SHADOW 3
Examine drives in the original system.
Shadow 3 offers investigators the unique ability to boot and interact with systems running any operating system without affecting the data on connected drives. Whether it's a computer, a game console, a DVR, or something else, you can see what's on the system—in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive. With Shadow 3, you get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence.
SHADOW 3
Get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence. See what's on the system—in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive.
Boot and operate Windows, Linux, Mac: any operating system
Run any application on suspect computer
Operate DVRs and game consoles that boot SATA drives
Works with SATA and IDE hard drives and SSDs
Investigate RAID systems (with one Shadow per drive)
Field Triage
Field Investigation
Lab Triage
Lab Investigation
Minutes to connect, investigate without limits
Present live in court, or produce print/video/screen shots directly from suspect computer—intuitive evidence presentation
Accepted in court
Confront suspect/defendant with powerful direct evidence before (or after) they get "lawyered up"
Immediate evidence/intelligence gathering
Allows suspect PC to decrypt data in many cases
Retains state of the computer between reboots, or 'zero' the Shadow to begin anew or to demonstrate repeatability of evidence gathering
Installs between the motherboard and hard drive. Turn on the Shadow, wait a few seconds for 'Ready', then boot and operate suspect computer
Works with boot drives and secondary drives
Direct evidence is the best evidence. See what the suspect sees, Show to the judge, jury, prosecutor exactly what the suspect sees.
Shadow 3 Demonstration
Shadow 3 inventor David Biessener talks applications and setup of the Shadow 3 portable forensic investigation device
