View source for Software:CAINE Linux

{{Infobox OS
| name = CAINE Linux
| logo = 
| logo size = 
| screenshot = Caine_Linux_6_desktop_screenshot.jpg
| screenshot_size = 290px
| developer = Giovanni "Nanni" Bassetti
| family = [[Software:Linux|Linux]] ([[Unix-like]])
| working state = Current
| source model = [[Open-source software|Open source]]
| released = {{Start date|df=yes|2009|02|22}}
| latest release version = 13.0 "Warp"
| latest release date = {{Start date and age|mf=yes|2023|03|16}}
| repo = 
| update model = 
| package manager = APT
| supported platforms = [[X86-64|amd64 (x86-64)]], [[ARM architecture|ARM]]
| kernel type = [[Monolithic kernel|Monolithic]]
| userland = 
| ui = [[Software:MATE|MATE]] Desktop Environment
| license = [[Free software]], mainly the [[Software:GNU GPL|GNU GPL]]
| website = {{URL|https://www.caine-live.net/|caine-live.net}}
}}

'''CAINE Linux''' (''Computer Aided INvestigative Environment'') is an Italian [[Software:Linux distribution|Linux]] live distribution managed by Giovanni "Nanni" Bassetti.<ref name=":0" /> The project began in 2008 as an environment to foster [[Digital forensics|digital forensics and incidence response]] (DFIR), with several related tools pre-installed.<ref>{{Cite web|url=https://www.caine-live.net/page4/history.html|title=History of the Project|website=www.caine-live.net|access-date=2020-01-29}}</ref>

== Purpose ==
CAINE is a professional [[Open-source software|open source]] forensic platform that integrates software tools as modules along with powerful scripts in a graphical interface environment.<ref name=":0">{{Cite web|url=https://www.caine-live.net/|title=CAINE Live USB/DVD - computer forensics digital forensics|website=www.caine-live.net|access-date=2018-07-02}}</ref> Its operational environment was designed with the intent to provide the forensic professional all the tools required to perform the digital forensic investigate process (preservation, collection, examination and analysis).<ref>{{Cite journal|date=2013-09-01|title=A survey of digital forensic investigator decision processes and measurement of decisions based on enhanced preview|journal=Digital Investigation|language=en|volume=10|issue=2|pages=148–157|doi=10.1016/j.diin.2013.04.005|issn=1742-2876|last1=James|first1=Joshua I.|last2=Gladyshev|first2=Pavel}}</ref><ref>{{Cite book|title=Hacker techniques, tools, and incident handling|last=Sean-Philip.|first=Oriyano|date=2011|publisher=Jones & Bartlett Learning|others=Gregg, Michael.|isbn=978-0763791834|location=Sudbury, Mass.|oclc=702369433}}</ref> CAINE is a live Linux distribution so it can be booted from removable media (flash drive) or from an optical disk and run in memory.<ref>{{Cite news|url=https://www.techradar.com/reviews/caine-80|title=CAINE 8.0|work=TechRadar|access-date=2018-07-02|language=EN-GB}}</ref> It can also be installed onto a physical or virtual system.  In Live mode, CAINE can operate on  data storage objects without having to boot up a supporting operating system. The latest version 11.0 can boot on UEFI/UEFI+Secure and Legacy [[BIOS]] allowing CAINE to be used on information systems that boot older operating systems (e.g. [[Software:Windows NT|Windows NT]]) and newer platforms (Linux, Windows 10).

== Requirements ==
CAINE is based on Ubuntu 18.04 64-bit, using Linux kernel 5.0.0-32.<ref>{{Cite web|title=CAINE Live USB/DVD|url=https://www.caine-live.net/|url-status=live|access-date=27 August 2021|website=CAINE website|archive-url=https://web.archive.org/web/20081029065141/http://www.caine-live.net:80/ |archive-date=2008-10-29 }}</ref> CAINE system requirements to run as a live disc are similar to Ubuntu 18.04. It can run on a physical system or in a virtual machine environment such as VMware Workstation.

