Forensic Talon® Ultimate
The Talon® Ultimate delivers advanced, high-performance forensic imaging at unbeatable imaging speeds of over 40GB/min*. Designed for field or forensic lab use, this forensic imager features a compact footprint, user-friendly navigation, and a budget-friendly price. The Talon Ultimate continues the proud legacy of previous generations of the Talon® forensic imaging solutions. Engineered specifically for digital forensic investigators, the Talon Ultimate meets all of your forensic imaging, hashing and wiping requirements.
Fast forensic imaging at speeds over 40GB/min*.
Image & verify from 1 source drive to 3 destinations.
Supports imaging from PCIe SSDs (M.2 NVMe, AHCI, SATA type) and PCIe and mini-PCIe cards.
Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using Falcon-NEO or Veracrypt, decrypt using the Talon Ultimate or open source software such as VeraCrypt.
Optional Multi-Task feature provides multi-source to multi-target imaging for simultaneous imaging of up to 5 source drives.
Optional targeted/logical imaging feature allows you to create a logical image and capture only specific files needed.
Remote operation with a web-based browser interface.
Broad interface support includes SATA, USB3, FireWire® and IDE. Optional support for SAS available.
Features
EXTREMELY FAST IMAGING The Talon® Ultimate provides extremely fast forensic imaging at over 40GB/min*.
PCIE SUPPORT Support for imaging from M.2 PCIe (SATA, AHCI and NVMe types), PCIe and mini-PCIe express cards is available using the Talon Ultimate’s PCIe port and optional adapters.
MULTIPLE IMAGE FORMATS The Talon Ultimate images and verifies to the following formats: native or mirror copy, dd image, dmg image, e01, ex01 (e01 and ex01 with compression).
CONCURRENT IMAGE+VERIFY Imaging and verifying concurrently takes advantage of destination hard drives that may be faster than the source hard drive. Duration of total image process time may be reduced by up to half.
AUTHENTICATION The Talon Ultimate supports SHA1, SHA256 dual hash (MD5+SHA1) authentication.
PARALLEL IMAGING Perform multiple imaging tasks from the same source drive to multiple destinations using different imaging formats. Clone to a network location or a destination drive using mirror copy mode while simultaneously imaging in e01 or .dd format to a different destination drive. Requires the purchase of the Multi-Task option.
WRITE-PROTECTED SOURCE PORTS
1 SATA (SAS optional)
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
1 PCIe
1 FireWire®
1 additional SATA (SAS optional) source port can be activated with the purchase of the Multi-Task option
DESTINATION PORTS
2 SATA (SAS-optional)
1 USB 3.0 (can be converted to SATA using an optional USB to SATA adapter)
1 FireWire
SAS support is enabled via software option, no additional modules required.
OPTIONAL TARGETED/LOGICAL IMAGING feature allows you to create a logical image using pre-set, custom filters, file signature filters and/or keyword search to capture only the specific files needed. An MFT report can be generated that contains a potential deleted file list. Format output to L01, LX01, ZIP or directory tree. Users can browse and view directly on the Talon Ultimate display, or use a web browser on a PC that is connected to the same network as the Talon Ultimate. Requires the purchase of the Targeted Imaging option.
FORMAT The Talon Ultimate formats destination drives to NTFS, EXT4, FAT32 or exFAT file systems. The unit supports imaging from source drives formatted to any major file system.
USER PROFILES/CONFIGURATIONS Administrators can save configuration settings and set password-protected user profiles.
USB PORTS A Gigabit Ethernet port for network connectivity is built-in. The unit includes a USB 3.0 device port for drive preview and two USB 2.0 host ports for keyboard, mouse and printer connectivity.
AUDIT TRAIL REPORTING/LOG FILES Provides detailed information on each operation. Log files can be viewed on Talon Ultimate or via a web browser, exported to XML, HTML or PDF format to a USB enclosure. Users can print the log files directly from their PC when connected to the Talon Ultimate via a web browser
MULTI-TASK OPTION This option adds 1 additional SATA source port (SAS Optional) and allows you to image from multiple source drives to multiple destinations simultaneously. This option also provides support to image one drive while hashing and/or wiping a second drive simultaneously. Users can perform up to 5 tasks concurrently.
ENCRYPTION Secure sensitive evidence data with whole disk, open standard, drive encryption using the NIST recommended XTS-AES-256 cipher mode, decrypt using Falcon-NEO or Veracrypt decryption can be performed using the Talon Ultimate or by using a free open source decryption software such as VeraCrypt,TrueCrypt or FreeOTFE (On The Fly Encryption)
NETWORKING This feature provides the ability to image to or from a network location. Use the Talon Ultimate to image to a network repository using CIFS protocol and/or image from a network repository using iSCSI. Users can use iSCSI as a source or destination drive. Also features a network “Push” function to push evidence files from destination drives connected to Talon Ultimate to a network repository.
IMAGE FROM A DESKTOP OR LAPTOP PC This feature allows you to image without removing the hard drive from the PC or laptop. Create a forensic bootable USB flash drive that allows the user to image a source drive from a computer on the same network without booting the computer’s native operating system. Requires our USB boot client software (available in our Knowledge Base on our website). Supports imaging from Surface Pro 4 laptops.
