CAINE
Ubuntu-based digital forensics live distribution
CAINE has no official, structured tool listing we can auto-sync (unlike Kali, BlackArch, REMnux, and Tails). The tools below are maintained by hand and may be incomplete or outdated — check the official docs for the current tool set.
Last verified September 4, 2026
CAINE is a digital forensics distribution built around a full forensic-investigation environment: acquisition, analysis, and reporting tools with careful attention to not modifying evidence during examination. It’s aimed at incident responders and forensic examiners rather than general penetration testing.
Use it only against systems/media you own or are explicitly authorized to examine — see the disclaimer.
Notable bundled toolsmanually maintained
autopsy
Graphical interface to SleuthKit
sleuthkit
Tools for forensics analysis on volume and filesystem data
testdisk
Partition scanner and disk recovery tool, and PhotoRec file recovery tool
Getting started
CAINE ("Computer Aided INvestigative Environment") ships as a bootable ISO. It's built around forensic soundness by default — write-blocking for connected drives and read-only mounting so evidence isn't altered by the analysis process itself. The official documentation covers booting in forensic mode, the bundled interface for managing acquired disk images, and the individual forensic tools included.