== Supported platforms ==
The CAINE Linux distribution has numerous software applications, scripts and libraries that can be used in a graphical or command line environment to perform forensic tasks. CAINE can perform data analysis of data objects created on Microsoft Windows, Linux and some [[Software:Unix|Unix]] systems. One of the key forensic features since version 9.0 is that it sets all [[Device file#BLOCKDEV|block devices]] by default to read-only mode. Write-blocking is a critical methodology to ensure that disks are not subject to writing operations by the operating system or forensic tools.<ref>{{Cite book|last1=Decusatis|first1=Casimer|last2=Carranza|first2=Aparicio|last3=Ngaide|first3=Alassane|last4=Zafar|first4=Sundas|last5=Landaez|first5=Nestor|title=2015 IEEE International Conference on Computer and Information Technology; Ubiquitous Computing and Communications; Dependable, Autonomic and Secure Computing; Pervasive Intelligence and Computing |chapter=Methodology for an Open Digital Forensics Model Based on CAINE |date=October 2015|pages=935–940 |publisher=IEEE|doi=10.1109/cit/iucc/dasc/picom.2015.61|isbn=9781509001545|s2cid=13397314}}</ref> This ensures that attached data objects are not modified, which would negatively impact digital forensic preservation.

== Tools ==
CAINE provides software tools that support [[Database|database]], [[Computer memory|memory]], forensic and network analysis.<ref>{{Cite web|url=https://www.linuxinsider.com/story/81353.html|title=CAINE Provides Sturdy Support for Forensic Specialists |website=www.linuxinsider.com|date=14 November 2014 |language=en|access-date=2018-07-02}}</ref> [[File system]] image analysis of NTFS, FAT/ExFAT, Ext2, Ext3, HFS and ISO 9660 is possible via command line and through the graphic desktop.<ref>{{Cite web|url=http://www.eweek.com/security/caine-9.0-linux-helps-investigators-with-computer-security-forensics|title=CAINE 9.0 Linux Expands Computer Forensic Investigation Capabilities|last=Kerner|first=Sean Michael|date=7 November 2017|website=eWeek}}</ref> Examination of Linux, Microsoft Windows and some Unix platforms is built-in. CAINE can import disk images in raw (dd) and expert witness/advanced file format. These may be obtained from using tools that are included in CAINE or from another platform such as [[Software:EnCase|EnCase]] or the [[Software:Forensic Toolkit|Forensic Tool Kit]].<ref>{{Citation|chapter=Tactical Objectives and Challenges in Investigative Computer Forensics|date=2013-04-11|pages=157–166|publisher=John Wiley & Sons, Inc.|isbn=9781118572115|doi=10.1002/9781118572115.ch6|title=Investigative Computer Forensics}}</ref>

Some of the tools included with the CAINE Linux distribution include:

* [[Software:The Sleuth Kit|The Sleuth Kit]] – open source command line tools that support forensic inspection of disk volume and file system analysis.
* [[Software:Autopsy|Autopsy]] – open source digital forensics platform that supports forensic analysis of files, hash filtering, keyword search, email and web artifacts. Autopsy is the graphical interface to The Sleuth Kit.
* RegRipper – open source tool, written in Perl, extracts/parses information (keys, values, data) from the Registry database for data analysis.
* Tinfoleak – open source tool for collecting detailed Twitter intelligence analysis.
* [[Software:Wireshark|Wireshark]] – supports interactive collection of network traffic and non real-time analysis of data packet captures (*.pcap).
* [[Software:PhotoRec|PhotoRec]] – supports recovery of lost files from hard disk, digital camera and optical media.
* Fsstat – displays file system statistical information about an image or storage object.

== References ==
{{reflist}}

== External links ==

* [https://www.caine-live.net/ Official website]

[[Category:Forensic software]]
[[Category:Linux]]
[[Category:Digital forensics software]]
[[Category:Linux distributions]]

{{Sourceattribution|CAINE Linux}}