How To: Create A Logical Image On Falcon NEO

Welcome to Logicube’s tutorial on the Forensic Falcon NEO. In this episode, we’ll show you how to perform a logical image.

The logical imaging feature of Falcon NEO shortens the evidence collection process by allowing investigators to select and acquire only the specific files they need, rather than the entire physical drive. Users can create logical images from source drives locally attached to the Falcon NEO, or from a network repository.

To perform a logical image, we’ll choose the Mode icon and select ‘File to File’. Choose the source drive – we’ll choose S1 – and then choose the Settings icon. Under the Settings icon you can add case information by clicking on the Case Info icon. So you can add a case filename, case ID, examiner, case notes, whatever you like.

Read More


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles