CAINE is a free Italian GNU/Linux live distribution for digital forensics. It combines existing utilities as modules in a graphical interface and is designed to guide investigators through four stages of a digital investigation. The listed current download is CAINE 14.0 “LIGHTSTREAM,” dated 24/Mar/2025. In that release, block devices start in read-only mode, and UnBlock can change the setting. The distribution also includes rbfstab for read-only mounting and Mounter for graphical mounting and unmounting. Its forensic tools include Autopsy, FTK Imager, PhotoRec, TestDisk, hashcat, and memory-analysis scripts, as well as Windows incident-response and live-forensics utilities. The project lists disk imaging, memory and mobile forensics, with support for raw/dd images, EnCase files, databases, internet histories, and Windows registries; reports can be exported as raw/dd, EnCase, or text. CAINE is free under GNU Lesser General Public License version 2.1 or later, while included third-party tools retain their own licenses.
Who it is for
CAINE is for investigators and users working on digital forensic investigations who want a live Linux environment with a graphical interface and forensic utilities. Its Windows side tools may also suit Windows incident-response work.
What is good
- Free ISO image, approximately 4000 MB
- Block devices default to read-only in CAINE 14.0
- Includes Autopsy, FTK Imager, PhotoRec, and TestDisk
- Supports disk, memory, and mobile forensics
- Provides a hash link for ISO integrity checks
What to know first
- Secure Boot may need to be disabled
- Third-party software retains separate licenses
- Windows support is through forensic side tools
Verdict
CAINE offers a free forensic live distribution with read-only device handling and a broad set of investigation utilities. Before disabling Secure Boot, the project advises having the BitLocker recovery key available.
CAINE plans and pricing
All plansCompared on digital forensics software
- Free plan
- Yes
- Evidence sources
- raw/dd disk images; EnCase files; databases; internet histories; Windows registries; deleted files; EXIF data; volatile memory dumps; Android and iPod devices
- Mobile forensics
- Yes
- Disk imaging
- Yes
- Memory forensics
- Yes
- Supported platforms
- Linux; Windows forensic side tools
- Export formats
- raw/dd; EnCase; text reports
