The next-generation of our ground-breaking Forensic Falcon®, the Falcon®-NEO achieves imaging speeds surpassing 50GB/min imaging speed*. Efficient and secure digital evidence collection is accomplished with a feature-set that provides sophisticated functionality with a goal to shorten acquisition time. Designed to meet future technological advances in digital forensics, the Falcon-NEO sets new standards in forensic imaging technology.

· Extreme speed, imaging at surpassing 50GB/min*. Clone PCIe to PCIe at speeds over 90GB/min

· Image & verify from 4 source to 8 destination drives for ultra-efficient imaging

· Targeted/logical Imaging feature creates a logical image using pre-set, custom filters, file signature files and keyword search to capture only specific files needed

· Image to/from a network location using two 10GbE connections for fast network imaging performance and to minimize bottlenecks

· Multi-task. Perform image, wipe, hash tasks simultaneously. Little or no speed degradation when imaging from two sources to two destinations

· Concurrent Image+Verify feature. Verification starts shortly after imaging process begins, significantly reducing the image plus verification process time

· Write-blocked preview & triage directly on the Falcon-NEO

· Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using Falcon-NEO or Veracrypt

· Network Traffic Capture. Capture network traffic, VOIP, internet activity

Extremely Fast ImagingThe Falcon®-NEO is the fastest forensic imaging solution available, achieving imaging speeds surpassing 50GB/min*. The product can clone PCIe to PCIe drives at speeds over 90GB/min.
Multiple Image FormatsThe Falcon-NEO images and verifies to the following formats: native or mirror copy, dd image,.dmg image, e01, ex01.The Falcon-NEO supports MD5, SHA1, SHA256 and dual-hash (MD5+SHA-1) authentication.

File SystemsFalcon-NEO formats destination drives to NTFS, exFAT, EXT4, or FAT32 file systems.The unit supports imaging from source drives formatted to any major file system.
Multiple Imaging Ports4 write-protected source ports include:
2 SAS/SATA
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
1 PCIe

8 destination ports include:
2 SAS/SATA
2 SATA only
3 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
1 PCIe
All destination ports are built into the unit, no additional module or bay attachments required.

Two 10GbE network portsprovide state-of-the-art connectivity for fast network imaging performance.
I/O Card PortsDesigned for the future, the Falcon-NEO includes 2 source I/O card ports and 1 destination I/O port to support new interface technologies as they arrive on the market. A Thunderbolt™/USB 3.1 Gen 2/USB-C I/O card is planned for a future release.
Multi-taskImage simultaneously from multiple sources to multiple destinations including a network repository. Supports imaging to one location while simultaneously hashing and/or wiping a second drive. Perform up to 5 tasks concurrently. Little or no speed degradation when imaging from two sources to two destinations.
Task MacroAllows users to set specific tasks to be performed sequentially. For example, first wipe, then image, then verify a drive.Set up to five Macros with up to 9 operations/tasks for each macro.

Parallel ImagingSimultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive in native copy format while imaging to a different destination drive using e01, ex01, dd or dmg format.
Web Browser/Remote OperationAn easy to use and intuitive interface allows you to connect to the Falcon-NEO from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.

Broad Interface SupportBuilt-in support for SAS/SATA/USB/PCIe storage devices. Supports eSATA, mSATA and microSATA interfaces with adapters included with Falcon-NEO. Optional adapters are available for 1.8″/2.5″/3.5″ IDE, 1.8″ IDE ZIF and flash drives.
PCIe SupportSupport for M.2 PCIe and M.2 NVMe type SSDs and mini-PCIe and PCIe express cards is provided using optional adapters
CD/DVD/Blu-ray ImagingThe Falcon-NEO can image CD/DVD/Blu-ray media by using a USB optical drive connected to the USB port on the Falcon-NEO. The Falcon supports multi-session CD/DVDs.
WipeWipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min
Image to External Storage DeviceThe Falcon-NEO allows you to image to an external storage device such as a NAS, using the 10GbE ports, USB 3.0 or via the SAS/SATA connection.
SCSI Module OptionThe SCSI Module option expands the capability of the Forensic Falcon-NEO by providing support for imaging from and to SCSI hard drives. The Module connects seamlessly to the Falcon-NEO and provides 1 write-protected SCSI source port or SCSI destination port.

