Logicube Forensic Falcon™ User’s Manual
59
6: Types of Operations
6.0 Types of Operations - Introduction
There are fourteen (14) types of operation available on the Falcon. The left side of the screen
shows the different operation types that can be set. Detailed information on all of the different
operations and their screens can be found in this section.
1.
IMAGING –
Performs an image from a Source to a Destination. There are four modes
available:
a.
Drive to Drive
– Performs a bit-for-bit copy of the Source producing an exact
duplicate of the Source drive.
b.
Drive to File
–
Images the Source to any of the following image output formats:
DD
,
E01
,
EX01
, or
File
. Compression is available for E01 and EX01 formats.
c.
File to File (Targeted Imaging feature) –
The Falcon can shorten acquisition time
by creating a logical image by using pre-set filters, custom filters, files signatures
filter, and/or keywords search function to select and acquire only the specific
files needed. Output formats available are: LX01, ZIP or directory tree.
Optionally an MFT report can be generated, which contains a list of deleted files
(if present) that can potentially be restored or recovered.
