A Group of Cyber Security Specialists

Forensic Falcon

Forensic Falcon by Secure IndiaExtremely Fast Imaging The Falcon is the fastest forensic imaging solution available, achieving speeds of 20GB/min. The Falcon meets future hard drive speed improvements with SAS/SATA-3 6GB/s maximum rated speed of 37GB/min.

Multiple Image Formats The Falcon images and verifies to the following formats: native or mirror copy, dd image, e01, ex01 and file-based copy. e01 and ex01 feature user-selectable compression levels and the Falcon supports SHA1, SHA256 or MD5 authentication.

Multiple Imaging Ports Write-protected source ports include:
1 USB 3.0
1 Firewire
Destination ports include:
2 USB 3.0
1 Firewire

A Gigabit Ethernet port for network connectivity is built-in. An optional PCI express card interface (for new/future technologies such as Thunderbolt) is planned for future availability.In addition the unit includes a USB 3.0 device port for drive preview and two USB 2.0 host ports

Multi-task Improve efficiency and shorten the evidence collection process with the ability to hash one drive while wiping or imaging to another simultaneously.

Web-based User Interface An easy to use and intuitive interface allows you to connect to the Falcon from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.

Broad Interface Support Built-in support for SAS/SATA/USB/Firewire storage devices. Supports 1.8″/2.5″/3.5″ IDE and 1.8″ IDE ZIF and microSATA interfaces with adapters included with Falcon. Optional adapters are available for eSATA, mSATA and flash drives.

Wipe Wipe up to DoD specifications or use Secure Erase to erase drives.

Image to External Storage Device The Falcon allows you to image to an external storage device such as a NAS, using the Gigabit Ethernet port, USB 3.0 or via the SAS/SATA connection.

Battery Pack (optional) An optional rechargeable battery provides untethered use of Falcon. Planned for a future release.

Removable Storage Drive O/S and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations

7″ Touch Screen Uses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.

HPA And DCO Capture Detect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.

Forensic, Filter-Based File Copy Users can filter by the extended file name (such as .PDF, .xls, .JPEG, .mov etc.)and then copy.

Encryption Secure sensitive evidence data with whole drive AES 256 bit encryption. Decryption can be performed using the Falcon or by using off-the-shelf decryption software.

Parallel Imaging Simultaneously perform two imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01 format.

Concurrent Image+Verify (Patent-Pending)Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.

Image to or from a Network Location Use the Falcon to image to a network location using CIFS protocol and/or image from a network location using iSCSI. The Falcon uses CIFS protocol to provide file system access and the highest level of security and control. Users can also use iSCSI as a source or destination drive.

User Profiles/Configurations Administrators can save configuration settings and set password-protected user profiles. This feature is planned for a future update.

Drive Preview The Falcon features write-protected source ports. Use the Falcon as an external write-blocker using the USB 3.0 device port for secure drive preview/image transfer.

Destination Drive Bay An optional destination drive bay module features an easy to use slide-in design and includes a locking door. This option is planned for a future release

Tasks Macro Allows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive.

Network Capture Capture network frames to a PCAP file format. Decode using off the shelf tools, e.g. WireShark. This feature is planned for a future release.

Drive Spanning Capture from one large capacity drive to two smaller capacity drives. This feature is planned for a future release.

USB Host Ports The Falcon features two USB 2.0 host ports for keyboard, mouse or printer connectivity

HDMI Port An HDMI port is located on the back of the Falcon. This port can be used to connect the Falcon to a projector.

Audit Trail Reporting Generate and write to the internal storage drive for review and printing.The report is time-stamped.