SHADOW 3
Examine drives in the original system.
The Shadow 3 offers investigators the unique ability to boot and interact with systems running any operating system without affecting the data on connected drives. Whether it's a computer, a game console, a DVR, or something else, you can see what's on the system — in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive. With Shadow 3, you get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence.
NOTICE: The IDE adapter kit traditionally supplied with each Shadow 3 order is on back order from our supplier, and we have been unable to secure an alternate source (We are hopeful that this is a temporary situation due to current semiconductor supply chain issues, which should ease at some point). As such, Voom is now shipping future Shadow 3 orders without the IDE adapter kit, and has removed it from the standard equipment list. The IDE adapter kit will now be listed as a separate SKU, with availability and pricing dependent upon market conditions at time of order. If there is a definite need for IDE support, please email and we will try to work with you on an individual basis.
SHADOW 3
Get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence. See what's on the system—in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive.
Boot and operate Windows, Linux, Mac: any operating system
Run any application on suspect computer
Operate DVRs and game consoles that boot SATA drives
Works with SATA and IDE hard drives and SSDs
Investigate RAID systems (with one Shadow per drive)
Field Triage
Field Investigation
Lab Triage
Lab Investigation
Minutes to connect, investigate without limits
Present live in court, or produce print/video/screen shots directly from suspect computer—intuitive evidence presentation
Accepted in court
Confront suspect/defendant with powerful direct evidence before (or after) they get "lawyered up"
Immediate evidence/intelligence gathering
Allows suspect PC to decrypt data in many cases
Retains state of the computer between reboots, or 'zero' the Shadow to begin anew or to demonstrate repeatability of evidence gathering
Installs between the motherboard and hard drive. Turn on the Shadow, wait a few seconds for 'Ready', then boot and operate suspect computer
Works with boot drives and secondary drives
Direct evidence is the best evidence. See what the suspect sees, Show to the judge, jury, prosecutor exactly what the suspect sees.
Shadow 3 Demonstration
Shadow 3 inventor David Biessener talks applications and setup of the Shadow 3 portable forensic investigation device