The Shadow 2 provides read/write access from the host computer's perspective, while maintaining the original HDD unchanged and forensically sound. The Shadow redirects all writes to its internal drive, at the host-to-drive interface level. Clear ('zero') the Shadow's drive at anytime and begin a clean investigation of the suspect computer within seconds.

Simply connect the Shadow and turn it on, after a few seconds (green light) boot the suspect computer. Operate the suspect computer in the same fashion as any user would. The Shadow ensures the suspect computer never receives a write and remains forensically sound. Since the Shadow only writes to its own internal drive, when it is removed the suspect computer remains in this pristine, unaltered state.