CAINE 9.0 Linux Helps Investigators With Computer Security Forensics

While there are many security-focused Linux distributions on the market, one distribution distinguishes itself by targeting forensic investigators. Instead of penetration testing tools, CAINE—which is an acronym for Computer Aided INvestigative Environment and was updated to version 9.0 on Oct. 25—is loaded with applications and tools to help investigators find the clues and data points that are required for computer security forensics. Among the tools that are included in the CAINE 9.0 Quantum release are memory, database and network analysis applications. One such new tool is RegRipper, which enables researchers to extract and parse information from an operating system registry. In this slide show, eWEEK examines this and other key features of CAINE 9.

At the core of CAINE 9.0 is an Ubuntu 16.04 base operating system, using the MATE open-source Linux desktop.

Among the new tools added to CAINE 9.0 is the open-source RegRipper forensic software application. RegRipper enables security researchers to extract and parse information from the Windows registry for further analysis.

The Harvester tool collects information about domains and email accounts by examining different public sources.

As part of security reconnaissance, researchers often want and need to collect as much information as possible, including information from social media sources. The Tinfoleak tool helps to collect information and attributes about Twitter users.

Another new tool in CAINE 9 that helps security researchers with reconnaissance activities is infoga, which collects information from a given target domain.

The VolDiff tool assists researchers with malware memory footprint analysis. VolDiff makes use of the open-source Volatility framework.

CAINE 9.0 also includes the Autopsy Forensic Browser, which is a graphical interface to the Sleuth Kit’s command line filesystem analysis tools.