| CAINE Linux | |
| Screenshot Size: | 290px |
| Developer: | Giovanni "Nanni" Bassetti |
| Family: | Linux (Unix-like) |
| Working State: | Current |
| Source Model: | Open source |
| Latest Release Version: | 13.0 "Warp" |
| Package Manager: | APT |
| Supported Platforms: | amd64 (x86-64), ARM |
| Kernel Type: | Monolithic |
| Ui: | MATE Desktop Environment |
| License: | Free software, mainly the GNU GPL |
CAINE Linux (Computer Aided INvestigative Environment) is an Italian Linux live distribution managed by Giovanni "Nanni" Bassetti. The project began in 2008 as an environment to foster digital forensics and incidence response (DFIR), with several related tools pre-installed.[1]
CAINE is a professional open source forensic platform that integrates software tools as modules along with powerful scripts in a graphical interface environment.[2] Its operational environment was designed with the intent to provide the forensic professional all the tools required to perform the digital forensic investigate process (preservation, collection, examination and analysis).[3] [4] CAINE is a live Linux distribution so it can be booted from removable media (flash drive) or from an optical disk and run in memory.[5] It can also be installed onto a physical or virtual system. In Live mode, CAINE can operate on data storage objects without having to boot up a supporting operating system. The latest version 11.0 can boot on UEFI/UEFI+Secure and Legacy BIOS allowing CAINE to be used on information systems that boot older operating systems (e.g. Windows NT) and newer platforms (Linux, Windows 10).
CAINE is based on Ubuntu 18.04 64-bit, using Linux kernel 5.0.0-32.[6] CAINE system requirements to run as a live disc are similar to Ubuntu 18.04. It can run on a physical system or in a virtual machine environment such as VMware Workstation.
The CAINE Linux distribution has numerous software applications, scripts and libraries that can be used in a graphical or command line environment to perform forensic tasks. CAINE can perform data analysis of data objects created on Microsoft Windows, Linux and some Unix systems. One of the key forensic features since version 9.0 is that it sets all block devices by default to read-only mode. Write-blocking is a critical methodology to ensure that disks are not subject to writing operations by the operating system or forensic tools.[7] This ensures that attached data objects are not modified, which would negatively impact digital forensic preservation.
CAINE provides software tools that support database, memory, forensic and network analysis.[8] File system image analysis of NTFS, FAT/ExFAT, Ext2, Ext3, HFS and ISO 9660 is possible via command line and through the graphic desktop.[9] Examination of Linux, Microsoft Windows and some Unix platforms is built-in. CAINE can import disk images in raw (dd) and expert witness/advanced file format. These may be obtained from using tools that are included in CAINE or from another platform such as EnCase or the Forensic Tool Kit.
Some of the tools included with the CAINE Linux distribution include: