Difference between revisions of "CAINE Live CD"

From ForensicsWiki
Jump to: navigation, search
m
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
{{Infobox_Software |
 
{{Infobox_Software |
   name = CAINE Live CD |
+
   name = CAINE LiveCD/DVD |
   maintainer = [[CAINE Project]] |
+
   maintainer = [[Nanni Bassetti]] |
 
   os = {{Linux}} |
 
   os = {{Linux}} |
 
   genre = {{Live CD}} |
 
   genre = {{Live CD}} |
 
   license = {{GPL}}, others |
 
   license = {{GPL}}, others |
   website = http://www.caine-live.net/ |
+
   website = [http://www.caine-live.net Caine Live] |
 
}}
 
}}
 +
'' ''' Caine (an acronym for Computer Aided Investigative Environment'''') is a [[distribution Linux | distribution]] [[Live CD | live]] oriented to Computer Forensics ([[computer forensics]]) historically conceived by Giancarlo Giustini, within a project of Digital Forensics '' Interdepartmental Research Center for Security'' (CRIS) of the University of Modena and Reggio Emilia  see [http://www.caine-live.net/page4/history.html Official Site].
 +
Currently the project is maintained by Nanni Bassetti.
  
'''CAINE Live CD''' (Computer Aided Investigative Environment) is a forensic [[Linux]] [[Live CD]] based on [[Ubuntu]].
+
== Features ==
== CAINE 2.0 ==
+
The latest version of Caine is based on the [[Ubuntu Linux]] 12.04 LTS, MATE and LightDM. Compared to its original version, the current version has been modified to meet the standards forensic reliability and safety standards laid down by the [[NIST]] View [Http://www.cftt.nist.gov/Methodology_Overview.htm the methodologies of Nist].
  
September 2010
+
Caine includes:
 +
* Caine Interface - a user-friendly interface that brings together a number of well-known forensic tools, many of which are open source;
 +
* Updated and optimized environment to conduct a forensic analysis;
 +
* Report generator semi-automatic, by which the investigator has a document easily editable and exportable with a summary of the activities;
 +
* Adherence to the investigative procedure defined recently by Italian Law 48/2008, [Http://www.parlamento.it/parlam/leggi/08048l.htm Law 48/2008,].
  
<pre>
+
In addition, Caine is the first distribution to include forensic Forensics inside the Caja/Nautilus Scripts and all the patches of security for not to alter the devices in analysis.
CHANGELOG CAINE 2.0 "NewLight"
+
  
Kernel 2.6.32-24
+
The distro uses several patches specifically constructed to make the system "forensic", ie not alter the original device to be tested and / or duplicate:
 +
* Root file system spoofing: patch that prevents tampering with the source device;
 +
* No automatic recovery corrupted Journal patch: patch that prevents tampering with the device source, through the recovery of the [[Journal]];
 +
* Mounter and RBFstab: mounting devices in a simple and via graphical interface.
  
ADDED:
+
[[RBFstab]] is set to treat [[EXT3]] as a [[EXT4]]'' noload with the option'' to avoid automatic recovery of any corrupt Journal of '[[EXT3]];
Air 2.0.0
+
* Swap file off: patch that avoids modifying the file [[swap]] in systems with limited memory [[RAM]], avoiding the alteration of the original artifact computer and overwrite data useful for the purposes of investigation.
MountManager
+
Disk Utility
+
Storage Device Manager
+
SSdeep
+
ByteInvestigator
+
DMIdecode
+
HDSentinel
+
WVSummary
+
Read_open_Xml
+
Fiwalk
+
Bulk Extractor
+
Log2Timeline
+
Midnight Commander
+
SQLJuicer
+
CDFS 2.6.27
+
Nautilus Scripts
+
Fake Casper patch
+
Manual updated
+
</pre>
+
  
 +
Caine and Open Source == ==
 +
Patches and technical solutions are and have been all made in collaboration with people (Professionals, hobbyists, experts,
 +
etc..) from all over the world. <br />
  
