FORENSIC FALCON – AN EXPERT’S REVIEW

Dear Readers,

The first technical phase of a digital forensics investigation consists in acquiring evidence.

The acquisition process for a computer that is powered off aims at creating an exact copy of the storage devices and peripherals. It must include all information required to enable the reconstruction of the structure and data of the given media device. As already detailed in previous eForensics Magazine articles, a low level bit-by-bit copy of the original physical device is deemed as the best method for achieving an (almost) perfect copy.

This article aims at providing some feedback on a recent test performed with the Forensic Falcon™ – from Logicube – while harvesting data spread over with multiple types of peripherals in a test bed environment. It follows the formal process of a first time responder or digital forensic investigator from opening the product’s box, to analyzing the results it provides. The final part delivers some feedback and additional thoughts. All steps and actions that can be performed are not mentioned to cast more light on items of interest.

We’d like to present you an expert’s review of Forensic Falcon™ 

To read the whole review download the file below.