The Shield-399 launches at the end of this month. I've been building it for over a year now, and it still feels a little strange to write that sentence.
So what is it? It's a portable digital forensics platform; a digital multi-tool. A self-contained unit with a touchscreen on the top and USB ports that each have an assigned role. Plug an evidence drive into a source port and the device treats it as read-only from the moment it connects, and then verifies that it actually is. Plug a destination drive into a destination port and the built in drive and partition manager will automatically mount and unmount the drive so the tools can write to it.
You can image to it in E01, Ex01, AFF4, or raw DD. Hashing happens during the acquisition pass itself: MD5, SHA-1, SHA-256, and BLAKE3 in full mode. If you leave verification on, the verify job queues itself automatically behind the image job. You don't have to remember to come back and do it.
That's the acquisition side. The same box wipes drives, formats them for reuse, scans source drive file systems, lets you browse their contents, runs keyword searches, compares file hashes against NSRL or your own hash sets, and organizes it all into case reports in PDF, HTML, or JSON.
One part I'm excited about is that you don't need the touchscreen at all if you don't want it. The unit hosts its own network dashboard. Put it on your local network, or scan the QR code it shows on screen and your phone opens the dashboard directly. Queue jobs from your desk, check progress from a tablet, or pull a report without walking over to the bench. Everything the device does is available in the browser. QR codes are generated on screen to make pairing and connection easier.
What it's not: a full analysis workstation. It won't parse browser history or registry artifacts, and it's not trying to replace your deep-dive analysis suite. It handles the front and back ends of the job: acquisition, sanitization, triage, and paperwork. It does those without tying up a workstation or a licensed seat.
One more thing worth saying: the appliance ships first. A software version you can install on your own hardware is coming after, and it runs the same capability set, but I wanted to get the hardware unit right before splitting my attention. One thing at a time. Some days you may want to travel with only your laptop; on others, you may want the simplicity of a dedicated hardware toolkit. You're not locked into one platform.
Over the next few weeks I'll be posting short pieces on individual features and some of the design decisions behind them: how source protection actually works, what the QR pairing is doing under the hood, and why I built the wipe engine the way I did. If you work in digital forensics, or you just like watching a hardware product come together, stick around.
We're almost there.