'''Live Preview Nautilus Scripts'''
+
CAINE represents fully the spirit of the Open Source philosophy, because the project is completely open, anyone could
CAINE includes scripts activated within the Nautilus web browser designed to make examination of allocated files simple. Currently, the scripts can render many databases, internet histories, Windows registries, deleted files, and extract EXIF data to text files for easy examination. The Quick View tool automates this process by determining the file type and rendering with the appropriate tool.
+
take the legacy of the previous developer or project manager. <br />
The live preview Nautilus scripts also provide easy access to administrative functions, such as making an attached device writeable, dropping to the shell, or opening a Nautilus window with administrator privileges. The "Save as Evidence" script will write the selected file(s) to an "Evidence" folder on the desktop and create a text report about the file containing file metadata and an investigator comment, if desired.
+
A unique script, "Identify iPod Owner", is included in the toolset. This script will detect an attached and mounted iPod Device, display metadata about the device (current username, device serial number, etc.). The investigator has the option to search allocated media files and unallocated space for iTunes user information present in media purchased through the Apple iTunes store, i.e., Real Name and email address.
+
The live preview scripts are a work in progress. Many more scripts are possible as are improvements to the existing scripts. The CAINE developers welcome feature requests, bug reports, and critiques.
+
The preview scripts were born of a desire to make evidence extraction simple for any investigator with basic computer skills. They allow the investigator to get basic evidence to support the investigation without the need of advanced computer forensics training or waiting upon a computer forensics lab. Computer forensics labs can used the scripts for device triage and the remainder of the CAINE toolset for a full forensic examination!
+
by John Lehr
+
------------------------------------------
+
'''CASPER PATCH (not for NBCaine 2.0)'''
+
The patch changes the way how Casper searches for the boot media. By default, Casper will look at hard disk drives, CD/DVD-drives and some other devices while booting the system (during the stage when system tries to find the boot media with correct root file system image on it - because common bootloaders do not pass any data about media used for booting to an operating system in Live CD configurations). Our patch is implemented for CD/DVD versions of CAINE and enables CD/DVD-only checks in Casper. This solves the bug when Casper would select and boot fake root file system images on evidentiary media (hard disk drives, etc). ---
+
by Suhanov Maxim
+
  
 +
The distro is open source, the Windows side (Nirlauncher/Wintaylor) is open source and, last one but not least important, the distro is installable, so as to give the possibility to rebuild in a new version, in order to give a long life to this project.
  
 +
== Caine Interface ==
 +
Caine Interface - a user-friendly interface that brings together a number of well-known forensic tools. <Br/>
  
== CAINE 1.5 ==
+
Environment updated and optimized for digital investigations. <br />
As of December 2009, the current version of [http://www.caine-live.net/ Caine] is 1.5. According to documentation, it is based on [http://releases.ubuntu.com/8.04/ Ubuntu 8.04]. Unlike the [[Helix]] project, Caine is free, freely redistributable, and open-source. CAINE 1.5 supports the Oxford 934dsb SATA chipset, used in (among other devices) the Voyager Q SATA dock from Newer Technologies.
+
  
== Forensic Issues ==
+
Report Semi-automatic - the final production of a complete document and easily editable exported by the investigator.
 +
Maximum adherence to the Italian investigative procedure. <br />
  
* CAINE Live CD versions before 1.0 will automount [[Ext3]] file systems during the boot process and recover them if required (bug in ''initrd'' scripts);
+
The first distribution to include forensic inside the Caja Forensics / Nautilus/Caja Scripts and all security patches, not to alter the devices in the analysis. <br />
* '''CAINE Live CD version 1.0 introduced new mounting policies''':
+
  
- The mounting policy for any internal or external devices adopted by CAINE: never mount automatically any device and when the user clicks on the device icon the system will mount it in read-only mode on a read-only loopback device.
+
The basic interface of the distribution called Caine Interface, was performed using the known GTK2-Perl wrapper that implements the Perl language instruction set and commands made available from the Gtk + toolkit.
  
- If a user decides to mount a device via terminal, he can use the “mount” command but all the mount options must be specified.
+
Caine Interface allows you not only to select the various forensic software, it automatically generates the final report, due to the modules offered by Perl Template Toolkit, and DocBook.
  
- The ext3 driver will be ignored when ext3 file systems are mounted and the ext2 driver used instead. This protects any ext3 file systems from a forensic point-of-view. Ext2 does not use journaling, so when an ext3 file system is mounted, there is no danger of modifying the journal metadata.
+
Inside contains the following software.
  
