SHADOW 3

Examine drives in the original system.

The Shadow 3 offers investigators the unique ability to boot and interact with systems running any operating system without affecting the data on connected drives. Whether it’s a computer, a game console, a DVR, or something else, you can see what’s on the system — in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive. With Shadow 3, you get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence.

​NOTICE:  The IDE adapter kit traditionally supplied with each Shadow 3 order is on back order from our supplier, and we have been unable to secure an alternate source (We are hopeful that this is a temporary situation due to current semiconductor supply chain issues, which should ease at some point).  As such, Voom is now shipping future Shadow 3 orders without the IDE adapter kit, and has removed it from the standard equipment list.   The IDE adapter kit will now be listed as a separate SKU, with availability and pricing dependent upon market conditions at time of order.  If there is a definite need for IDE support, please email support@voomtech.com and we will try to work with you on an individual basis.  

Get the speed and convenience of exploring suspect systems through their native environments while preserving your evidence. See what’s on the system—in the field, in the lab, or in court. Hardware write-blocking ensures that drives in evidence remain unchanged, even as the system performs operations that normally write changes to the drive.

​

• Boot and operate Windows, Linux, Mac: any operating system

• Run any application on suspect computer

• Operate DVRs and game consoles that boot SATA drives

• Works with SATA and IDE hard drives and SSDs

• Investigate RAID systems (with one Shadow per drive)

• Field Triage

• Field Investigation

• Lab Triage

• Lab Investigation

• Minutes to connect, investigate without limits

• Present live in court, or produce print/video/screen shots directly from suspect computer—intuitive evidence presentation

• Accepted in court

• Confront suspect/defendant with powerful direct evidence before (or after) they get “lawyered up”

• Immediate evidence/intelligence gathering

• Allows suspect PC to decrypt data in many cases

• Retains state of the computer between reboots, or ‘zero’ the Shadow to begin anew or to demonstrate repeatability of evidence gathering

• Installs between the motherboard and hard drive.  Turn on the Shadow, wait a few seconds for ‘Ready’, then boot and operate suspect computer

• Works with boot drives and secondary drives

​

Direct evidence is the best evidence.  See what the suspect sees, Show to the judge, jury, prosecutor exactly what the suspect sees.

Shadow 3 Demonstration

Shadow 3 inventor David Biessener talks applications and setup of the Shadow 3 portable forensic investigation device