Immediate forensic investigation, on site or in the lab. Boot and operate a suspect computer without changing the (hard drive) evidence.
- Boot and operate Windows, Linux, Mac: any operating system
- Run any application on suspect computer
- Operate DVR’s and game consoles that boot SATA drives
- Works with SATA and IDE hard drives and SSD’s
- Investigate RAID systems (with one Shadow per drive)
- Field Triage
- Field Investigation
- Lab Triage
- Lab Investigation
- Minutes to connect, investigate without limits
- Present live in court, or produce print/video/screen shots directly from suspect computer – intuitive evidence presentation
- Accepted in court
- Confront suspect/defendent with powerful direct evidence before (or after) they get “lawyered up”
- Immediate evidence/intelligence gathering
- Allows suspect PC to decrypt data in many cases
- Retains state of the computer between reboots, or ‘zero’ the Shadow to begin anew or to demonstrate repeatability of evidence gathering
- Installs between the motherboard and hard drive. Turn on the Shadow, wait a few seconds for ‘Ready’, then boot and operate suspect computer
- Works with boot drives and secondary drives