Voom Shadow 3, User Manual

Page 1: ...Voom Shadow 3 User Guide Portable Computer Forensic Test Lab For Immediate Real Time Computer Investigation ...

Page 2: ...quipment described herein including hardware firmware and software is manufactured from designs that are the property of Voom Technologies Inc Reproduction or reverse engineering of any part of this equipment without express written permission of Voom Technologies Inc is prohibited Copyright 2004 2018 Voom Technologies Inc All Rights Reserved Printed in U S A Shadow 3 is designed developed and man...

Page 3: ... 3 Preface 3 3 1 Product Contents 3 3 2 System Requirements 3 3 3 Overview 3 3 4 Definitions 5 3 4 1 General 5 3 4 2 Shadow 5 4 Shadow Setup 6 4 1 Single Hard Drive System 6 4 2 Multiple Hard Drive System 8 4 2 1 Use Multiple Shadows 8 4 2 2 Use Third Party Write Blockers 8 4 3 Operating the Host Computer 8 5 Command Description 9 5 1 Zero Shadow Command 9 5 2 Wipe Shadow Command 9 5 3 Park Drives...

Page 4: ... 1 Zero Shadow Procedure 16 7 2 Wipe Shadow Procedure 16 7 3 Park Drives Procedure 16 7 3 1 Spin Drives Procedure 17 7 4 Lock Shadow Procedure 17 7 5 Toggle Ctrl Blk Procedure 17 8 Shadow Internal Hard Drive Replacement 18 8 1 Step 1 Internal Hard Drive Removal 18 8 2 Step 2 Internal Hard Drive Installation 18 8 3 Step 3 Internal Hard Drive Introduction 19 9 Warranty 20 9 1 Limited Warranty 20 9 2...

Page 5: ...t be construed as a commitment by Voom Technologies Inc Voom Technologies Inc assumes no responsibility or liability for any errors or inaccuracies that may appear in this manual including the products firmware and included accessories 1 3 Data Protection The user must be aware that an improper system configuration can lead to data corruption Please read the Shadow Setup chapter of this manual car...

Page 6: ...ime Zone at 651 998 1618 2 2 Support by E Mail Voom Technologies Inc technical support is available by e mail at support voomtech com 2 3 Technical Support Tips Call from a telephone where you have access to your computer Please be prepared to provide the following information Name telephone number e mail address Serial Number and version of the Voom Shadow product Make and model of your computer ...

Page 7: ...e is often a very time consuming process Because it is absolutely essential that the evidence on a suspect hard drive not be altered in any way investigation and analysis of the data on the hard drive is often times done in a lab environment Imagine if you could boot and use the suspect computer all the while preventing any alteration of the suspect hard drive Voom Shadow 3 is an investigative too...

Page 8: ...uring the investigative process are written to the internal Shadow hard drive The suspect hard drive is not altered in any way during the investigative process System operating integrity is maintained because the Shadow remembers where the writes occurred and reads from the Shadow drive whenever the suspect computer reads data from a block that the Shadow has written 4 ...

Page 9: ...that is configured as master through jumper setting or cable select connection Motherboard The main computer circuit board sometimes called the mainboard OS Refers to the Operating System Examples include Microsoft Windows 2000 Professional and Microsoft Windows XP Home Partition Partitions can be created on a hard drive so that each partition acts like a separate hard drive In Microsoft Windows p...

Page 10: ...power cable and remove the computer cover 2 Disconnect the DC power cable from the suspect hard drive 3 Disconnect the SATA cable from the suspect hard drive Leave it connected to the motherboard Step 2 Shadow Setup 1 Connect the SATA cable that was disconnected from the hard drive in Step 1 3 to the Shadow 3 port labeled Motherboard 2 Connect one end of the Voom supplied SATA cable to the Shadow ...

Page 11: ...Voom Technologies Inc 2004 2018 Proprietary www voomtech com The following picture is included for reference when using IDE hard drives 7 ...

Page 12: ...st of the writes will occur on the boot drive or if there are no other available SATA ports it should be tolerable to protect the non boot drives with a simple write blocker Keep in mind that the additional functionality of Shadow 3 will not be available on the secondary hard drives 4 3 Operating the Host Computer Once the system has been connected as described above the Shadow unit may be turned ...

Page 13: ... Drives Command The Park Drives command will tell the Source drive and Shadow drive to park their heads in preparation for powering off This controlled shutdown does not stress the hard drives the way an unexpected emergency shutdown will Shadow 3 will automatically issue the Park command to the drives during normal operation It is recommended to issue the Park Drives command every time the Shadow...