- By applying a special patch CAINE team fixed the bug that changed the journal of the ext3 file systems when the computer was switched off by pulling the plug.
+
, Acquisition
 +
* Grissom Analyzer (mmls, img_stat, fsstat)
 +
* LRRP
 +
* AIR
 +
* Guymager
 +
* Terminal with saving the output
 +
* DC3DD
  
- Fixed in the fstab: forbidding the auto-mounting of the MMCs and put a control for the "exotic names" like /dev/sdad1.
+
; Analysis
 +
* Autopsy
 +
* [[The SleuthKit]]
 +
* [[Selective file dumper | Sfdumper 2.2]]
 +
* Fundl 2.0
 +
* Scalpel
 +
* Foremost
 +
* Stegdetect
 +
* Ophcrack
 +
* Nautilus scripts
 +
* And many others
  
- If the user wants to mount and write on an NTFS media should instead use the "ntfs-3g" command (e.g., $ sudo ntfs-3g /dev/sda1 /media/sda1).
+
Reporting semiautomatic == ==
  
    # ntfs-3g /device-path /your-mount-point
+
Every contribution in the form of output and local report for each program involved in an investigation is saved in a report file, easily manageable by the investigator. The generation of the final report is done through the creation of temporary log file, that is to contain the output products for implementing the programs used by the investigator. <br />
 +
The generation process is achieved through the use of Perl, bash scripts, variables Perl Template Toolkit and the DocBook file that acts as a container to the final report. <br />
  
== External Links ==
+
All set within the Perl program.
* [http://www.caine-live.net/ Project website]
+
 
 +
The Project Caine == ==
 +
 
 +
The project was initially inserted into the priorities of the CRIS (Centre for Research Interdepartmental Security) Research Centre Interpardimentale Security - University of Modena [http://cris.unimore.it/cris/node/54 site], in this way the distribution has benefited from essential contributions on the technical computing, together to the latest "best practices" legal investigation digital  see [http://www.dia.unisa.it/~ads/ads/Sicurezza_files/Tesina%20Live%20Forensics.pdf Security University of Salerno] see [http://www.forwardedge2.com/pdf/bestpractices.pdf U.S. Secret Service document] see [http://ncfs.org/craiger.forensics.methods.procedures.final.pdf CraigeR's Draft].
 +
 
 +
The project Caine was also the subject of a scientific paper accepted and published inside the first Workshop on Computer & Network Forensics held in Milan September 10th 2008 - [http://conferenze.dei.polimi.it/ossconf/schedule.php OSSCoNF].
 +
 
 +
In followed all close collaboration with Denis Frati (spilled by the project at end 2009) and Nanni Bassetti, prominent figures in the panorama of Italian Digital Forensics, allowed a constant improvement of investigative standards proposed. The work carried out together with the staff ConoscereLinux allowed to enter Caine within the Italian community of programmers of open-source software.
 +
 
 +
Caine is very much the spirit of Open Source OSSConf 2008 Open Source Day 2012, precisely because the various inputs planning and operational were provided by so many employees scattered across the globe, using only the network to communicate and many have our utmost to provide hosting, mirror and suggestions, scripts and everything that can serve to improve the project, then a full and free.
 +
 
 +
Currently the project manager and a team of international figures treat the project Caine since the 1.0 release to date that has arrived at version 4.0 (18-March-2013) and achieving praise from law enforcements of several foreign nations.
 +
 
 +
24/11/2012 The Caine 3.0 was presented at '[http://www.opensourceday.org/2012/?mid=20 Opens Source Day 2012]' at the University of Udine.
 +
 
 +
== Notes ==
 +
<references />
 +
 
 +
== Bibliography ==
 +
* Andrea Ghirardini, Gabriele Faggioli, ''Computer Forensics'', Apogeo, 2009, ISBN 9788850328161
 +
* E. Huebner, S. Zanero, ''Open Source Software for Digital Forensics'', Springer, 2010, ISBN 978-1-4419-5802-0
 +
* Diane Barrett, Greg Kipper, ''Virtualization and Forensics: A Digital Forensic Investigator's Guide to Virtual Environment'', Syngress, 2010, ISBN 978-1-59749-557-8
 +
* Sean Philip Oriyano and Michael Gregg, ''Hacker Techniques, Tools, And Incident Handling'', Jones and Bartlett Learning, 2011, ISBN 978-0-7637-9183-4
 +
* Michael Jang, ''Security Strategies in Linux Platforms and Applications'', Jones and Bartlett Learning, 2011, ISBN 978-0-7637-9189-6
 +
 
