Falcon®-NEO review by John Thackray

The key phase of any digital investigation is the acquisition and verification of potential evidence. If this is not done in a safe and reliable manner, any future analysis is put at risk of being considered inadmissible. To safeguard against this issue, there are various forensic imagers on the market. When choosing between the various options for forensic hardware and software, an independent test is of added value.

Recently, John (Zeke) Thackray, a renowned forensic investigator, tested our partner Logicube’s Falcon®-NEO forensic imager on this basis. Following the test and evaluation of the Falcon®-NEO he concluded that it was by far the "Best in Class" solution for forensic imagers. The review’s findings are summarised below.

The review

Relevance and necessity
Logicube has exceeded all expectations with the improvements and new operational modules available for the Falcon®-NEO. They have clearly kept up with technological advancement and listened to user-demands in their quest for new initiatives and developments.

The improved capabilities and options offered by the Falcon®-NEO, with a wide range of supported devices, encryption, mobile device capturing, network traffic and cloud collections, remote operating, highlight once more Logicube’s position as global leader in terms of data imaging. They are miles ahead of the competition.

Authentication, reliability, and accuracy
The touchscreen interface and variety of available options provide the Falcon®-NEO with great professionalism and a feel-good factor. The Falcon®-NEO performed admirable compared to its main competitors, and consistently exceeded all other tested data acquisition solutions. The acquisition speeds (50GB to 90GB per minute) and data deletion speeds (30GB to 70GB per minute) as validated are simply phenomenal. The simultaneous verification improves data acquisition efficiency, as well as its potential execution speed for safeguarding the continuity and integrity of the data acquired. The speeds achieved both in lab and field conditions do not only meet the demands imposed on advanced high-volume operating system processing, but also the extremely large capacities of household computers now found even in small digital investigations.

The ability to automate and selectively gather information is of crucial importance for investigations that involve privacy or e-Discovery demands. The improved data range, file type, and key word filtering possibilities further improved the efficiency and quality of the gathered data. Many of the Falcon®-NEO’s functions are considered standard, and are expected of this kind of product. However, when combined with its macro task, network, cloud, and mobile device capture capabilities, the NEO can be deployed in many different ways, simplifying the process for non-technical first responders.

The Falcon®-NEO is suitable for more than the forensic community. IT-security consultants, system managers, and auditors can also use it to gather and identify data for routine, non-criminal investigations. The device has many capabilities needed for general IT-maintenance and management, such as capturing network traffic for analysis, or the removal option that irrevocably removes information when recycling systems for reusing in an organisation or for resale to third parties.

As a user of similar competing products, Logicube has far exceeded expectations through its new expansions and operational modules now available for the Falcon®-NEO. This is mainly evident from processing speed, but also from the additional advanced functionality and support from its Mobile Device Capture, Cloud Storage Acquisition, Fibre Channel, FireWire, SCSI and Thunderbolt options.

Compared to other digital forensic imaging solutions on the market, Logicube’s Falcon®-NEO is once more the most complete and exceedingly user-friendly solution for digital forensic investigations and IT-management. The many characteristics and capabilities of Falcon®-NEO make it a consistent advance in functionality, processing, and reliability.

Complies with global norms and guidelines
The simple and automated capabilities, including remote access where needed, offer a fail-safe solution for first responders and investigators aiming to ensure that consistency and best-practice guidelines are just noted, but also followed and safeguarded.

Compatibility
The Falcon®-NEO produces output in a format compatible with all important computer, mobile forensic, IT security, and eDiscovery analysis and processing tools. Moreover, the potential for time-saving with this all-in-one solution is vast.

Want to know more about the de Falcon®-NEO after this review? Want to try it out for yourself? Be sure to contact us today.