Falcon-NEO2
Description
The Falcon-NEO2 is Logicube’s flagship field forensic imager, released in 2023 as the successor to the Falcon-NEO. It is the first field imager to exceed 100GB/min E01 capture speeds, built on a SAS-3 architecture that handles up to five simultaneous tasks across 10 source and 11 destination ports. It offers USB 3.2 Gen-2, dual 10GbE for network imaging, and built-in cloud storage acquisition. An optional module adds mobile device acquisition, and it has achieved VICS compliance for law enforcement use.
The principle
Camera Ballistics is not based on metadata such as EXIF, but it uses mathematics to analyze the physics of the sensor. Due to small differences in size and material composition, each pixel behaves differently, involving effects such as Photo Response Nonuniformity making each sensor unique.
High Speed Imaging
The Falcon-NEO2 achieves imaging from SAS-3 SSDs to SAS-3 SSDs at speeds up to 115GB/min. Clone PCIe to PCIe at speeds exceeding 100GB/min.
AFF4 Physical and Logical Imaging
Supports both physical and logical AFF4 imaging. Image source drives to AFF4 (Advanced Forensic File Format 4), an open-source format for digital evidence and data.
Two steps to digital forensic expertise
The power of Camera Ballistics is further amplified by its sleek and intuitive interface that guides you through processing in just a few clicks. Camera Ballistics takes its complex analysis method and turns it into a two-phase process. Simply create a few reference photos with the suspect camera for the program to learn about the device’s sensor and a sensor fingerprint will be generated. Camera Ballistics will use this fingerprint to analyze the photos you are investigating and match it to the ones taken by the suspected camera.
Multi-Factor Authentication
Utilize a YubiKey 5 FIPS series of authenticators to connect to a shared Active Directory network resource securely.
Multi-Task
Image simultaneously from multiple sources to multiple destinations including a network repository. Supports imaging to one location while simultaneously hashing and/or wiping a second drive. Perform up to 5 tasks concurrently. Little or no speed degradation when imaging from two sources to two destinations.
Wipe
Encryption Detection
Whole disk and partition level encryption detection. Easily identify Source drives with possible encryption.
Multiple Imaging Formats
The Falcon-NEO2 images and verifies to the following formats: native or mirror copy, dd image,.dmg image, e01, ex01. The Falcon-NEO2 supports MD5, SHA1, SHA256 and dual-hash authentication.
File Systems
Falcon-NEO2 formats destination drives to NTFS, exFAT, HFS+, EXT4, EXT3, EXT2 or FAT32 file systems. The unit supports imaging from source drives formatted to any major file system.