Release CAINE 11.0, distribution for detecting hidden data

Har sett dagens ljus utgivning CAINE 11.0 (Computer Aided INvestigative Environment), a specialized live distribution designed for forensic analysis, searching for hidden and deleted data on disks, and recovering residual information to reconstruct the system breach. The distribution is based on Ubuntu and equipped with a unified graphical interface based on the MATE shell to manage a set of diverse tools for investigating Unix and Windows systems. It supports loading the live image into RAM. The size of the bootable ISO-avbildningen 4.1 GB (x86_64).

I sammansättningen includes tools such as GtkHash, Air (Automated Image & Restore), SSdeep, HDSentinel (Hard Disk Sentinel), Bulk Extractor, Fiwalk, ByteInvestigator, Autopsy, Foremost, Scalpel, Sleuthkit, Guymager, DC3DD. It is also worth noting a specially developed system within the project WinTaylor for in-depth analysis of Windows systems and generating detailed reports on all recorded anomalies. Also included is a collection of helper scripts for the Caja file manager (a fork of Nautilus), which allows performing a wide range of checks on disk partitions or directories, as well as viewing a list of deleted files and analyzing structured content such as browser history, Windows registry, images with EXIF metadata.

Huvudsakliga nyheter:

• The release is built on the Ubuntu 18.04 package base, supports UEFI Secure Boot, and comes with Linux kernel 5.0;
• To prevent accidental write operations, all block devices are now mounted by default in read-only mode. To switch to a writable mode, the BlockON utility is offered in the graphical interface;
• Boot time has been reduced;
• Added the ability to boot while copying the boot image into RAM;
• New versions of OSINT, Autopsy 4.13, APFS, BTRFS forensic tool;
• Added support for NVME SSD;
• The SSH server is disabled by default;
• Integrated tool scrcpy, for managing an Android device (screen capture) via USB or TCP/IP;
• Added X11VNC Server for remote management of CAINE;
• Added AutoMacTc tool for forensic analysis of macOS-based systems;
• Added utility Autotimeliner for automatically extracting user activity information from memory dumps;
• Added firmware analyzer Firmwalker;
• Added utility CDQR (Cold Disk Quick Response) för att återhämta resterande data från diskavbilder;
• Ett verktygsset för Windows har lagts till.
  

Källa: opennet.ru