How It Works

CoreSHIELD™ may be used to protect the boot drive so that the contents of the drive may be examined in the original computer, using the drive’s native operating system. However, before doing so, it is highly recommended the user become familiar with CoreSHIELD™ and proficient with its use.

Determine the amount of on-board RAM present on the system. CoreSHIELD™ works well with at least 96MB of available RAM.

If there is more than one hard drive installed in the computer, each drive must be protected to insure their contents do not change during operation. Install and configure a CoreSHIELD™ bridge card for each IDE hard drive present in the system.

Let the operating system “settle” and adjust to the presence of CoreSHIELD™ as a new hardware device. In addition to CoreSHIELD™, other hardware changes such as a keyboard, mouse or monitor that is different from the original, will likely cause adjustments to be made by the operating system, including automatic installation of drivers.

If prompted to restart, select either “cancel” or “later”, as appropriate. Since CoreSHIELD™ is not allowing any writes to the drive, restarting will have no effect and you will continuously loop back through the same process.

The examiner or user may now examine the contents of the suspect's computer, including any software configurations, date/time and TCP/IP settings, access compressed volumes, run proprietary applications, even log onto Internet Service Providers or access other online data services.
(<<< Back)