Welcome to Logicube’s tutorial on the Forensic Falcon NEO. In this session, we’ll show you how to use the file browser feature.
The file browser feature of the Falcon NEO provides logical access to source and destination drives connected to the Falcon NEO. To open the file browser, click on the left-hand menu and click on the File Browser icon. The browser can be used directly on the Falcon NEO’s display, which can be useful when you’re out in the field and there are no computers available; or the browser can be used from the web interface, as we’ve done here.
The file browser can open several types of image files, including jpeg, png, gif, and can also open text, HTML and PDF type files. Using the web interface on a PC also gives you the ability to download files to that same PC and then preview any files that cannot be previewed on Falcon NEO.
To select the drive to browse, tap at the top of the screen; you’ll see these tabs that show all of the drives connected to the Falcon NEO. Both source and destination drives, if the destination drive was formatted by Falcon NEO, will be displayed. Drives connected to the source position are write-protected, and opening a file using the Falcon NEO’s display interface, or when using a web browser on a PC, or when using a computer, will not alter the forensic integrity of the source drive connected to Falcon NEO.
The file browser will show all of the partitions that can be read. We’re going to go ahead and select partition two. And using the scrollbar on the right-hand side you can scroll through all of the folders that are available here. We’re going to click on Demo; you can see we have Documents, Photos, Videos; I’ll click on Photos and again you can use the scrollbar on the right to scroll through all of the photos that are available here. We’ll go ahead and click on a couple of these, and you can see the photo pops up here; we’ll click on a second one, and again the photo will show up here.
If we scroll back up to Documents, you can see that there’s a PDF file here; we’ll click on that, and again we can see that pops up, you can scroll through it.
If there is a particular file that is not viewable on the Falcon NEO, for example this .doc or document file, when you click on it you’re going to see an error message that says “File viewer cannot view file type”. If you are using the web browser on a PC, if you right-click that file and then click on ‘Save link as…’, you can save that file to the desktop of your computer so that you can view it at a later point.
The file browser feature helps streamline the evidence collection process. When faced with large volumes of suspect drives, the ability to preview and triage drive contents can be extremely beneficial. Investigators can prioritise drives based on content, for imaging now or at a later time.
We hope you found this tutorial of interest. To learn more about the Falcon NEO please visit our website at logicube.com, or contact our sales team at [email protected].