An alternative solution is the use of a keyboard, video, mouse (KVM) switch over IP (IP-KVM). An IP-KVM is a
device that allows the remote connection to the keyboard, video and mouse ports of the TS. It captures, digitizes and
compresses the video signal of the TS before transmitting it to a remote controller by means of an IP connection. Conversely, a console application on the controlling computer captures mouse and keyboard inputs and sends them to the IP-KVM device, which, in turn, generates respective mouse and keyboard inputs for the controlled system. The amount of suspicious traces that can be found upon a digital forensic analysis of the TS is limited, mostly considering that modern IP-KVM devices [21] do not require any software to be installed both on the controller and on the target systems. Obviously, the KVM device is itself evidence that should be destroyed or obfuscated by the AM in order to divert the investigation.