IMAGE FROM A MAC® COMPUTER Image from a Mac computer booted in Target Disk Mode using the write-blocked FireWire port on Talon Ultimate.The Mac computer’s internal drive is seen as a “source” drive. Mac computers with either FireWire or Thunderbolt™ ports can be connected to the Talon Ultimate, a Thunderbolt to FireWire adapter is required. Supports MacBook Pro®, and Mac computers with USB-C ports. Mac Computers that use the T2 Security Chip can be imaged using Logical Imaging (File to File Mode) or using the Mac computer’s Disk Utility please refer to the application note, Mac drives with the Talon Ultimate.
ATA SECURITY Unlock and clone ATA Security locked drives. Temporarily unlock drives and then clone, hash or wipe. Requires ATA Security password to unlock.
DRIVE TRIM Allows the Talon Ultimate to manipulate the DCO and HPA area of the destination drive so that the destination drive’s total native capacity matches the source drive.
CD/DVD BLU-RAY The Talon Ultimate can image CD/DVD/Blu-Ray media by using a USB optical drive connected to the USB port on the Talon Ultimate. Supports multi-session CD/DVDs.
DRIVE “TIME-OUT” FEATUREUsers can set a specific “time-out” for hard drives connected to Talon Ultimate. After a specified amount of idle time the drive will be automatically put into standby mode, powering down the drives.
NETWORK SERVICES Users can disable various network services such as HTTP, SSH, Telnet,bCIFS/NETBIOS, iSCSI Iperf and Ping, for security purposes.
DRIVE SPANNING Capture from one large capacity drive to two smaller capacity drives.
WEB BROWSER/REMOTE OPERATION An easy to use interface allows you to connect to the Talon Ultimate from a web browser and manage all operations remotely. The browser features automatic page scaling for iPad type devices.
BROAD INTERFACE SUPPORT Built-in support for SATA/USB3/FireWire storage devices. SAS devices are supported with the purchase of software options. 2.5″/3.5″ IDE drives are supported with an adapter included with Talon Ultimate. Support for 1.8″ IDE and 1.8″ IDE ZIF, M.2 PCIe (SATA & AHCI types), microSATA, eSATA, mSATA and flash drives is available with optional adapters.
HDMI PORT An HDMI port is located on the back of the Talon Ultimate. This port can be used to connect the Talon Ultimate to a projector.
REMOVABLE STORAGE DRIVE OS and audit trail/logs are stored on an internal drive. This drive is easily removed for secure/classified locations.
7″ TOUCH SCREEN Uses a capacitive touch screen with an easy-to-use interface that provides easy navigation through all operations. An on-screen keyboard is also included.
WIPE - Wipe up to DoD specifications or use Secure Erase to erase drives, wipe at speeds up to 27GB/min.
HPA AND DCO CAPTURE Detect and capture Host Protected Areas (HPA) and Device Configuration Overlay (DCO) hidden areas on the source (suspect) drive.
ERROR GRANULARITY SETTING Drive error handling is enhanced with a configurable error granularity feature. When a bad sector on the source drive is found Talon Ultimate will, by default skip that sector. Changing the granularity allows more sectors to be skipped. There are 3 options (512 Bytes, 4096 Bytes, 64 KIB). As an example, if 4096 Bytes is chosen, and one of the 8 sectors in that cluster size contains a bad sector, the Talon Ultimate will skip the entire cluster (4096 bytes or 8 sectors).
COMPACT SIZE The Talon Ultimate is light weight, at 2.0lbs (1.0kg) and features a small footprint of 7.6″W X 2.6″H X 5.5″D (19.0cm X 6.6cm X 13.9cm).
ONE-YEAR STANDARD WARRANTY The system comes complete with a one year parts and labor warranty. Both an optional 1 year extended warranty (total of 2 years) and a 2 year extended warranty (total of 3 years) are available.
WRITE-BLOCKED DRIVE PREVIEW/TRIAGE Preview drives connected to Talon Ultimate on a PC with the USB 3.0 device port. Users can also copy files from drives to their PC with this feature. The Talon Ultimate can be used as a write-blocker.
FILE BROWSER Write-blocked preview of drive contents directly on the Talon Ultimate is available using the file browser feature. This provides logical access to source or destination drives connected to Talon Ultimate. Users can view the drive’s partitions and contents, and view text files, PDF, XML, HTML files.
IN THE BOX
The Talon Ultimate includes the following:
The Talon Ultimate ships in a cardboard carrying case that includes a custom protective foam insert ready to drop into a standard Pelican-type hard case
Power supply and power cord
1 CAT6 network cable
1 FireWire cable
1 USB 3.0 device cable
3 SAS/SATA cables
4 6-pin SATA plugs (for use with eSATA drives)
1 2.5″/3.5″ IDE to SATA adapter
Users’ manual on CD-ROM
*The Talon Ultimate achieves speeds of over 40GB/min using solid state “suspect” drives that contain a freshly installed Windows “X” OS and random data. Settings used are e01/ex01 image format, with compression and with verify “on”. The specification and condition of the suspect hard drives as well as the mode, image format and settings used during the imaging process may affect the achieved speeds.