Page 14: ... Shadow 3 alters the HD control block to be more compatible with some motherboard OS combinations in particular 2007 and newer motherboards in combination with Windows 10 The modified behavior is entirely in software the HD is never physically altered by the change There is no guarantee either mode will allow a shadowed HD to boot 10 ...

Page 15: ...cter displayed in the lower right hand corner of the LCD indicates that the unit is waiting for acknowledgment of the data currently displayed in the LCD Press the enter button each time the arrow character is displayed in order to continue executing the current command Note The user may terminate an executing command by pressing the cancel button Note The button command menu is unavailable when t...

Page 16: ...one Your Shadow drive has been zeroed Press enter to return to the ready screen 6 2 Wipe Shadow Procedure The following table describes the normal sequence associated with wiping the Shadow drive LCD interface Comments Shadow3 1 04 ready classic From the main window press menu to display the initial menu item Zero Shadow Press menu to proceed to the next command Wipe Shadow Press enter to execute ...

Page 17: ...Spin Drives command Shadow3 1 04 parked Shadow3 1 04 ready The drives have been parked The drives have been spun up 6 4 Lock Shadow Procedure The following table describes the normal sequence associated with locking the Shadow LCD interface Comments Shadow3 1 04 ready classic From the main window press menu to display the initial menu item Zero Shadow Press menu to proceed to the next command Wipe...

Page 18: ...y the initial menu item Zero Shadow Press menu to proceed to the next command Wipe Shadow Press menu to proceed to the next command Park Drives Press menu to proceed to the next command Lock Shadow Press menu to proceed to the next command Toggle Ctrl Blk to Compatible Press enter to execute the Toggle Ctrl Blk command Toggle Ctrl Blk Are You Sure Press enter to perform the Toggle cancel to abort ...

Page 19: ...OM1 as described in the table below Parameter Value Baud Rate 115200 Data Bits 8 Parity none Stop Bits 1 Flow Control none Serial Port Settings Once the serial cable is connected and the terminal program configured the Shadow 3 unit may be turned on On power up you should see the following sequence Start FPGA loaded Shadow3 1 04 Initializing Checking Shadow Checking Source only with a Source chang...

Page 20: ...dure When using the serial interface the command syntax for wiping the Shadow is given below Wipe The following example shows the output from a typical Wipe Shadow command Wipe Wiping shadow drive may take over 20 minutes done 0 errors elapsed 50 50 elapsed Shadow Drive Wiped 7 3 Park Drives Procedure When using the serial interface the command syntax for parking the drives is given below Park The...

Page 21: ...ocedure When using the serial interface the command syntax for parking the drives is given below Lock The following example shows the output from a typical Lock Shadow command Lock Shadow Drive Locked 7 5 Toggle Ctrl Blk Procedure When using the serial interface the command syntax for parking the drives is given below ToggleControl The following example shows the output from a typical Lock Shadow ...

Page 22: ...d carefully lift the drive retaining bracket and screw out and set them aside The internal hard drive can now be removed by carefully sliding it towards the right which will unplug it from the internal connections Take note of the orientation of the internal hard hard drive the connectors should be on the left end and the hard hard drive label should be facing up Once the internal hard hard drive ...

Page 23: ... Shadow 3 enclosure then install and tighten the 4 screws Do not over tighten the screws 8 3 Step 3 Internal Hard Drive Introduction Turn on the Shadow 3 without any cables attached and wait for the LCD to display Shadow disabled No Source The new internal Shadow drive has now been introduced to the Shadow 3 unit and the unit may be operated normally 19 ...

Page 24: ...ing but not limited to water or lightning damage or tampering with the product Upon notification of defect in materials or workmanship and return of the product in accordance with the Warranty Return Instructions below and in concurrence with the warranty conditions as indicated above Voom shall either repair or replace the product at its discretion Voom reserves the right to replace the product w...

Page 25: ...ative with the product serial number the invoice number and the date of purchase in order to facilitate this process 3 Once you receive a RMA number please pack the Product in its original packaging or any other secure box so that no damage may occur 4 Deliver the Product shipping prepaid to Voom Technologies Inc 1000 Westgate Dr Suite 150 I St Paul MN 55114 Attention RMA ______ 5 Shipping with pr...

Page 26: ...e 0 to 8000 Feet Physical Characteristics Height 1 5 inches Width 5 625 inches Depth 4 inches Weight I pound excluding accessories 10 1 CE Users need to notify any information technology equipment users within a 60 meter radius that Shadow 3 may interfere with other electronic equipment Although the manufacturer has not observed electromagnetic interference from the Shadow 3 with other electronic ...