Photo Jul 13, 3 43 11 PM_edited.png

SHADOW 3

Examine drives in the original system.

Shadow 3 offers investigators the unique ability to boot and interact with systems running any operating system without affecting the data on connected drives. Whether it's a computer, a game console, a DVR, or something else, you can see what's on the system—in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive. With Shadow 3, you get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence.

 

SHADOW 3

Get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence. See what's on the system—in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive.

​

  • Boot and operate Windows, Linux, Mac: any operating system

  • Run any application on suspect computer

  • Operate DVRs and game consoles that boot SATA drives

  • Works with SATA and IDE hard drives and SSDs

  • Investigate RAID systems (with one Shadow per drive)

  • Field Triage

  • Field Investigation

  • Lab Triage

  • Lab Investigation

  • Minutes to connect, investigate without limits

  • Present live in court, or produce print/video/screen shots directly from suspect computer—intuitive evidence presentation

  • Accepted in court

  • Confront suspect/defendant with powerful direct evidence before (or after) they get "lawyered up"

  • Immediate evidence/intelligence gathering

  • Allows suspect PC to decrypt data in many cases

  • Retains state of the computer between reboots, or 'zero' the Shadow to begin anew or to demonstrate repeatability of evidence gathering

  • Installs between the motherboard and hard drive.  Turn on the Shadow, wait a few seconds for 'Ready', then boot and operate suspect computer

  • Works with boot drives and secondary drives

​

Direct evidence is the best evidence.  See what the suspect sees, Show to the judge, jury, prosecutor exactly what the suspect sees.

Request a quote or information
 

Shadow 3 Demonstration

Shadow 3 inventor David Biessener talks applications and setup of the Shadow 3 portable forensic investigation device