Background
Often investigators will want to run a forensic application such as ProDiscover Basic Edition from a thumb-drive and perform some initial analysis and/or image out to a local thumb-drive or to a network mount.
ProDiscover and other applications that are written to use local system resources and registry entries can be installed to a U3 (http://www.u3.org/) travel drive if a package is created for install. PackageFactory (http://www.eure.ca/) for U3 lets you convert any* application or EXE into a U3P Package File, for free!
While running applications from U3 drives on a system does leave traces (your tests may vary), this approach can be a least-intrusive approach (for specific situations where no better approach is practical) to live investigation from the accessible system itself.
Technology Pathways has created a U3 install package and made it available for download at http://toorcon.techpathways.com/uploads/ProDiscoverBasicU3.zip
Initial internal tests with the Memorex Travel Drive have been quite successful. As always, Technology Pathways recommends investigators conduct their own tests and become familiar with all tools and methodologies they intend to use in real-world cases.
Regards,
Christopher L. T. Brown, CISSP