// Pre-release evaluation · v0.9

Shadow and Shield · Shield 399

A digital forensics platform built for the operator.

Shadow and Shield launches with Shield 399: a field-ready forensic toolkit, touchscreen appliance, and network dashboard for acquisition, sanitization, analysis, case work, and repeatable tool execution.

Technical users configure profiles once. Operators run approved work from the appliance. Tool execution, case activity, metrics, and results remain reviewable from the dashboard.

Join Release Updates Explore Capabilities
Shield 399 forensic appliance with labeled hardware callouts
Shield 399 Pre-release evaluation unit
  • FormatsE01 / Ex01 / AFF4 / DD / Synthetic E01
  • User ControlsProfiles, teams, roles, tool config
  • RecordTool execution, operator history, hashes, keywords, file listings
  • ChassisASUS 15 Pro Ultra 7 255H, 96 GB RAM, 1TB NVMe

Why It Exists

Built to keep forensic tools organized, accessible, accountable, and synchronized.

Shield 399 came from deployed work where data collection and processing outpaced operator capacity and every tool added another setup burden.

  • Useful forensic tools already existed, but each carried its own install, dependencies, and configuration.
  • Tool runs, drive context, notes, and collection priorities were difficult to track across disparate environments.
  • Technical users needed a way to configure a tool profile once.
  • Operators needed to connect media, run the saved profile, and hand off results without exhaustive retraining.

Built For

Built for real evidence work.

Designed for teams that collect, process, review, and hand off digital evidence across field and lab environments.

Law Enforcement + Digital Forensics Military / SOF Field Teams Intel + Government Programs Forensic Labs + Technical Examiners
MODE 01

Field Collection

Connect media, run approved profiles, and process evidence where the work starts without rebuilding configurations.

MODE 02

Lab Review

Review tool execution, hashes, file listings, keyword results, reports, and exports from the dashboard with case context attached.

MODE 03

Team Coordination

Manage users, roles, organizations, cases, selected metadata sync, and repeatable tool access across controlled teams and deployments.

Core Capabilities

Core capabilities for evidence handling and tool execution.

Eight capability areas operators actually use — configured by a technical user, executed from the appliance, and reviewable with case context. Each one has a deeper page when you need the scope, caveats, and outputs.

01 / Acquire

Acquire Evidence

Image connected media to E01, Ex01, AFF4, DD/RAW, or Synthetic E01 with hashing, verification, destination spillover, and one-to-many cloning.

 02 / Sanitize

Sanitize Media

Use Wipe/Overwriter for drive wiping, verification, SSD-aware erase options, and sanitization records where the drive path supports it.

 03 / Analyze

Analyze Drives

Use keyword, regex, hash comparison, encryption indicators, filesystem context, and drive-health signals where exposed.

 04 / Convert

Clone, Migrate, Convert

Handle disk cloning, drive migration, and selected image-conversion capabilities from the same operating surface.

 05 / Manage

Manage Cases & Reports

Keep cases, evidence records, assignments, reports, and exports tied to tool execution and operator activity.

 06 / Execute

Execute Tools

Save tool profiles, queue jobs, track dependencies, use Quick Add, and review execution history where supported.

 07 / Sync

Sync Teams & Deployments

Manage users, organizations, roles, permissions, and selected operational metadata across configured deployments.

 08 / Operate

Operate Hardware

Use the touchscreen, network or paired-device access, configured port roles, and hardware-aware system services.

Operations Dashboard

Hardware-paired software for case-aware review.

Authorized review on an approved local network. Case context, queue state, execution history, and exportable records are paired with the field unit.

Shadow and Shield dashboard running on a rugged laptop beside the Shield 399 appliance and evidence drives
Explore the Platform

Pre-release Access

Join release updates.

Shadow and Shield is in active development and pre-release testing. Get product progress, launch details, and availability updates from daarc.