Falcon®-NEO2

Description

The Falcon-NEO2 is the groundbreaking follow-on to the Falcon®-NEO, which has long been recognized as the “Best In Class” among all imagers. With Project VIC Validation and the Triage function, triage source drive files against VICS, Comma-Separated Values (CSV), and X-Ways Hash Databases. Multi-Factor Authentication (MFA) support is available using the YubiKey 5 FIPS authenticators. The built-in File Browser now supports Thumbnail view for easier viewing. Retooled and optimized with a powerful new engine, the Falcon-NEO2 is the first field imager to surpass 100GB/min E01 capture speeds. Its SAS-3 architecture (12 Gbps SAS) supports up to 5 simultaneous tasks with up to 10 source and 11 destination ports. Image SAS-3 SSDs at speeds up to 115GB/min, and PCIe drives at speeds exceeding 100GB/min. The USB ports on the Falcon-NEO2 are USB 3.2 Gen-2 (10Gbps), and two 10GbE ports continue to be available on Falcon-NEO2 for imaging to/from network repositories. The “Cloud Storage Acquisition” and “Mobile Device Capture” are standard and available on the Falcon-NEO2, along with physical and logical support for AFF4.

TECHNICAL SPECIFICATIONS
 

• SAS-3 Support : Built-in native SAS-3 (12 Gbps) support for 4 Source and 4 Destination ports; total of 10 Sources and 11 Destinations.
• VICS Compliance : VICS Data Compliant with import and triage support for VICS Hash Databases.
• Hash Database Import : NEW: Import and convert VICS, Comma Separated Value (CSV), and X-Ways hash databases using the Graphical User Interface (GUI) for triage.
• Destination Drive Support : NEW: Support for non-Logicube formatted destination drives.
• Multi-Factor Authentication : Support for Multi-Factor Authentication (MFA) to network repositories.
• Concurrent Image & Verify : Perform simultaneous imaging and verification, a Logicube innovation since 2013.
• Thumbnail Preview : Thumbnail viewing of images in the built-in file browser for easier triage.
• AFF4 Support : Supports AFF4 physical and logical drive captures.
• Thunderbolt 3 : Support for Thunderbolt 3 source and destination drives with speeds up to 40 Gbps.
• USB Connectivity : 2 × USB 3.2 Gen 2 (10 Gbps) Source ports and 4 × USB 3.2 Gen 2 (10 Gbps) Destination ports.
• Imaging Performance : SSD imaging speeds up to 115 GB/min and PCIe cloning exceeding 100 GB/min.
• NVMe Imaging : 5-to-5 simultaneous independent NVMe drive Source-to-Destination captures.
• Mobile & Cloud Acquisition : Built-in support for mobile device and cloud storage acquisition.
• Multi-Tasking : Image and hash from up to 5 source drives simultaneously.
• Network Capture : Capture to and from network locations via dual 10 GbE ports with support for CIFS, iSCSI, network traffic, VoIP, and Internet activity.

FEATURES
 

• High-Speed Imaging : Image SAS-3 SSDs at speeds up to 115 GB/min and clone PCIe drives at speeds exceeding 100 GB/min.
• Comprehensive Source & Destination Ports : Supports SAS/SATA, USB 3.2 Gen 2, PCIe, and optional Thunderbolt™ 3/USB-C connectivity.
• AFF4 Imaging : Supports both physical and logical AFF4 imaging for secure digital evidence acquisition.
• VICS-Compliant Triage : Import VICS hash databases to quickly identify and triage evidence.
• Cloud Storage Acquisition : Acquire evidence directly from OneDrive, Dropbox, and Google Drive.
• Concurrent Image & Verify : Simultaneously image and verify data, reducing acquisition time.
• Multi-Tasking : Perform up to five concurrent operations including imaging, hashing, wiping, and network capture.
• Mobile Device Acquisition : Capture evidence from Apple iOS and Android devices with the optional Mobile Device Capture software.
• Mac Imaging Support : Acquire data from Mac computers using Target Disk Mode, USB boot devices, or Disk Utility.
• Logical Imaging : Capture only required files using filters, keyword searches, and file signatures.
• Encryption Support : Detect encrypted drives and decrypt BitLocker, Opal, VeraCrypt, and TrueCrypt protected volumes (with credentials).
• Network Imaging : Dual 10 GbE ports enable high-speed imaging to and from NAS devices, CIFS, and iSCSI repositories.
• File Browser : Preview drives, partitions, and forensic image files directly from the built-in interface.
• Multiple Image Formats : Supports DD, DMG, E01, EX01, native clone, and AFF4 formats with MD5, SHA1, and SHA256 hashing.
• Drive Wiping : Securely erase drives using DoD and NIST 800-88 compliant wiping methods, including ATA Secure Erase.
• Remote Web Management : Operate and manage the Falcon-NEO2 remotely through a web browser on desktop or mobile devices.
• Broad Drive Compatibility : Supports SAS, SATA, USB, PCIe, NVMe, eSATA, mSATA, microSATA, IDE, FireWire, and SCSI (optional modules).
• 7″ Capacitive Touchscreen : Intuitive touch interface for easy navigation and forensic workflow management.
• Compact & Portable : Lightweight design (3.35 lbs / 1.52 kg) with dimensions of 10″ × 6.75″ × 3.25″.
• One-Year Warranty : Includes one-year parts and labor warranty with optional extended coverage.

 
SPECS
 

• Power Requirements : 12 VDC Grounded, 21 AMP
• Power Consumption : 250W
• Operating Temperature : 0–40°C (32–104°F)
• Relative Humidity : 20% to 80% (Non-condensing)
• Net Weight : 3.35 lbs (1.52 kg)
• Dimensions : 10″ × 6.75″ × 3.25″ (254 × 171.45 × 82.55 mm)
• Agency Approvals : RoHS Compliant

HARDWARE & SOFTWARE OPTIONS
 

• Thunderbolt/USB-C I/O Card : Optional I/O card supporting direct imaging to and from Thunderbolt 3/USB-C and USB 3.1 Gen 2 external drives and storage enclosures. Connects to either of the two write-protected source I/O ports or one destination I/O port.
• FireWire Module : Optional module providing support for FireWire enclosures. Connects to either PCIe port and provides one write-protected FireWire source or destination port.
• SCSI Module : Optional module supporting 68-pin SCSI drives. Connects to either PCIe port and provides one write-protected SCSI source or one destination port. Optional adapters are available for 50-pin and 80-pin SCSI drives.
• Mobile Device Capture Option : Optional renewable software subscription available for Falcon-NEO2 units with serial numbers below 223000 (standard on units with serial numbers 223000 and above). Enables rapid acquisition of evidence from Apple iPhones, iPads, Android phones, and tablets, reducing the need for additional hardware during field investigations.

For more detailed features and specifications, Click here

Datasheets

Video

Categories