XML. See section 3.7 of the user's manual on how to export log files. - User Profiles/Configurations can now be copied to other Falcon devices over a network connection via CLI. See Section 9.6 of the user's manual for detailed information. - Fixed an issue where some E01 and EX01 image captures were hanging when large capacity Source drives were used (Typically 500GB or larger). - Minor bug fixes. v2.0 (Release Date: 11/22/13) - TrueCrypt support - Falcon now supports using TrueCrypt to decrypt drives that were encrypted using the Falcon. For detailed information, see Chapter 7 in the user's manual. - NTFS support - Falcon can now format Destination drives using the NT File System (NTFS) as well as EXT4. For detailed information, see section 5.0.3.2.3 in the user's manual. - Improved Case File Naming - Case file names are customizable. A new field 'Case/File Name' is available. The DD, E01, or EX01 filenames will correspond to the information entered in this field. For detailed information, see Section 4.0.3.1 in the user’s manual. - Drive Spanning - Image from one large capacity source drive to multiple smaller capacity drives. For detailed information, see Section 3.1.1.1 in the user's manual. - Improved log file deletion - Log files can now be deleted from the GUI. An option to delete the log files one at a time or all the log files is available. For detailed information, see Section 3.7.2 in the user's manual. - Push - Push evidence files from destination drives connected to the Falcon or from a Falcon repository to a network location. MD5 or SHA hashing can be performed during the push process. Additionally users can select to verify the file transfer to ensure data integrity. A log file is generated for each push operation. For detailed information, see Section 5.0.4 in the user’s manual. - iSCSI enhancements - Source drives are now viewable over a network connection using an iSCSI initiator. For detailed information, see Chapter 10 in the user's manual. - Language support - Korean language support is now available. For detailed information, see Section 5.0.10.4 in the user's manual. - Improved E01/EX01 imaging speeds. - Task Macro improvement - Task Macro operations increased to 9 sequential operations (up from 5). - Minor bug fixes. v1.2 (Release Date: 10/08/13) - Improved operation and resolution of critical bugs when using parallel task feature. - Improved support for 4TB hard drives. - Long repository names now display correctly. - Zero Configuration Networking (Zeroconf) added. Zeroconf is a method of networking devices via an Ethernet cable without requiring configuration and administration. Zeroconf is able to allocate addresses without a DHCP server and translate between domain names and IP addresses without a DNS server. - Case Info screen (Examiner, Case ID, Evidence ID, and Case Notes) is now available when performing a hash or wipe operation. - Improved support for USB drives and devices when performing software updates. - Other bug fixes. v1.0rc28 (Release Date 08/07/13) - Improved log messages. Log files now show the selected algorithm when running a Hash operation/task. Log files also now show if a Destination drive is encrypted. - HDMI port is now active. Information on the HDMI port can be found in the User's manual. - Better compatibility with exporting log files using USB flash drives formatted in Windows. - When using the 'Drive to File' imaging mode, users can now run two imaging tasks using two different Source drives to the same (one) Destination. - Fixed a bug where imaging using 'Drive to File' from one Source to two destinations with Verify set to 'Yes' can cause the Falcon to hang or crash. - Fixed a bug where formatting (with encryption enabled) two drives (in a single wipe task from the WIPE menu) resulted in only one of the two drives being formatted. Users will now see both drives mounted correctly (and the Falcon will not prompt the user to re-format) during the Imaging operation. - Other minor bug fixes. v1.0rc22 (Release Date: 07/19/13) - Resolves bugs within the following operations: Task Macro, Parallel Imaging, Config. Lock function. In addition corrected the GUI (screen) selections under USB Engage Mode. v1.05rc15 - Initial release