Forensic Falcon

Without exception, the fastest and most technologically advanced forensic imaging solution available. Feature-packed, power-rich performance in a space-saving footprint that provides expandability to meet future technology advances. This unparalleled solution is designed for demanding forensic imaging tasks and sets a new standard of excellence in digital forensic data imaging solutions.

The Falcon is the fastest forensic imaging solution available, with imaging speeds of 20GB/min*. Meets future hard drive speed improvements with SAS/SATA-3 6GB/s maximum rated speed of 37GB/min.


  • Image and verify to multiple image formats; native copy, dd image, e01, ex01 and file-based copy. E01 features user-selectable compression levels. Uses SHA1, SHA256 or MD5 authentication.
  • Supports EXT4 or NTFS destination file format.
  • Multiple imaging ports. Write-protected source ports include 2 SAS/SATA, 1 USB 3.0, 1 Firewire, destination ports include 2 SAS/SATA, 2 USB 3.0 and 1 Firewire. Gigabit Ethernet port for network connectivity. USB source and destination can be converted to SATA using a USB to SATA adapter.
  • An optional PCI express card interface (for new/future technologies such as Thunderbolt) is planned for future availability.
  • Multi-task. Improve efficiency and shorten evidence collection process with the ability to wipe one destination drive while imaging to another, or image from multiple source drives to multiple destinations. Perform up to five tasks concurrently.
  • Web-based user interface allows users to connect to the device from a web browser and manage all operations remotely. The interface features automatic page scaling for iPad type devices.
  • Parallel Imaging. Simultaneously perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. For example, clone to a network location or a destination drive while imaging to a different destination drive using different imaging formats (e.g. native copy and e01).
  • The Network Push feature gives users the ability to push evidence files from destination drives connected to the Falcon or from a Falcon repository to a network location. The Push feature provides a more secure method than simply copying and pasting to the analysis computer by performing an MD5 or SHA hash during the push process. Additionally users can select to verify the file transfer to insure data integrity. Network users can then quickly preview data or copy data to a local drive or to any other directory on the network. The Falcon generates log file for each push process.
  • Concurrent Image+Verify (patent-pending). Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.
  • Built-in support for SAS/SATA/USB/FW storage devices, support for 1.8”/2.5”/3.5” IDE and 1.8” ZIF and microSATA drive interfaces using adapters included with Falcon. Optional adapters are available for eSATA, mSATA and compact flash drives.
  • Image to or from a network location. Use the Falcon to image to a network location using CIFS protocol and/or image from a network location using iSCSI. CIFS protocol provides file system access and the highest level of security and control. Users can use iSCSI as a source or destination drive.
  • The device can perform a forensic, filter-based file copy. Filter and image specific file types (PDFs, word docs, JPEGs, .mov files, etc).
  • Secure sensitive evidence data with whole drive AES 256 bit Encryption. Decryption can be performed using the Falcon or by using open source software programs such as FreeOTFE.
  • Multi-pass wipe (DoD specifications) or use secure erase to wipe drives.
  • Image to an external storage device (such as a NAS) using the Gigabit Ethernet, USB 3.0 or SAS/SATA connection.
  • Supports Drive Spanning; image from one large capacity hard drive to two or more smaller capacity drives.
  • Write-protected source ports. Use the Falcon as an external write-blocker (via the USB 3.0 device port) for secure drive preview/image transfer.
  • Optional destination drive bay module provides easy slide-in design and includes a locking door for added security. This option is planned for a future release.
  • Tasks Macro feature. Allows users to set specific tasks to be performed sequentially. For example:
    1. Wipe the destination drive
    2. Hash the source
    3. Image the source drive using e01 format
  • Network capture. Capture network frames to a PCAP file format. Decode using off the shelf tools, e.g. WireShark. Planned for a future release.
  • Set password-protected user profiles and save configurations. A convenient administrative function provides the ability to create profiles with default settings.
  • Features an internal, removable storage drive that stores O/S and audit trail/logs. The drive is easily removed for secure/classified locations.
  • Additional features Additional features include HPA/DCO capture, audit trail/logs, large 7” color touch screen display, on-screen keyboard, two USB 2.0 host ports for keyboard, mouse or printer connectivity, and an HDMI port to connect a projector.


Falcon Overview