Image From Desktop/Laptop PCsCreate a forensic bootable USB flash drive to image a source drive from a computer on the same network without booting the computer’s native OS. Supports Surface Pro 4 and above laptops. For instructions on how to create the USB flash drive go to the Falcon-NEO Knowledge Base page.
Image from a Mac® ComputerImage from a Mac computer with USB-C ports using a USB-C to USB-A cable and Target Disk Mode. Users can also image from Mac computers using Logicube’s USB boot device. Create a forensic bootable USB flash drive to image a source drive from a Mac on the same network without booting the computer’s native OS. The Falcon-NEO supports imaging from MacBook Pro® systems.

Error handlingDrive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found Falcon-NEO will, by default skip that sector. Changing the granularity allows more sectors to be skipped. There are 3 options (512 Bytes, 4096 Bytes, 64 KIB). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the Falcon-NEO will skip the entire cluster (4096 bytes or 8 sectors).
Reverse Readsetting instructs the Falcon-NEO to skip past a bad sector ( based on error granularity settings) then read backwards, potentially capturing data that may not necessarily be read when skipping the entire block.
Removable Storage DriveOS and audit trail/log files are stored on an internal drive. This drive is easily removed for secure/classified locations.7″ Touch ScreenUses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.
HPA And DCO CaptureDetect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.
Compact SizeThe Falcon-NEO is light weight, at 3.0lbs (1.36kg) and features a small footprint of 10″W X 3.25″H X 6.75″D (25.4cm X 8.2cm X 17.1cm)

Targeted Imaging featureShortens acquisition time. Create a logical image by using pre-set filters, custom filters, file signature filters, and/or keyword search function to select and acquire only the specific files you need. An MFT report can be generated that contains a potential deleted file list. Format output to L01, LX01, ZIP or directory tree. Users can browse and view directly on the Falcon-NEO display or manage and view on a networked Falcon-NEO from your laptop/desktop using a web browser.
Partition ImagingSelect and image specific partitions on the source drive.
Concurrent Image+VerifyImaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image+verify process time may be reduced by up to half.
BitLocker SupportImage source drives that have been encrypted using BitLocker. Decrypt partitions (requires the BitLocker password) and then image the selected partition.
ATA SecurityUnlock and clone ATA Security locked drives. Temporarily unlock drives and then clone,hash or wipe. Requires ATA Security password to unlock
Image to or from a Network RepositoryImage to a network repository using CIFs protocol and/or image from a network location using iSCSI. 2 X 10GbE ports are available. Users can connect to a 10GbE NAS as a source and connect to your network using the 2nd 10GbE port to minimize bottlenecks. Provides a secure method to isolate the source network/NAS from the destination NAS/network.
Network Traffic CaptureCapture network traffic, internet activity and VOIP. Sniff data on a network and store captured packets on a hard drive connected to Falcon-NEO. The data is saved and stored to a *.pcanpg file format which can be opened by various software programs such as Wireshark. Chain destination feature allows spanning to multiple destinations.
Network ServicesUsers can disable various network services such as HTTP, SSH, Telnet, CIFS/NETBIOS, iSCSI Iperf and Ping, for security purposes.

Write-Blocked Drive Preview.Preview drive contents directly on the Falcon-NEO. The file browser feature provides logical access to source or destination drives connected to Falcon-NEO. Users can view the drive’s partitions and contents and view text files, jpeg, PDF, XML, HTML files. Other methods to preview include using the file browser feature and Falcon-NEO’s web browser on a PC/laptop or preview over a network via SMB or iSCSI (as an iSCSI target). 3rd party analysis tools can be used with SMB or iSCSI methods.
Network Push FeaturePush evidence files from destination drives connected to the Falcon-NEO or from a Falcon-NEO repository to a network location. The Push feature provides a more secure method than simply copying and pasting to the analysis computer by performing an MD5 or SHA hash during the push process. Additionally, users can select to verify the file transfer to ensure data integrity. Network users can then quickly preview data or copy data to a local drive or to any other directory on the network. The Falcon-NEO generates a log file for each push process.
Image RestoreFile to drive mode restores dd,dmg,e01,ex01 images created by the Falcon-NEO to another drive.

User Profiles/ConfigurationsAdministrators can save configuration settings and set password-protected user profiles.
Audit Trail Reporting/Log FilesProvides detailed information on each operation. Log files can be viewed on Falcon-NEO or via a web browser, exported to XML, HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when connected to Falcon-NEO via a web browser
EncryptionSecure sensitive evidence data with open-source whole drive NIST recommended XTS-AES-256 encryption cipher mode. Decryption can be performed using the Falcon-NEO or by using a free open source decryption software such as VeraCrypt, TrueCrypt http://www.truecrypt.org. or FreeOTFE (On The Fly Encryption), http://sourceforge.net/projects/freeotfe.mirror/.
Drive TrimAllows the Falcon-NEO to manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive.

Drive “Time-Out” FeatureUsers can set a specific “time-out” for hard drives connected to Falcon-NEO. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives.

Drive SpanningCapture from one large capacity drive to two smaller capacity drives.
Blank Disk CheckVerifies if the source or destination disk is empty or has been wiped.
Keyboard, MouseAny USB 3.0 ports can be used for keyboard, mouse or printer connectivity.
HDMI PortAn HDMI port is located on the back of the Falcon-NEO. This port can be used to connect the Falcon-NEO to a projector.

One-year Standard WarrantyThe system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty ( total of 2 years) and a 2 year extended warranty (total of 3 years) are available.

In The BoxThe Falcon-NEO includes the following:
Carrying case
Power supply and power cord
6 SAS/SATA cables
2 CAT7 network cables
6 6-pin SATA plugs
1 1.8″ microSATA to SATA adapter
1 mSATA to SATA adapter
1 eSATA to SATA converter cable
Users manual on CD-ROM


*The Forensic Falcon-NEO achieves speeds surpassing 50GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.

Specs:Return to top

Power Requirements:12VDC Grounded 21 AMP
Power Consumption:Operating Temperature:0-40C (32-104 F)
Relative Humidity:20% to 80% (no condensing)
Net Weight:3.0 lbs (1.36kg)
Dimensions:10”W X 3.25”H X 6.75”D (25.4cm X 8.2cm X 17.1cm)
Agency Approvals:RoHs compliant. FCC Part 15 Class A, CE

Software:Return to top

Falcon-NEO product software updates can be found by navigating toKnowledge Base

AccessoriesReturn to top

F-FALNEO-SCSI-OPT
Provides 1 SCSi port that can be used as either source (write-protected) or destination. Connects to the PCIe ports on the Falcon-NEO. Available August 2018

F-ADP-SCSI-50

50 pin to 68 pin SCSI adapter for use with the Falcon-NEO SCSI Module Option (F-FALNEO-SCSI-OPT)

F-ADP-SCSI-80

80 pin to 68 pin SCSI adapter for use with the Falcon-NEO SCSI Module Option (F-FALNEO-SCSI-OPT)

F-ADP-USB2SATAU

USB 3.0 to SATA Adapter and power supply

F-CBL-USB-PWR
Cable to eliminate the need for additional power supplies when using USB to SATA adapters connected to USB ports on the Falcon-NEO. Connect up to 3 USB to SATA adapters

F-CBL-USBSAT-KT
USB Power Cable (F-CBL-USB-PWR) plus 3 USB2SATA adapters

F-USB-3.0-U

USB 3.0-U 4-port Hub

F-ADP-Z-2.5-IDE

2.5/3.5″ IDE to SATA adapter to image 2.5″ or 3.5″ IDE type drives

F-ADP-ZIF-1.8PK

Combo pack. Includes quantity 1 F-ADP-ZIF-2 and quantity 1 F-ADP-Z-1.8-IDE adapter used together to image 1.8″ IDE ZIF drives

F-ADP-FLASH-RDR

Used for imaging various flash media, including compact flash, SD cards.

F-ADP-Z-MSATA

mSATA to SATA adapter to image mSATA drives

F-CABLE-MCRSATA

microSATA to SATA adapter to image microSATA drives

F-CABLE-ESATA

eSATA to SATA converter cable for eSATA hard drives

F-CBL-SATA18-FL

18” extended SATA cable set

F-ADP-PCI-FN-KT

Adapter kit for M.2 PCIe SSDs, PCIe and mini-PCIe cards. Includes 1 each; , M.2 to PCIe adapter, miniPCIe to PCIe adapter, M.2. to SATA adapter, PCIe to PCIe extender cable. For use with the Forensic Falcon-NEO

F-HRDCASE-FNEO
Falcon-NEO hardcase only (with foam, interior bag,