The Computer Aided INvestigative Environment (CAINE) is a live-response bootable CD/DVD with options for booting in safe mode, text mode, as a live system, or in RAM, as shown here:
- Homepage: http://www.caine-live.net/
- Based on: GNU Linux.
- Distribution type: Forensics and incident response
One of the most noticeable features of CAINE after selecting your boot option is the easy way to find the write-blocker feature, seen and labeled as a BlockON/OFF icon, as shown in the following screenshot. Activating this feature prevents the writing of data by the CAINE OS to the evidence machine or drive:
Forensic Tools is the first menu listed in CAINE. Like DEFT Linux, there are several categories in the menu, as seen in the following screenshot, with several of the more popular tools used in open source forensics. Besides the categories, there are direct links to some of the more well-known tools, such as Guymager and Autopsy, which will both be covered in detail in later chapters:
For a full list of the features and packages included in CAINE at the time of this publishing, please visit the following link: