Forensic Falcon Neo

A future-focused, next-generation digital forensic imager. Unmatched performance designed to streamlineevidence collection processes.

The next-generation of our ground-breaking Falcon® forensic imager, the Falcon NEO® has been engineered specifically for digital forensic investigations.  Delivering high performance and advanced features, the Falcon-NEO is designed to meet the challenges of digital investigations head-on. Efficient and secure digital evidence collection is accomplished with a feature-set that provides sophisticated functionality with a goal to shorten acquisition time. Future-focused, the Falcon-NEO sets new standards in digital forensic imaging technology.


  • The Falcon®-NEO is an extremely fast forensic imaging solution. It achieves imaging speeds surpassing 50GB/min and can clone PCIe to PCIe at speeds of 69GB/min.
  • Image and verify to multiple image formats; native copy, .dd image, .dmg image, e01 and The Falcon-NEO provides MD5, SHA1, SHA256, and dual hash (MD5+SHA1) authentication at extremely fast speeds.
  • Falcon-NEO formats destination drives to NTFS, exFAT, EXT4, or FAT32 file The unit supports imaging from source drives formatted to any major file system.
  • Four Write-blocked source ports include 2 SAS/ SATA, 1 USB 0, 1 PCIe. Six Destination ports include 2 SAS/SATA, 2 SATA, 1 USB 3.0 and 1 PCIe. All destination ports are built-in to the unit, no additional module or bay attachments required.
  • Two 10GbE network ports provide state-of-the-art connectivity for fast network imaging performance.
  • I/O card ports. Designed for the future, the Falcon-NEO includes 2 source I/O card ports and 1 destination I/O port to support new interface technologies as they arrive on the Thunderbolt/USB 3.1 Gen 2/USB-C I/O card will be available in Q4 2018.
  • Networking Use the Falcon-NEO to image to a network location using CIFS protocol and/or image from a network location using iSCSI. Users can use iSCSI as a source or destination drive. Image to an external storage device such as a NAS, using the Gigabit Ethernet, USB 3.0 or SAS/SATA connection.
  • Network Capture. Capture network traffic, internet activity and Sniff data on a network and store captured packets on a hard drive connected to Falcon-NEO.
  • Multi-Task. Image simultaneously from multiple sources to multiple destinations including a network repository. Supports imaging to one location while simultaneously hashing and/or wiping a second Users can perform up to 5 tasks concurrently. Little or no speed degradation when imaging from two sources to two destinations.
  • Parallel Perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. Clone to a network location or a destination drive using mirror copy mode while simultaneously imaging in e01 or .dd format to a different destination drive.
  • Targeted Imaging/Logical Imaging feature shortens acquisition time. Create a logical image by using pre-set filters, custom filters, file signature filters, and/or keyword search function to select and acquire only the specific files you need. An MFT report can be generated that contains a potential deleted file list. Format output to LX01, ZIP or directory tree. Users can browse and view directly on the Falcon-NEO display, or manage and view on a networked Falcon-NEO from your laptop/desktop using a web browser.
  • Partition Select and image specific partitions on the source drive.
  • Write-Blocked Drive Preview drive contents directly on the Falcon®-NEO. The file browser feature provides logical access to source or destination drives connected to Falcon-NEO. Users can view the drive’s partitions and contents and view text files, jpeg, PDF, XML, HTML files. Other methods to preview include using the file browser feature and Falcon-NEO’s web browser on a PC/laptop or preview over a network via SMB or iSCSI (as an iSCSI target). 3rd party analysis tools can be used with SMB or iSCSI methods.
Forensic Falcon Neo