How To Image To A Network Repository With Logicube’s Forensic Falcon-NEO

Welcome to Logicube’s tutorial on the Falcon-NEO forensic imager. The Falcon-NEO allows you to image directly to or from a network repository using SMB or CIFS protocol, or using iSCSI. Two 10GbE ports provide extremely fast network imaging performance. In this episode we’ll show you how to image from a physical drive connected to the Falcon-NEO, to a network repository, using CIFS protocol. Make sure you have full permissions to the shared resource before attempting to create a network repository on the Falcon-NEO. We strongly suggest that you contact your network administrator to ensure proper permissions have been set up.

We have set up a directory on a computer that is connected to the same network as the Falcon-NEO. By right clicking on the directory and checking the share properties, we can verify that we have full permissions to this share. We’ll now create and mount the repository on the Falcon-NEO.

From the left-side menu, tap on the ‘Manage Repositories’ icon. On the ‘Add/Remove’ tab, you’ll see a list of available repositories, including all drives attached to the Falcon-NEO destination ports, and any network repository. Tap the ‘Add Repository’ button at the bottom of the screen, then tap ‘Name’ to set the name of the repository. Then tap ‘Drive’ to select a network share to set as a repository.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Then tap ‘Network Source’ to select the network source – either LAN1, LAN2, or ‘Any’ – then tap ‘Network Destination’ to enter the network settings. Enter the path of the share; this includes the IP address and share name. Use the forward slash, not the backward slash, when entering the path. Enter the domain of the share, if the shared resource is in a domain; otherwise, use the work group name. Then enter the username that has full permissions, both read and write access, to the share. Then enter the password for the username.

Next tap ‘Role’, and the repository can be set as a source, destination, or both. Once the repository has been set up, it will appear under the repository list. If you would like the repository you have set up to remain configured when the Falcon-NEO is turned off, the changes must be saved and loaded to a profile on the Falcon-NEO. Refer to the users’ manual for instructions on how to do this.

Once a repository has been added, you can use it as a source or destination for any imaging task. For this task, we’ll select the ‘Drive to File’ mode, then we’ll select the source – in this case, we’ll select a hard drive connected to the Falcon-NEO.

Next, choose your settings. Here you can enter a case name and other case identification information such as evidence ID. Then set the imaging method. Here we’ll choose E01, and leave the default setting of 4GB for the segment size and with compression on. You can then choose whether to image HPA and DCO areas of the drive and set the error granularity. Finally, choose the hash method and whether you wish to verify or not.

Then select your destination: in this case, the network repository we just set up. Once all your settings have been chosen, press ‘Start’ and the imaging task will begin.

Upon completion of the imaging task, you can review the log file associated with the task by navigating to the ‘Logs’ icon from the left-side menu bar. The log file includes all of the chosen settings and the file information from the network repository that was captured for this task.

Thank you for your interest in the Falcon-NEO. We hope you found this tutorial informative. To learn more about the Falcon-NEO, visit our website at logicube.com, or contact our sales team at sales@logicube.com.

Leave a Comment

Latest Videos

Digital Forensics News Round-Up, May 01 2024 #dfir #computerforensics

Forensic Focus 1st May 2024 5:30 pm

Marco Fontani joins the Forensic Focus podcast to discuss Amped Software’s latest AI-powered tool, DeepPlate. DeepPlate is a deep learning system designed to read license plates affected by common issues introduced by surveillance systems, making it a valuable asset for forensic video analysts.

Marco provides an in-depth overview of DeepPlate, explaining how it currently supports eight countries (France, Germany, Italy, the Netherlands, Spain, Sweden, the UK, and the United States) and how it uses separate models for each country to account for varying license plate formats. He also discusses the synthetic data generation process used for training the models, ensuring privacy and mitigating bias.

The conversation delves into the limitations and considerations when using AI-based tools in a forensic workflow, with Marco emphasizing the importance of bias mitigation techniques and proper interpretation of confidence scores. He stresses that DeepPlate is an investigative tool designed to provide a second opinion, rather than a tool for court admissibility.

