Tool profiles
Save supported tool settings as reusable profiles, giving operators a consistent starting point for repeatable tasks.
Platform Overview
A platform for tools, operators, cases, and results.
Technical examiners configure tools, manage cases, monitor execution, and review results through the local network dashboard. Operators run prepared tools from the Shield-399 touchscreen. Case and operator context remain connected to supported queue entries, execution records, and reports.
Touchscreen operation
Run prepared tools from the Shield-399 touchscreen and monitor queue status and progress at the point of operation.
Dashboard review
Use an authorized browser session on a connected, customer-provided laptop, tablet, or phone to review queue state, execution history, case activity, and operational metrics.
Case and team context
Associate supported work with cases, users, and organizations. Warden Network can synchronize selected operational metadata across configured deployments; evidence-image files remain on their storage destinations.
In Operation
One platform from bench work to field deployment.
These field configurations show Shield-399 units working with the local network dashboard, connected media, and protective cases. Select any photograph to open it at full size.
Responsive Access
Mobile dashboard access.
Authorized users can review case and evidence context from a mobile browser over an approved local connection. Access remains subject to the user's session, organization, and permissions.
Workflow
From connected media to case-attached operational history.
- Phase I
Connect
Attach source, destination, and utility media through configured port roles.
- Phase II
Authenticate
Select the user, case, organization, and saved workflow profile.
- Phase III
Execute
Queue acquisition, analysis, sanitization, cloning, migration, or export jobs.
- Phase IV
Verify
Record hashes, verification outcomes, errors, warnings, and execution state.
- Phase V
Review
Use dashboard views, exports, and reports with per-case operational context.
Operations Log
Tool activity, captured as it runs.
Demonstrative sample entries show how actions, hashes, verification outcomes, and operator context can become reportable case history.
- 14:42:07ZInfoSource media attached on PORT.SRC.01 - read-only enforced
- 14:42:11ZOKOperator authenticated against case profile
- 14:42:18ZInfoAcquisition queued: format E01, hash SHA-256, verify on
- 14:51:44ZOKImage complete - 482.6 GB / 0 errors / SHA-256 verified
- 14:51:46ZInfoKeyword and hash comparison set queued against case index
- 15:14:02ZOKCase record updated - operator, hashes, and execution details retained
Operations Dashboard
Configure, monitor, and review from one local dashboard.
From an authorized browser session, users can configure supported tools, manage cases, monitor queue activity, and review execution history, operational metrics, and reports served by the Shield-399 unit.
Overview · 01 of 03
Manage menu
Manage cases, users, access, and reusable configuration from one workspace.
Overview · 01 of 03
Dashboard access
Review local network connections and dashboard-access settings.
Overview · 01 of 03
Forensic image pipeline
Review imaging-pipeline settings and available controls.
Overview · 01 of 03
User management
Review user accounts and available access controls.
Cases · 01 of 03
Case list
Review case numbers, statuses, evidence counts, and recent activity.
Cases · 01 of 03
Team members
Review user accounts and organization membership.
Cases · 01 of 03
Assignment controls
Review assignments that connect users and organizations to case access.
Execution · 01 of 03
Case and execution reports
Review generated case and tool-execution reports alongside recorded activity.
Execution · 01 of 03
Execution history
Review recorded operations, timing, status, and associated case or operator context.
Execution · 01 of 03
Hash job history
Review queued and completed hash jobs with their recorded context.
Execution · 01 of 03
Active hashing queue
Monitor dependencies, progress, and status while a hashing job runs.
Investigate · 01 of 03
Disk layout
Review detected disk structure, partitions, and unallocated regions.
Investigate · 01 of 03
Encrypted-device access
Enter credentials for guarded read-only access to a supported encrypted volume.
Investigate · 01 of 03
NTFS system entries
Review detected NTFS system entries in the file explorer.
Investigate · 01 of 03
Connected-drive overview
Review a connected drive, recorded sessions, partition details, and available examination views.
Investigate · 01 of 03
Keyword search results
Review recorded keyword hits and result details.
Investigate · 01 of 03
Disk-layout analysis
Review GPT metadata, unallocated regions, and partitions for a recorded drive session.
Investigate · 01 of 03
Hash analysis job
Review hash-job configuration, status, and recorded results.
Metrics · 01 of 03
Activity trend
Review operational activity and volume across the selected reporting period.
Metrics · 01 of 03
Tool performance by file category
Compare tool performance across recorded file categories.
Metrics · 01 of 03
Live system monitor
Review current CPU, memory, and thermal state for the active Shield-399 unit.
Metrics · 01 of 03
Drive performance
Review live drive throughput and IOPS measurements.
Tools · 01 of 03
Tool catalog
Browse available tools and open their configuration controls.
Tools · 01 of 03
File extractor
Review the file-extraction tool configuration before running the job.
Tools · 01 of 03
Hash-list management
Create or update reusable hash-list reference data.
Tools · 01 of 03
Drive-hasher results
Review completed drive-hashing results and recorded values.
Tools · 01 of 03
Forensic imager execution
Review configured imaging details, media, and execution state.
Tools · 01 of 03
Hash analysis job
Review hash-analysis job details and recorded configuration.
Tools · 01 of 03
Imaging engine
Select an available imaging engine for the configured acquisition.
Tools · 01 of 03
Imager destination
Review Destination capacity and select an output folder.
Tools · 01 of 03
Case executions
Review tool executions organized by associated case.
Configuration · 01 of 03
Assignment controls
Review assignment controls for teams, cases, and organization access.
Configuration · 01 of 03
Create a resource list
Create reusable reference data for supported tools.
Configuration · 01 of 03
Saved tool profiles
Review and manage repeatable tool profiles.
Configuration · 01 of 03
Resource-list details
Review reference material attached to a resource list.
Configuration · 01 of 03
Resource-list catalog
Browse reusable resource lists in the configuration library.
Configuration · 01 of 03
Custom reference entry
Review a custom reference entry in the configuration library.
Fleet · 01 of 03
Warden Central
Review registered Shield-399 unit availability and connection state.
Fleet · 01 of 03
Organization structure
Review organizational groupings and assignments.
Fleet · 01 of 03
Mobile dashboard access
Scan a QR code to open the Shield-399 dashboard on an approved mobile device.
Field Dossier
Details that separate Shadow and Shield from a tool collection.
The platform is not just a launcher for forensic utilities. These clauses highlight first-party capabilities, workflow records, and team features built into Shadow and Shield.
Native Go forensic imager optimized for modern CPU architecture
LUKS and BitLocker credential handling for encrypted evidence workflows
Source-drive detection, review, and read-only handling controls
Filename translation into English for supported export outputs
Tool execution history, results, hashes, and operator records
Team, organization, and case metadata sync with metrics and reporting
Product updates
Stay informed about Shield-399.
Receive Shield-399 product, software-release, capability, and availability updates from Shadow and Shield.