Logicube F-FALCON-SA, Руководство пользователя

Страница: 23 / 168

Logicube Forensic Falcon™ User’s Manual
14
3: Quick Start
3.0 Quick Start Guide
This chapter gives a basic overview and steps on how to perform different types of operations
using the Falcon (Image, Hash, Wipe, etc.). Complete details on each operation, menu, or
selection, and the different screens can be found in
Chapter 5: Imaging and Chapter 6: Types of
Operation .
The Falcon can perform up to five (5) tasks per mode of operation (Image, Hash, and/or Wipe).
It is highly recommended to change the passwords for built-in accounts. Instructions
on how to change the passwords to the two built-in accounts can be found in
Chapter 17 .
3.1 Imaging
This type of operation allows the imaging of a Source drive to one or more
Destinations. There are four (4) different imaging modes and several settings
to choose from. These selections should be performed in order from left to
right.

Drive to Drive – Performs a bit-for-bit copy of the Source producing an exact duplicate
of the Source drive. This is also known as a native copy or mirror copy.

Drive to File – Images the Source to any of the following image output file formats: DD ,
E01 , or EX01 . Compression is available for E01 and EX01 formats.
E01 and EX01 files created on the Destination may be smaller than the selected
Segment Size if compression is used. For example, if 4GB segment size selected,
some files may be less than 4GB. This occurs when there is a lot of blank space on
the Source drive.

File to File (Targeted Imaging feature) – The Falcon can shorten acquisition time by
creating a logical image by using pre-set filters, custom filters, files signatures filter,
and/or keywords search function to select and acquire only the specific files needed.
Output formats available are: LX01, ZIP or directory tree. Optionally an MFT report can
be generated, which contains a list of deleted files (if present) that can potentially be
restored or recovered.

File to Drive (Image Restore) – Restores DD, E01, EX01 images created by the Falcon to
another drive.