 +
== External links ==
 +
*[http://www.careeracademy.com/browseproducts/CHFI-Training-CBT-Boot-Camp--EC-Council-Computer-Hacking-Forensic-Investigator.HTML Presente nel training CHFI Ec-Council] International certificatione
 +
*[http://link.springer.com/chapter/10.1007/978-1-4419-5803-7_5 Open Source Live Distributions for Computer Forensics- by Springer]<br />
 +
*[http://conferenze.dei.polimi.it/ossconf/schedule.php OSSConf 2008]<br />
 +
*[http://books.google.it/books?id=jQVgWaF3pJwC&pg=PT304&lpg=PT304&dq=Andrea+Ghirardini;+Gabriele+Faggioli,+Computer+Forensics+caine&source=bl&ots=mf8-Def6uF&sig=88ydFgTv05M2Q45B4FSvwqhBXKk&hl=it&sa=X&ei=W2voUOD3Lcrk4QSVlIDoDQ&ved=0CEMQ6AEwAQ Google books]<br />
 +
*[http://www.amazon.com/Virtualization-Forensics-Forensic-Investigators-Environments/dp/1597495573Virtualization and Forensics: A Digital Forensic Investigator's Guide to Virtual Environment]<br />
 +
*[http://www.linux-magazin.de/Ausgaben/2010/12/Italienische-Aufklaerung Linux-Mazin.de]<br />
 +
*[http://www.linux-magazine.com/Issues/2011/122/Caine Linux-Magazine.com]<br />
 +
*[http://www.opensourceday.org/2012/?mid=20 Opens Source Day 2012]<br />
 +
*[http://searchsecurity.techtarget.it/articoli/0,1254,18_ART_103282,00.html TechTarget.it]<br />
 +
*[http://programmazione.it/index.php?entity=eitem&idItem=41687 Programmazione.it]<br />
 +
*[http://www.linuxtoday.com/upload/caine-3.0-review-121009195504.html Linuxtoday.com]<br />
 +
*[http://www.linuxtoday.com/infrastructure/2010122801535SCSW Linuxtoday.com 2]<br />
 +
*[http://news.softpedia.com/news/CAINE-3-0-a-Tool-for-Digital-Forensics-297461.shtml Softpedia]<br />
 +
*[http://hackingzones.in/?p=2726 hackingzone.in]<br />
 +
*[http://www.gustavopimentel.com.ar/ gustavopimental.com.ar]<br />
 +
*[http://www.concise-courses.com/security/top-ten-distros/# concise-courses.com]<br />
 +
*[http://www.e-linux.it/news_detail/caine-15 e-linux.it]<br />
 +
*[http://www.ilsoftware.it/articoli.asp?tag=CAINE-progetto-italiano-per-la-computer-forensics_5656 ilsoftware.it]<br />
 +
*[http://www.dragonjar.org/distribucion-live-cd-analisis-forense.xhtml dragonjar.org]<br />
 +
*[http://www.nannibassetti.com/dblog/articolo.asp?articolo=156 Attestato Marenostrum V.F.F.]<br />
 +
*[http://www.linuxformat.com/archives?issue=151 LinuxFormat] <br />
 +
*[http://www.techrepublic.com/blog/10things/10-obscure-linux-distributions-and-why-you-should-know-about-them/2334 TechRepublic]<br />
 +
*[http://www.forensicswiki.org/wiki/CAINE_Live_CD ForensicsWiki]<br />
 +
* [http://www.caine-live.net Sito ufficiale]
 +
* [http://cris.unimore.it/cris/node/54 Sito del CRIS] dedicato a Caine
 +
 
 +
{{Linux}}

Revision as of 06:16, 4 May 2013

CAINE LiveCD/DVD
Maintainer: Nanni Bassetti
OS: Linux
Genre: Live CD
License: GPL, others
Website: Caine Live

Caine (an acronym for Computer Aided Investigative Environment') is a distribution live oriented to Computer Forensics (computer forensics) historically conceived by Giancarlo Giustini, within a project of Digital Forensics Interdepartmental Research Center for Security (CRIS) of the University of Modena and Reggio Emilia see Official Site. Currently the project is maintained by Nanni Bassetti.

Features

The latest version of Caine is based on the Ubuntu Linux 12.04 LTS, MATE and LightDM. Compared to its original version, the current version has been modified to meet the standards forensic reliability and safety standards laid down by the NIST View the methodologies of Nist.

Caine includes:

  • Caine Interface - a user-friendly interface that brings together a number of well-known forensic tools, many of which are open source;
  • Updated and optimized environment to conduct a forensic analysis;
  • Report generator semi-automatic, by which the investigator has a document easily editable and exportable with a summary of the activities;
  • Adherence to the investigative procedure defined recently by Italian Law 48/2008, Law 48/2008,.

In addition, Caine is the first distribution to include forensic Forensics inside the Caja/Nautilus Scripts and all the patches of security for not to alter the devices in analysis.

The distro uses several patches specifically constructed to make the system "forensic", ie not alter the original device to be tested and / or duplicate:

  • Root file system spoofing: patch that prevents tampering with the source device;
  • No automatic recovery corrupted Journal patch: patch that prevents tampering with the device source, through the recovery of the Journal;
  • Mounter and RBFstab: mounting devices in a simple and via graphical interface.

