Logicube Falcon-NEO Application Note

Page 1 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com Falcon®-NEO System Restore 1.0 INTRODUCTION ........................................................................................................................ 1 2.0 WARNING: LOG FILES WILL BE DELETED .......................................................................... 2 2.1 REQUIREMENTS FOR BACKING UP THE LOG FILES – FALCON-NEO DOES NOT BOOT ........................................ 2 2.2 BACKING UP THE LOG FILES – FALCON-NEO DOES NOT BOOT ........................................................................ 2 3.0 USING A BOOTABLE USB FLASH DRIVE WITH THE SYSTEM RESTORE ......................... 3 4.1 REQUIREMENTS .............................................................................................................................................. 3 4.2 CREATING THE RECOVERY USB FLASH DRIVE .................................................................................................. 4 4.3 USING THE RECOVERY FLASH DRIVE ................................................................................................................ 7 4.0 USING THE BUILT-IN SYSTEM RESTORE ........................................................................... 9 3.1 BUILT-IN SYSTEM RESTORE (STEP-BY-STEP) ................................................................................................... 9 5.0 FIRMWARE UPDATE ........................................................................................................... 12 1.0 Introduction This document provides instructions on how to perform a system restore on the Forensic Falcon-NEO. There are two ways to restore the Falcon-NEO: • Using a bootable USB flash drive with the system restore • Using the built-in system restore

Page 2 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 2.0 WARNING: Log files will be deleted Performing the system restore will delete all of the log files. If desired, the log files can be backed up before the recovery process. If the Falcon-NEO boots up properly, the audit log files can be backed up easily. See Section 3.7.1 (Viewing or exporting logs) or Section 3.7.4 (Accessing logs over a network) in the user’s manual on how to back up the log files if the Falcon-NEO boots up properly. If the Falcon-NEO does not boot up properly, there is a possibility the log files may be backed up by following the steps in this section. 2.1 Requirements for backing up the log files – Falcon-NEO does not boot • The Falcon-NEO connected to a network • A computer with a Secure FTP (SFTP) client (E.g. FileZilla or WinSCP) connected to the same network 2.2 Backing up the log files – Falcon-NEO does not boot The outlined steps in this section use an open-source SFTP client called FileZilla. Other SFTP clients can be used. 1. Make sure the Logicube device is connected to a network accessible by the computer with the SFTP client and if there is an error message, leave the error message on the screen. 2. Open FileZilla. Similar to the screenshot below, enter the following information then click the Quickconnect button: • Host: The IP address or hostname of the Logicube device. • Username: logicube • Password: logicube • Port: 22 3. A window may appear labeled Unknown host key. If this window appears, click the OK button.

Page 3 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 4. On the right window pane, change the ‘Remote site’ to /var/log/ong_audit then press the Enter key. 5. On the left window pane, change the ‘Local site’ to where you want to download the files. In the example below, it will be downloaded to C:\Downloads. 6. On the right side (Remote site), the /var/log/ong_audit directory has all of the log files. Highlight all the files and folders. There are two ways to download the files: a. Right-click the mouse button and select Download, or b. While holding down the left mouse button, drag and drop the Evm* files to the left window pane. 7. The log files should now be backed up to your computer. 3.0 Using a bootable USB flash drive with the system restore For each software release of the Falcon-NEO, a new system restore is available. 4.1 Requirements • Your own 8 GB or larger capacity USB flash drive • A computer with a Windows Operating System • A wired USB keyboard

Page 4 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 4.2 Creating the recovery USB flash drive Here are the steps to prepare the flash drive with the software necessary to be bootable: It is recommended to use Chrome or Firefox to download the files. Internet Explorer and Edge do not download *.img files properly. 1. Go to http://updates.logicube.com/falcon-neo-recovery. Look for the following two files: • The Falcon-NEO image file (a file with a *.img extension) • win32diskimager-v1.0.0-binary.zip – An open source tool used for writing images to USB flash drives or SD/CF cards Balena Etcher may be used instead of Win32DiskImager. The instructions in this section are for Win32DiskImager. 2. Download both files. If the image file will not download, right-click on the link and use the ‘Save Target As…’ or ‘Save Link As’ option and make sure it is saved with the *.img file extension. 3. Extract all the files in the win32diskimager-v1.0.0-binary.zip file to a folder or directory of your choosing. 4. Connect a USB flash drive that is at least 8 GB in capacity to the computer where the software was downloaded. It is recommended that all other USB drives are unplugged. The contents of the USB flash drive will be overwritten. If there is data on the USB flash drive that should not be deleted, back up the contents of the USB flash drive or use another USB flash drive for this procedure. 5. In the win32diskimager-v1.0.0-binary folder where the software was extracted, run the file Win32DiskImager.exe. The Win32 Disk Imager window will appear.

Page 5 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 6. Click the folder icon to select a disk image. 7. In the folder where the files were downloaded (in step 2), select the recovery file and click the Open icon. Note the screenshot below shows a different file name. 8. The Image file should now be seen in the Win32 Disk Imager screen under ‘Image File’.

