Logicube Forensic Falcon™ User’s Manual
155
17: FREQUENTLY ASKED QUESTIONS
17.0 FAQs
Q.
Why is it when I image a drive the number of bytes shown is twice the size of my Source drive?
A.
The number of bytes shown on the progress bar is not the actual size of the drive. This is the actual
data being processed. When ‘Verify’ is set to “Yes”, the reported number will double in size.
Q.
Is there a way to image a drive inside a computer without having to remove it and connect it directly
to the Falcon?
A.
Yes. There is a Forensic USB Boot Client for the Falcon. The Application Note and Instructions can be
found on the Falcon support page:
http://www.logicube.com/knowledge/forensic-falcon
Q.
How many concurrent tasks can the Falcon run?
A.
The Falcon can run up to 5 concurrent tasks.
Q.
Do Destination drives need to be wiped or formatted using the Falcon?
A.
For Drive to File mode, the Falcon must be used to format Destination drives. This helps ensure that
the images and data are written properly to the Destination drive(s). The Falcon logs all wipe and
format operations.
Q.
Can the Falcon image Linux partitions?
A.
Yes. Falcon can image Linux partitions.
Q.
Can the Falcon image a Hierarchical File System (HFS)?
A.
Yes, Falcon can image HFS.
Q.
How does the Falcon handle bad sectors found on the Source drive?
A.
Falcon will retry the bad sector 7 times. After the 7
th
attempt, if the sector still cannot be read, it will
skip that sector and list the sector in the log file.
Q.
What operating system does Falcon use?
A.
Falcon uses a Linux-based operating system. A Linux-based operating system provides increased
stability and security over Windows-based systems.
Q.
What file format does Falcon use when formatting destination drives?
A.
Falcon can format destination drives using the NT File System (NTFS) or EXT4 file system.
