top of page
Logicube® Falcon®-NEO2
The Falcon-NEO2 is the groundbreaking follow-on to the Falcon®-NEO which has long been recognized as the “Best In Class” among all imagers. Retooled and optimized with a powerful new engine, the Falcon-NEO2 is the first field imager surpassing 100GB/min E01 capture speeds.
 
Its SAS-3 architecture (12 Gbps SAS) supports up to 5 simultaneous tasks with up to 10 source and 11 destination ports. Image SAS-3 SSDs at speeds up to 115GB/min, and PCIe drives at speeds exceeding 100GB/min. The USB ports on the Falcon-NEO2 are USB 3.2 Gen-2 (10Gbps), and two 10GbE ports continue to be available on Falcon-NEO2 for imaging to/from network repositories. The “Cloud Storage Acquisition” is standard and available out of the box on the Falcon-NEO2 along with support for AFF4.
 
In short, the Forensic Falcon-NEO2 is designed to take the already peerless standards set by Logicube to a higher level by offering features, capabilities, and speeds not available on any forensic field imager before.
 
  • Image E01 from SAS-3 SSD to SAS-3 SSD at up to 115GB/min
  • Clone PCIe to PCIe at speeds exceeding 100GB/min
  • Wipe PCIe drives at speeds up to 115GB/min
  • Supports up to 10 source and 11 destination ports
  • Support for AFF4 Capture
  • M.2 NVMe support for up to 5-to-5 simultaneous tasks with optional adapters
  • Multi-task. Image from up to 5 sources simultaneously; Support for 4 SAS/SATA source drives are included with a 4-in-1 SAS/SATA cable
  • All USB-A ports are 10Gbps
  • 12Gbps SAS-3 support
  • Image to/from Thunderbolt™ 3/USB-C external storage enclosures with an optional I/O card
  • Standard Cloud Storage Acquisition software provides convenient capture of OneDrive, Google Drive, and Dropbox files
  • Create a logical image targeting specific user/data files
  • Concurrent Image+Verify greatly reduces duration of image plus verification process
  • Two 10GbE connections provide fast network imaging performance
  • Network capture feature to capture network traffic, VOIP, internet activity
  • Capture from mobile devices including Apple® iPhones, iPads, Android phones and tablets with optional renewable software package
 

Logicube® Falcon®-NEO2

SKU: log-F-FALCON-NEO2
£3,699.00Price
Quantity
Ships from USA allow 7-14 days

  • HIGH SPEED IMAGING

    The Falcon-NEO2 achieves imaging from SAS-3 SSDs to SAS-3 SSDs at speeds up to 115GB/min. Clone PCIe to PCIe at speeds exceeding 100GB/min.

     

    SOURCE PORTS

    • 4 SAS/SATA drives supported with 1 port
    • 2 USB 3.2 (Gen 2, can be converted to SATA using an optional USB to SATA adapter)
    • 1 PCIe
    • 2 I/O ports for use with optional I/O cards including Thunderbolt™3/USB-C

     

    DESTINATION PORTS

    • 4 SAS/SATA drives supported with 1 port
    • 4 USB 3.2 (Gen 2, can be converted to SATA using an optional USB to SATA adapter)
    • 1 PCIe
    • 1 I/O port for use with optional I/O cards including Thunderbolt™3/USB-C

    CLOUD STORAGE ACQUISITION

    Now included as a standard feature. Allows users to acquire files from OneDrive, Dropbox, or Google Drive. Capture to any destination drive or network repository.

     

    CONCURRENT IMAGE+VERIFY

    Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image+verify process time may be reduced by up to half.

     

    MULTI-TASK

    Image simultaneously from multiple sources to multiple destinations including a network repository. Supports imaging to one location while simultaneously hashing and/or wiping a second drive. Perform up to 5 tasks concurrently. Little or no speed degradation when imaging from two sources to two destinations.

     

    THUNDERBOLT3/USB-C SUPPORT

    An optional I/O card supports imaging directly to/from Thunderbolt 3/USB-C and USB 3.1 Gen 2 external drives and storage enclosures. The card connects to the Falcon-NEO2’s 2 write-blocked source I/O ports or 1 destination I/O port. Organizations can take advantage of Thunderbolt 3 technology’s fast transfer speeds when imaging directly to large capacity Thunderbolt 3 RAID storage enclosures for evidence data collection. The I/O card does not currently support imaging in TDM from Mac systems, please refer to the Falcon-NEO2 users’ manual on how to image from Mac systems in TDM using the USB ports or our iSCSI boot device.