Page 6 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 9. Under ‘Device’, select the drive letter for the USB flash drive that was connected during step 3 then click the Write icon. 10. A confirmation screen will appear. Make sure that the “Target Device” is set to the correct drive letter. If it is the correct drive letter, click Yes to continue. If it is showing the wrong drive letter, click No. This will take you back to the previous screen where you can select the correct drive letter (back to step 9). 11. The USB flash drive is now being prepared and the progress bar should be advancing. 12. When it is finished, a prompt should appear stating the write was successful. Click the OK icon to continue. Close the Win32 Disk Imager window. The USB flash drive is now ready to be used. 13. Disconnect the USB flash drive from the computer.

Page 7 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 4.3 Using the recovery flash drive 1. Turn the Falcon-NEO OFF and disconnect all drives (and any drive adapters) connected to all source and destination ports. 2. Insert the recovery USB flash drive to one of the front USB ports. 3. Connect a USB keyboard to the other front USB port. 4. Turn the Falcon-NEO on. The Falcon-NEO will display a logo, then beep. 5. Immediately after the beep, press and release the F7 key. A boot menu should appear. 6. Using the arrow keys on the keyboard, select the USB flash drive with UEFI in the front of the name of the USB flash drive. Do not select “UEFI OS:” if it is available. 7. The System Restore will load. When the System Recovery fully loads, the following screen will appear. Tap Restore.

Page 8 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 8. A confirmation screen will appear. Tap Yes to continue with the System Restore. 9. The system restore will begin. The entire process may take up to 10 (ten) minutes to complete. 10. When finished, the following screen will appear. Tap OK. 11. The main System Restore screen will apper. Tap Power Off.

Page 9 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 12. A confirmation screen will appear. Tap Yes. 13. The Falcon-NEO should gracefully shut down and will turn itself off. The System Restore process should now be complete. Disconnect the USB keyboard and turn the Falcon-NEO on to make sure it boots properly. 14. The latest software should now installed. Follow Section 5.0 to check for a firmware update. 4.0 Using the built-in system restore Use this method only if you have previously performed the System Restore version 3.2u3. If you are not sure whether you have previously performed the System Restore version 3.2u3, please use the method in Section 4.0. The Falcon-NEO has a built-in system restore. This method requires a USB keyboard. 3.1 Built-in system restore (step-by-step) 1. Disconnect all drives and adapters connected to the Source or Destination ports. 2. Connect a USB keyboard to one of the two front USB ports. 3. Turn the Falcon-NEO on. The Falcon-NEO will display a logo, then beep, then on the top-left of the screen a 3, 2, 1 countdown will appear 4. When the 3, 2, 1 countdown appears, press and release the Esc key on the keyboard. A grub bootloader menu will appear. 5. Use the arrow keys on the keyboard and highlight System Recovery then press the Enter key.

Page 10 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 6. After the System Recovery loads, the following screen should appear. Tap Restore to continue. If you see text that shows Continue with system restore operation? (y/n) instead of the GUI as seen above, stop and follow the instructions in Section 4.0 to use a bootable USB flash drive. 7. A confirmation screen will appear. Tap Yes to continue with the System Restore. 8. The system restore will begin. The entire process may take up to 10 (ten) minutes to complete.

Page 11 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 9. When finished, the following screen will appear. Tap OK. 10. The main System Restore screen will appear. Tap Power Off. 11. A confirmation screen will appear. Tap Yes. 12. The Falcon-NEO should gracefully shut down and will turn itself off. The System Restore process should now be complete. Disconnect the USB keyboard and turn the Falcon-NEO on to make sure it boots properly. 13. The latest software should now installed. Follow Section 5.0 to check for a firmware update.

Page 12 of 12 Revised date: December 2020 Logicube, Inc. • 19755 Nordhoff Pl.,Chatsworth, CA 91311 USA• tel:+1-818-700-8488• fax:+1-818-435-0088 www.logicube.com 5.0 Firmware Update Falcon-NEO software releases may contain a firmware update. This section provides instructions on how to check if a firmware update is available, and how to perform the firmware update. 1. After the System Restore (and after restarting the Falcon-NEO), from the main menu, locate and tap Software Updates on the left side. 2. Tap the Firmware Update tab. One of two screens will appear: a. FIRMWARE UPGRADE AVAILABLE – Tap the Update icon. A message will appear: “FIRMWARE UPDATE COULD TAKE UP TO A FEW MINUTES TO COMPLETE; PLEASE DO NOT INTERRUPT POWER DURING THIS TIME. ON COMPLETION THE UNIT WILL AUTO-RESTART AND CONFIRM THE UPDATE.” Tap the OK icon to start the firmware update process. When the OK icon is tapped, the screen may appear to do nothing. Do not keep tapping the OK icon. The firmware update will take no more than 60 seconds. b. FIRMWARE UPGRADE NOT AVAILABLE – This message will appear if the device does not require a firmware update. No further action is necessary if this message appears.