CAINE and Tsurugi Linux
CAINE project (Nanni Bassetti); Tsurugi Linux project · CAINE 14 / Tsurugi 26.03 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Two maintained live Linux distributions assembled for digital forensics. CAINE 14 'Lightstream' is built on Ubuntu 24.04 and is notable for a write-blocking system that locks all block devices read-only by default, with a GUI to unblock deliberately. Tsurugi Linux ships a LAB analysis edition, a lighter Acquire edition for imaging, and the BENTO portable live-response toolkit; its current LAB release is version 26.03.
Who it is for, and when
A forensic live distribution is the practical answer to acquiring or previewing a machine you cannot or should not boot normally — boot from the medium, get a read-only view of the internal disks, and image with Guymager or ewfacquire. CAINE's default-blocked device policy is the most useful safety property either offers, because it makes accidental writes to evidence an explicit act rather than an oversight. Tsurugi is the broader analysis workbench of the two and leans toward OSINT and malware work alongside classic forensics. Tsurugi's site is tsurugi-linux.org.
What it does not cover
A distribution is a bundle, not a validated instrument: the tools inside carry their own versions, quirks, and maintenance states, and you are responsible for knowing which version of which tool produced a result. Software write blocking is a configuration that can be changed or can fail, and it is not equivalent to a hardware write blocker for evidentiary purposes. Neither distribution covers mobile acquisition meaningfully, and neither substitutes for a licensed suite on large or complex cases.
Go to the source
Open at caine-live.net (opens in a new tab)https://www.caine-live.net/
Details
- Type
- Tool
- Written for
- New to the fieldWorking examinerNew to the field, Working examiner
- Publisher
- CAINE project (Nanni Bassetti); Tsurugi Linux project
- Version verified
- CAINE 14 / Tsurugi 26.03
- Year
- 2026
- Topics
- forensic-distro, imaging, linux, evidence-handling, open-source, triage
- Checked at source
Related entries
An open-source library and tool set for the Expert Witness Compression Format (E01/Ex01), including ewfacquire to create images, ewfverify to check their integrity hashes, ewfinfo to read the metadata, and ewfmount to expose an image as a raw device. The repository remains actively maintained.
The acquisition half of the job done properly with Linux command-line tools: write protection, image formats, attaching subject media, image management and transfer, integrity by cryptographic and piecewise hashing, PKI signatures and RFC 3161 timestamping, drive security (ATA passwords, Opal self-encrypting drives, BitLocker, FileVault), and difficult cases such as RAID, VM images and damaged media.
SWGDE's core on-scene collection document, covering preparation, data integrity and security, acquisition approaches, hashing and documentation. The version verified here is 18-F-002-2.0 dated 20 November 2025.
FTK Imager
Partly freeA free Windows imaging and preview tool, originally from AccessData and now distributed by Exterro, which acquired the FTK line. It creates raw, E01, and AD1 images, captures live RAM, previews file systems before acquisition, and produces hash verification reports.
SIFT Workstation
FreeA free Ubuntu LTS-based virtual machine appliance from SANS that bundles more than a hundred open-source incident response and forensic tools, pre-configured and dependency-resolved. It is still actively updated by Rob Lee and a small team and underpins several SANS DFIR courses.