Live Evidence Preview with Shadow 2

For the German journal iX we tested recently the Shadow 2 box from VOOM Technologies. The VOOM Shadow 2 is a computer hardware device that is designed to aid the investigation of a suspect hard drive. It provides investigators with virtual read write access from the host computer’s perspective, while maintaining the original hard drive unchanged. You can use this for preview a drive prior to imaging in the field. We checked with HPA and DCO – everything worked fine according to our checksums.
Read more on my German computer forensics blog.

Update: No, I have no connection with this vendor. 😉