CAINE
CAINE is a free Italian GNU/Linux live distribution for digital forensics.
What CAINE is
CAINE is a free Italian GNU/Linux live distribution for digital forensics. It brings existing utilities together as modules behind a graphical interface and is intended to support investigators through four phases of a digital investigation. Its tools include Autopsy, FTK Imager, PhotoRec, TestDisk, hashcat, and memory-analysis scripts, along with Windows incident-response and live-forensics utilities. CAINE 14.0 “LIGHTSTREAM,” dated 24/Mar/2025, is listed as the current download. By default, CAINE 14.0 sets block devices to read-only; UnBlock can change that setting. The distribution also includes rbfstab for read-only mounting and Mounter for graphical mounting and unmounting. It supports disk imaging, memory forensics, and mobile forensics, and can work with raw/dd disk images, EnCase files, databases, internet histories, and Windows registries. Export formats include raw/dd, EnCase, and text reports. The plan is free; the free ISO image is approximately 4000 MB. Third-party software retains separate licenses.
Good
- Free GNU/Linux live distribution.
- Read-only block-device mode is the default.
- Includes disk, memory, and mobile forensics.
- Exports raw/dd, EnCase, and text reports.
- Provides a graphical device-mounting tool.
Watch out
- The ISO image is approximately 4000 MB.
- Third-party software has separate licenses.
- Secure Boot may need to be disabled.
Who it suits
CAINE suits digital investigators who need a Linux forensic environment with a graphical interface and bundled analysis utilities. Its Windows forensic side tools may also suit users handling Windows incident response.
Verdict
CAINE combines forensic utilities and device-mounting tools in a free live distribution. Check the ISO hash before use, and have the BitLocker recovery key available if disabling Secure Boot is needed.
Plans and prices
From CAINE's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| CAINE | Free | Free ISO image · approximately 4000 MB · third-party software has separate licenses |
| Free CAINE ISO | Free | Approximately 4000 MB · 64-bit · live or installable Ubuntu-based distribution · Free ISO image |
The facts
Each one read from CAINE's own pages, with the date it was checked.
What it does
- Analysis tools
- The tools page describes forensic utilities including Autopsy, FTK Imager, PhotoRec, TestDisk, hashcat, and memory-analysis scripts.checked 30 Sep 2026
- Base system
- CAINE 14.0 is based on 64-bit Ubuntu 24.04 and uses kernel 6.8.0-52.checked 15 Oct 2026
- Boot support
- CAINE 14.0 is described as UEFI-ready and able to boot in UEFI or legacy BIOS modes.checked 15 Oct 2026
- Current release
- The site identifies CAINE 14.0 Lightstream as the latest installable release, published on 24 March 2025.checked 15 Oct 2026
- Documentation
- Official documentation consists of a manual-and-policies page, tool manuals, installation guidance and imaging instructions.checked 15 Oct 2026
- Download verification
- The download page warns users to verify the published MD5 or SHA256 hash of the ISO.checked 15 Oct 2026
- Evidence capture
- Save as Evidence copies selected files into an Evidence folder and creates a metadata report with an optional investigator comment.checked 15 Oct 2026
- Extensibility
- The project says its open distribution can be rebuilt into a differently branded version.checked 15 Oct 2026
- Forensic write protection
- CAINE 14.0 blocks block devices in read-only mode by default, and provides UnBlock to change that state.checked 30 Sep 2026
- Graphical interface
- CAINE combines existing forensic programs as modules behind a graphical interface.checked 15 Oct 2026
- Included utilities
- CAINE includes rbfstab for read-only device mounting and Mounter, a graphical tool for mounting and unmounting devices.checked 30 Sep 2026
- Independent adoption
- LinuxMind says CAINE is used by law-enforcement agencies, corporate security teams, academic researchers and independent investigators.checked 15 Oct 2026
- Independent praise: breadth
- LinuxMind describes CAINE as combining many open-source forensic tools for collection, preservation, analysis and reporting.checked 15 Oct 2026
- Independent praise: evidence preservation
- LinuxMind highlights read-only mounting as a central benefit for preventing accidental evidence changes.checked 15 Oct 2026
- Independent praise: usability
- LinuxInsider found the MATE desktop straightforward and well suited to forensic and IT work.checked 15 Oct 2026
- Integrity checks
- The download instructions tell users to check the ISO’s published hash and list a SHA256 hash link for CAINE 14.0.checked 30 Sep 2026
- Interface
- CAINE integrates existing software tools as modules and provides a graphical interface.checked 30 Sep 2026
- Investigation workflow
- The project aims to support investigators through all four phases of a digital investigation.checked 15 Oct 2026
- Latest release
- The downloads page lists CAINE 14.0 “LIGHTSTREAM,” dated 24/Mar/2025, as the current download.checked 30 Sep 2026
- Licence
- CAINE and its Windows-side tools are offered under the GNU Lesser General Public License version 2.1 or later, while bundled components retain their own licences.checked 15 Oct 2026
- License
- CAINE is free software under the GNU Lesser General Public License version 2.1 or later; included third-party software retains its own licenses.checked 30 Sep 2026
- Limit: hardware and filesystem coverage
- A comparative research article reports possible hardware or distribution conflicts, difficulties for newcomers and weaker performance with specialized or uncommon filesystems and extensions.checked 15 Oct 2026
- Limit: installation complexity
- LinuxInsider reported quirky hard-drive installation, UEFI setup workarounds and difficulty configuring swap.checked 15 Oct 2026
Where it runs
- Limit: Linux expertise
- LinuxInsider said obtaining write access requires terminal commands and technical-document reading for less experienced users.checked 15 Oct 2026
Alternatives to CAINE
- 1
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 2
Plaso
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 3
Paraben E3 Forensic Platform
AndroidiOSLinuxmacOS7.1From $699 a year - 4
OSForensics
Free planAndroidSelf-hostedWindows7.0From $945 a year - 5
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time - 6
ADF Triage-G2
AndroidiOSLinuxmacOS6.8