CAINE
What it is
CAINE is a free Italian GNU/Linux live distribution for digital forensics. It brings existing software tools together as modules behind a graphical interface and is designed to support investigators across four phases of a digital investigation. Its utilities include Autopsy, FTK Imager, PhotoRec, TestDisk, hashcat and memory-analysis scripts, as well as Windows incident-response and live-forensics tools. The current listed download is CAINE 14.0 “LIGHTSTREAM,” dated 24/Mar/2025. Block devices are read-only by default in that release; UnBlock can change the setting. rbfstab supports read-only mounting, while Mounter provides graphical mounting and unmounting. CAINE supports disk imaging, memory forensics and mobile forensics, and works with raw/dd images, EnCase files, databases, internet histories and Windows registries. Export formats include raw/dd, EnCase and text reports. It is free under the GNU Lesser General Public License version 2.1 or later; included third-party software keeps its own licenses. Windows forensic tools are available alongside the Linux distribution.
For and against
For
- Free GNU/Linux live distribution.
- Graphical interface groups existing forensic tools.
- Block devices default to read-only mode.
- Exports raw/dd, EnCase and text reports.
- Includes Windows incident-response tools.
Against
- Third-party software has separate licenses.
- Secure Boot may need disabling.
- BitLocker recovery key is needed before disabling Secure Boot.
The verdict
CAINE combines a graphical forensic environment with utilities for multiple evidence types and read-only device handling by default. Users should review third-party licenses and Secure Boot guidance before getting started.
Who it suits
CAINE suits investigators who need a Linux-based environment for digital forensic work, including disk, memory and mobile forensics. Windows incident-response utilities are also described.
Plans and prices
Free CAINE ISO
Approximately 4000 MB · 64-bit · live or installable Ubuntu-based distribution
Read 15 Oct 2026 · caine-live.net
CAINE
Free ISO image · approximately 4000 MB · third-party software has separate licenses
Read 30 Sep 2026 · caine-live.net
On the record
- Analysis tools
- The tools page describes forensic utilities including Autopsy, FTK Imager, PhotoRec, TestDisk, hashcat, and memory-analysis scripts.caine-live.net · read 30 Sep 2026
- Base system
- CAINE 14.0 is based on 64-bit Ubuntu 24.04 and uses kernel 6.8.0-52.caine-live.net · read 15 Oct 2026
- Boot support
- CAINE 14.0 is described as UEFI-ready and able to boot in UEFI or legacy BIOS modes.caine-live.net · read 15 Oct 2026
- Current release
- The site identifies CAINE 14.0 Lightstream as the latest installable release, published on 24 March 2025.caine-live.net · read 15 Oct 2026
- Documentation
- Official documentation consists of a manual-and-policies page, tool manuals, installation guidance and imaging instructions.caine-live.net · read 15 Oct 2026
- Download verification
- The download page warns users to verify the published MD5 or SHA256 hash of the ISO.caine-live.net · read 15 Oct 2026
- Evidence capture
- Save as Evidence copies selected files into an Evidence folder and creates a metadata report with an optional investigator comment.caine-live.net · read 15 Oct 2026
- Extensibility
- The project says its open distribution can be rebuilt into a differently branded version.caine-live.net · read 15 Oct 2026
- Forensic write protection
- CAINE 14.0 blocks block devices in read-only mode by default, and provides UnBlock to change that state.caine-live.net · read 30 Sep 2026
- Graphical interface
- CAINE combines existing forensic programs as modules behind a graphical interface.caine-live.net · read 15 Oct 2026
- Included utilities
- CAINE includes rbfstab for read-only device mounting and Mounter, a graphical tool for mounting and unmounting devices.caine-live.net · read 30 Sep 2026
- Independent adoption
- LinuxMind says CAINE is used by law-enforcement agencies, corporate security teams, academic researchers and independent investigators.linuxmind.dev · read 15 Oct 2026
- Independent praise: breadth
- LinuxMind describes CAINE as combining many open-source forensic tools for collection, preservation, analysis and reporting.linuxmind.dev · read 15 Oct 2026
- Independent praise: evidence preservation
- LinuxMind highlights read-only mounting as a central benefit for preventing accidental evidence changes.linuxmind.dev · read 15 Oct 2026
- Independent praise: usability
- LinuxInsider found the MATE desktop straightforward and well suited to forensic and IT work.linuxinsider.com · read 15 Oct 2026
- Integrity checks
- The download instructions tell users to check the ISO’s published hash and list a SHA256 hash link for CAINE 14.0.caine-live.net · read 30 Sep 2026
- Interface
- CAINE integrates existing software tools as modules and provides a graphical interface.caine-live.net · read 30 Sep 2026
- Investigation workflow
- The project aims to support investigators through all four phases of a digital investigation.caine-live.net · read 15 Oct 2026