     

    MOBILE DEVICE CAPTURE

    Acquire critical digital evidence from mobile devices, including Apple iPhones, iPads, Android phones and tablets with an optional renewable software subscription. Capture SMS, MMS, photos, videos. Supports up to iOS version 16.x and Android 4.0 and up.

     

    IMAGE FROM A MAC COMPUTER

    Image from a Mac computer with USB-C ports using a USB-C to USB-A cable and Target Disk Mode. Users can also image from Mac computers using Logicube’s USB boot device. Create a forensic bootable USB flash drive to image a source drive from a Mac on the same network without booting the computer’s native OS. The Falcon-NEO2 supports imaging from MacBook Pro systems and supports imaging from Mac computers that use the Apple T2 Security Chip by using file to file mode or using the Mac computer’s Disk Utility.

     

    LOGICAL IMAGING FEATURE

    Shortens acquisition time. Create a logical image by using pre-set filters, custom filters, file signature filters, and/or keyword search function to select and acquire only the specific files you need. An MFT report can be generated that contains a potential deleted file list. Format output to L01, LX01, ZIP or directory tree. Users can browse and view directly on the built-in display or manage and view on a networked Falcon-NEO2 from your laptop/desktop using a web browser.

     

    ENCRYPTION DETECTION

    Whole disk and partition level encryption detection. Easily identify Source drives with possible encryption.

     

    BITLOCKER, OPAL, VERACRYPT, AND TRUECRYPT DECRYPTION SUPPORT

    Decrypt partitions (requires the recovery key or password) and then image the selected partition. BEK (BitLocker Encryption Key) file is supported to unlock FIPS-compliant BitLocker encryption.

     

    APFS SUPPORT

    Supports logical imaging (using file to file mode) from drives formatted to APFS (Apple File System). Requires use of Advanced set-up, reference the users’ manual for complete information. The Falcon-NEO2 can also view and browse APFS files using the built-in file browser feature.

     

    IMAGE FROM DESKTOP/LAPTOPS

    Create a forensic bootable USB flash drive to image a source drive from a computer on the same network without booting the computer’s native OS. Supports Surface Pro 4 and above laptops.

     

    TWO 10 GBE NETWORK PORTS

    Two 10 GbE network ports provide fast network imaging. Image to/from a network repository using CIFs protocol or iSCSI. Users can connect to a 10GbE NAS and connect to your network using the 2nd 10GbE port to minimize bottlenecks.

     

    FILE BROWSER/WRITE-BLOCKED DRIVE PREVIEW

    Preview drive contents directly on the Falcon-NEO2. The file browser feature provides logical access to source or destination drives and network repositories connected to Falcon-NEO2. Users can view the drive’s partitions and contents and view text files, jpeg, PDF, XML, HTML files. Users can also view the contents of .dd, e01, ex01, dmg, L01 image files created by Falcon-NEO2. Other methods to preview include using the file browser feature and Falcon-NEO2’s web browser on a PC/laptop or preview over a network via SMB or iSCSI (as an iSCSI target). 3rd party analysis tools can be used with SMB or iSCSI methods.

     

    PARALLEL IMAGING

    Simultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01, ex01, dd or dmg format.

     

    NETWORK TRAFFIC CAPTURE

    Capture network traffic, internet activity and VOIP. Sniff data on a network and store captured packets on a hard drive connected to Falcon-NEO2. The data is saved and stored to a *.pcapnpg file format which can be opened by various software programs such as Wireshark. Chain destination feature allows spanning to multiple destinations.

     

    NETWORK SERVICES

    Users can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI, Iperf and Ping, for security purposes.

     

    IMAGE RESTORE

    File to drive mode restores dd,dmg,e01,ex01 images created by the Falcon-NEO2 to another drive.

     

    TASK MACRO

    Allows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive. Set up to five Macros with up to 9 operations/tasks for each macro.

     

    NETWORK PUSH FEATURE

    Push evidence files from destination drives connected to the Falcon-NEO2 or from a Falcon-NEO2 repository to a network location. The Push feature provides a more secure method than simply copying and pasting to the analysis computer by performing an MD5 or SHA hash during the push process. Additionally, users can select to verify the file transfer to ensure data integrity. Network users can then quickly preview data or copy data to a local drive or to any other directory on the network. The Falcon-NEO2 generates a log file for each push process.

     

bottom of page