RBFstab is set to treat EXT3 as a EXT4 noload with the option to avoid automatic recovery of any corrupt Journal of 'EXT3;

  • Swap file off: patch that avoids modifying the file swap in systems with limited memory RAM, avoiding the alteration of the original artifact computer and overwrite data useful for the purposes of investigation.

Caine and Open Source == == Patches and technical solutions are and have been all made in collaboration with people (Professionals, hobbyists, experts, etc..) from all over the world.

CAINE represents fully the spirit of the Open Source philosophy, because the project is completely open, anyone could take the legacy of the previous developer or project manager.

The distro is open source, the Windows side (Nirlauncher/Wintaylor) is open source and, last one but not least important, the distro is installable, so as to give the possibility to rebuild in a new version, in order to give a long life to this project.

Caine Interface

Caine Interface - a user-friendly interface that brings together a number of well-known forensic tools.

Environment updated and optimized for digital investigations.

Report Semi-automatic - the final production of a complete document and easily editable exported by the investigator. Maximum adherence to the Italian investigative procedure.

The first distribution to include forensic inside the Caja Forensics / Nautilus/Caja Scripts and all security patches, not to alter the devices in the analysis.

The basic interface of the distribution called Caine Interface, was performed using the known GTK2-Perl wrapper that implements the Perl language instruction set and commands made available from the Gtk + toolkit.

Caine Interface allows you not only to select the various forensic software, it automatically generates the final report, due to the modules offered by Perl Template Toolkit, and DocBook.

Inside contains the following software.

, Acquisition

  • Grissom Analyzer (mmls, img_stat, fsstat)
  • LRRP
  • AIR
  • Guymager
  • Terminal with saving the output
  • DC3DD
Analysis

Reporting semiautomatic == ==

Every contribution in the form of output and local report for each program involved in an investigation is saved in a report file, easily manageable by the investigator. The generation of the final report is done through the creation of temporary log file, that is to contain the output products for implementing the programs used by the investigator.
The generation process is achieved through the use of Perl, bash scripts, variables Perl Template Toolkit and the DocBook file that acts as a container to the final report.

All set within the Perl program.

The Project Caine == ==

The project was initially inserted into the priorities of the CRIS (Centre for Research Interdepartmental Security) Research Centre Interpardimentale Security - University of Modena site, in this way the distribution has benefited from essential contributions on the technical computing, together to the latest "best practices" legal investigation digital see Security University of Salerno see U.S. Secret Service document see CraigeR's Draft.

The project Caine was also the subject of a scientific paper accepted and published inside the first Workshop on Computer & Network Forensics held in Milan September 10th 2008 - OSSCoNF.

In followed all close collaboration with Denis Frati (spilled by the project at end 2009) and Nanni Bassetti, prominent figures in the panorama of Italian Digital Forensics, allowed a constant improvement of investigative standards proposed. The work carried out together with the staff ConoscereLinux allowed to enter Caine within the Italian community of programmers of open-source software.

Caine is very much the spirit of Open Source OSSConf 2008 Open Source Day 2012, precisely because the various inputs planning and operational were provided by so many employees scattered across the globe, using only the network to communicate and many have our utmost to provide hosting, mirror and suggestions, scripts and everything that can serve to improve the project, then a full and free.

Currently the project manager and a team of international figures treat the project Caine since the 1.0 release to date that has arrived at version 4.0 (18-March-2013) and achieving praise from law enforcements of several foreign nations.

24/11/2012 The Caine 3.0 was presented at 'Opens Source Day 2012' at the University of Udine.

Notes

<references />

Bibliography

  • Andrea Ghirardini, Gabriele Faggioli, Computer Forensics, Apogeo, 2009, ISBN 9788850328161
  • E. Huebner, S. Zanero, Open Source Software for Digital Forensics, Springer, 2010, ISBN 978-1-4419-5802-0
  • Diane Barrett, Greg Kipper, Virtualization and Forensics: A Digital Forensic Investigator's Guide to Virtual Environment, Syngress, 2010, ISBN 978-1-59749-557-8
  • Sean Philip Oriyano and Michael Gregg, Hacker Techniques, Tools, And Incident Handling, Jones and Bartlett Learning, 2011, ISBN 978-0-7637-9183-4
  • Michael Jang, Security Strategies in Linux Platforms and Applications, Jones and Bartlett Learning, 2011, ISBN 978-0-7637-9189-6

External links