00:00 – What is DeepPlate and what is its purpose?
02:45 – How many countries does DeepPlate currently support?
09:30 – What are the challenges of diplomatic and personalised number plates?
11:30 – How would a forensic video analyst use DeepPlate as part of their workflow?
13:40 – Can DeepPlate be used in Court?
16:30 – What is Amped Software’s position on AI?
19:00 – What will be the impact of updated models on results?
20:50 – What kind of data is used to train the system?
23:30 – How has the system been tested?
26:15 – What are the access conditions for using DeepPlate?
28:05 – Does Amped Software retain user data for DeepPlate and if yes for how long? 
29:45 – Is it possible to buy additional seats for your license?
31:00 – What are the limitations and considerations when using AI-based tools like
DeepPlate for forensic and investigative purposes?
35:20 – Does Amped Software plan to use AI in other areas?

Show Notes 

Washington State Judge Blocks Use Of AI-Enhanced Video As Evidence In Possible First-Of-Its-Kind-Ruling - https://www.linkedin.com/feed/update/urn:li:activity:7181308834370494464/

Neural Network for Denoising and Reading Degraded License Plates - https://link.springer.com/chapter/10.1007/978-3-030-68780-9_39

Introducing DeepPlate, Amped’s Investigative Tool for AI-Powered License Plate Reading - https://blog.ampedsoftware.com/2024/02/28/introducing-deepplate-ampeds-investigative-tool-for-ai-powered-license-plate-reading

Marco Fontani joins the Forensic Focus podcast to discuss Amped Software’s latest AI-powered tool, DeepPlate. DeepPlate is a deep learning system designed to read license plates affected by common issues introduced by surveillance systems, making it a valuable asset for forensic video analysts.

Marco provides an in-depth overview of DeepPlate, explaining how it currently supports eight countries (France, Germany, Italy, the Netherlands, Spain, Sweden, the UK, and the United States) and how it uses separate models for each country to account for varying license plate formats. He also discusses the synthetic data generation process used for training the models, ensuring privacy and mitigating bias.

The conversation delves into the limitations and considerations when using AI-based tools in a forensic workflow, with Marco emphasizing the importance of bias mitigation techniques and proper interpretation of confidence scores. He stresses that DeepPlate is an investigative tool designed to provide a second opinion, rather than a tool for court admissibility.

00:00 – What is DeepPlate and what is its purpose?
02:45 – How many countries does DeepPlate currently support?
09:30 – What are the challenges of diplomatic and personalised number plates?
11:30 – How would a forensic video analyst use DeepPlate as part of their workflow?
13:40 – Can DeepPlate be used in Court?
16:30 – What is Amped Software’s position on AI?
19:00 – What will be the impact of updated models on results?
20:50 – What kind of data is used to train the system?
23:30 – How has the system been tested?
26:15 – What are the access conditions for using DeepPlate?
28:05 – Does Amped Software retain user data for DeepPlate and if yes for how long?
29:45 – Is it possible to buy additional seats for your license?
31:00 – What are the limitations and considerations when using AI-based tools like
DeepPlate for forensic and investigative purposes?
35:20 – Does Amped Software plan to use AI in other areas?

Show Notes

Washington State Judge Blocks Use Of AI-Enhanced Video As Evidence In Possible First-Of-Its-Kind-Ruling - https://www.linkedin.com/feed/update/urn:li:activity:7181308834370494464/

Neural Network for Denoising and Reading Degraded License Plates - https://link.springer.com/chapter/10.1007/978-3-030-68780-9_39

Introducing DeepPlate, Amped’s Investigative Tool for AI-Powered License Plate Reading - https://blog.ampedsoftware.com/2024/02/28/introducing-deepplate-ampeds-investigative-tool-for-ai-powered-license-plate-reading

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_OVTrTRCC5ZQ

AI-Powered License Plate Reading With Amped DeepPlate

Forensic Focus 30th April 2024 9:58 am

Forensic Focus Digest, April 26 2024 #digitalforensics #dfir

Forensic Focus 26th April 2024 3:35 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles