The patented Shadow was created by Voom especially for immediate critical data access, ease of investigation, comprehensible evidence presentation and validation of findings. This unique device works with any operating system and any software application (including custom-designed). It allows the user to “operate” the suspect computer in its native environment without imaging and to begin an investigation anew, in seconds, without reimaging. Use the Shadow in the field or lab: preview evidence, triage (e.g., rank high-value evidence), upload forensic tools (e.g., password cracking). In the courtroom: present live, dynamic, understandable evidence (e.g., Mark Jensen trial, Feb., 2008). The Shadow comes standard with a built-in write-blocker and an internal HDD to which all writes are redirected. Simply connect and turn on the Shadow, then boot the suspect computer.