I was preparing a course material for one of my training programs about digital forensics that I thought it should be a good idea to write a post about available bootable Live CDs for use by digital forensic investigators. These Live CDs have a set of forensic tools and can be deployed to a running suspect system or we can boot the suspect system using them. I have listed only well-known Live CDs that are widely used.<\/p>\n
SIFT<\/a> (SANS Investigative Forensic Toolkit) Workstation is my favorite one. It is created by Rob Lee<\/a> at SANS Institute<\/a> on top of Ubuntu and pre-configured with several digital forensic examination tools. Its current version is 2.14 and it\u2019s available to download at no charge in two different flavors; VMware Appliance<\/a> and Installation DVD<\/a> (.iso file).<\/p>\n Helix3<\/a> is another famous Linux distribution built on top of Ubuntu that focuses on incident response and computer forensics. It is developed by e-fense<\/a> and. The most recent release of Helix3 is 2009R1 and can be downloaded from e-fense store<\/a>. In 2009 e-fense announced that Helix3 would no longer be free to download and there is no plan to update the free version. The paid version is called Helix3 Pro<\/a> and the latest<\/a> version of Helix3 Pro is 2009R3 that was released on December 2009. At this time, e-fense is no longer planning on developing the Helix3 Pro. \u00a0Although the tool is not updated for a long period but it is used widely by the digital forensic practitioners. While it can be used as a bootable live CD, It also provides a collection of\u00a0executables that can be run on live system.<\/p>\n CAINE<\/a> (Computer Aided Investigative Environment) is another forensics distro based on Ubuntu and looks like the Helix3 in functionality and environment. CAINE is developed by Tony Brijeski and provides a friendly Windows autorun GUI and a number of analysis tools. The ISO image of current version is available for free download at cain3.0<\/a>.<\/p>\n DEFT<\/a> (Digital Evidence & Forensic Toolkit) is based on Linux Kernel 3 and the DART (Digital Advanced Response Toolkit). It is developed and maintained by an Italian team in .iso file format and virtual appliance configure. The current version which is distributed free of charge is 7.2. DEFT includes the best up-to-date forensic specific tools that you may get to work on imaging, processing, and or analyzing cases.<\/p>\n Raptor<\/a> is another forensics bootable CD from Forward Discovery<\/a>. It is based on Ubuntu distro and the latest free version of Raptor is 2.5. It is available for sale as a pre-installed USB device.<\/p>\n