Caine is a simple Ubuntu 18.04 customized for the computer forensics, all
you need to read is here (this is a collection of infos for the old caine releases) and the rest is:
The Beginner's Guide v4.92 NEW!
and all the single manuals of the tools (e.g. the Sleuthkit, Autopsy, Foremost,etc. etc.)
BEFORE TO INSTALL CAINE YOU HAVE TO UNLOCK THE DESTINATION DISK USING UNLOCK GUI (on Desktop) (sudo blockdev --setrw -/dev/sd*)
*** HERE IS A VIDEO TUTORIAL FOR CAINE 7.0 ***
HOW TO INSTALL CAINE - VIDEO
HOW TO INSTALL CAINE 8.0
HERE IS A CAINE 6.0 TUTORIAL IN ENGLISH
HERE IS A CAINE 7.0 TUTORIAL IN SPANISH
HERE IS HOW TO INSTALL WIN-UFO IN SPANISH
WIN-UFO doesn't exist anymore, because his developer has closed the website, so you cannot download it anymore.
Booting Caine via PXE by Hans Peter Merkel
CAINE 10.0 has been updated 18/Dec/2018 (Autopsy 4.9.1 updated)
CAINE 11.0 "Wormhole" 64bit - Official CAINE GNU/Linux distro latest release 01/Dec/2019.
The important news is that CAINE 11.0, 10.0, 9.0, 8.0 and 7.0 block all the block devices (e.g. /dev/sda), in Read-Only mode. You can use a tool with a GUI named UnBlock present on Caine's Desktop.
This new write-blocking method assures all disks are really preserved from accidentally writing operations, because they are locked in Read-Only mode.
INSTALLING CAINE: UnBlock (blockdev) put the device in WRITABLE mode -> use Ubiquity -> Choose System Install -> Choose user: CAINE password: CAINE host: CAINE -> Go!
Ubiquity is the installer, even if for old BIOS based computers, you need to run BootRepair after the end of Ubiquity!.
Then after the first boot, run Grub Customizer and put RW instead of RO in the boot menu.
After installing Caine on your HD, you have to edit the /usr/sbin/rbfstab, changing swapoff -a in swapon -a and the row swap) OPTIONS=ro,noauto ;; with swap) OPTIONS=rw,auto ;;, then reboot
Caine 11.0 is ready for USB pendrive.
If secureboot failed, try to disable it from UEFI.
If you want to create an hybrid image, try this:
isohybrid -u caine11.0.iso
For Caine up to 9.0 this is how to install: INSTALLING CAINE: UnBlock (blockdev) put the device in WRITABLE mode -> use SystemBack -> Choose System Install -> Choose user: caine password: caine host: caine -> check "transfer user configuration files" -> Go!
If you need to write a disk, you can unlock it with UnBlock or using "Mounter" changing the policy in writable mode.
For AUTOPSY issues see this SOLUTION
VirtualBox today (30/Oct/2016) doesn't work fine with CAINE 8.0 (VGA and connection issues). It's a problem of VirtualBox
You can solve it simply pressing ctrl+alt+F1 and then ctrl+alt+F7 and you get the desktop!
1. Mounting policy of CAINE
The mounting policy for any internal or external devices adopted by CAINE: never mount automatically any device and when the user clicks on the device icon the system will mount it in read only mode on loop device.
- A user cannot mount a device through the Disk Mounter applet, but only by Terminal Window or by Mounter (GUI) Mounter and the system will always mounted with the following options: ro,noatime,noexec,nosuid,nodev,noload.
For UMOUNTING a device you can use Caja by root (eg. gksudo Caja) or by terminal window (xterm or sudo umount) or Mounter GUI
General Information:
A green disk icon means the system is SAFE and will mount devices READ-ONLY on loop device.
A red disk icon means WARNING, mounted devices will be WRITEABLE.
Instructions:
Left-click the disk icon to mount a device.
Right-click the disk icon to change the system mount policy.
Middle-click will close the mounter application. Relaunch from the menu.
The mounted devices will not be affected by mount policy changes.
Only subsequent mounting operations will be affected.
In Caine 7.0 mounter can unlock and lock block devices in Read-Only mode.
- If the user decides to mount a device via terminal, he can use the “mount” command but all the mount options must be specified.
- If the user wants to mount and write on an NTFS media should instead use the "ntfs-3g" command (e.g., $ sudo ntfs-3g -o rw /dev/sda1 /media/sda1).
- sudo ntfs-3g -o rw /device-path /your-mount-point
You can redirect the output on an RW mounted device in these ways:
- Terminal window --> sudo su --> (eg. fdisk -lu > /media/sdb1/fdisk.txt)
- Terminal window --> output redirect in, for example: /home/caine, then sudo cp fdisk.txt /media/sdb1
- sudo bash -c "fdisk -lu > /media/sdb1/fdisk.txt"
The ext3 driver will be ignored when ext2 and ext3 partitions are mounted in the future and the ext2 driver used instead. This protects any ext3 partitions from a forensic point-of-view. Ext2 does not use journaling, so when an ext3 partition is mounted, there is no danger of modifying the meta-data when increasing the count inside said journal.
Applying a special patch (Maxim Suhanov's patch) we fixed the bug, that changed the journal of the ext3/ext4 file system, when the computer was switch off not using the shutdown procedure. Fixed in the fstab: forbidding the auto-mounting of the MMCs and put a control for the "esotic names" like /dev/sdad1
Bash Scripts Tools directory:
the tools MUST be launched by sudo sh script_name.sh
2. Live USB pendrive creation
You can create Live USB (NOT PERSISTENT) using RUFUS.
ONLY for Caine 4.0 and its previous releases, you cannot create LiveUSB Caine from this distro, you have to DOWNLOAD NBCaine from Caine's website to get it! () OR if you need CAINE on pendrive (USB), you can sobstitute the file /usr/share/initramfs-tools/scripts/casper with THIS and use your preferred tool for making it.
3. Installing Caine
First of all here is a good guide (in spanish)-Thanks to Alonso Eduardo Caballero Quezada
HERE IS A GUIDE IN ENGLISH: http://first-response.co.uk/blog/caine-6-0-dark-matter-installation-tutorial/
INSTALLING CAINE: use SYSTEMBACK -> Choose System Install -> Choose user: caine password: caine host: caine -> check "transfer user configuration files" -> Go!
For installing Caine 6.0 in UEFI mode, you have to make a little partition in Vfat (approx.100Mb) for the mount point /boot/efi, then you can install all the system in the mount point "/".
After installing Caine on your HD, you have to edit the /usr/sbin/rbfstab, changing swapoff -a in swapon -a and the row swap) OPTIONS=ro,noauto ;; with swap) OPTIONS=rw,auto ;;, then reboot
For Caine 6.0, the SystemBack installer present can't set SWAP partition, so you can install Caine without the swap partition, if you need to create and activate the swap, you can do it after installation using gparted (booting from a live distro) and editing /etc/fstab file or before installing Caine, upgrade SystemBack.
4. Language Support
FOR previous releases of Caine 4.0: The CAINE report supports the following languages: English, Italian, French, German and Portuguese. The translations of report template in French and German were kindly made by Guy Vucken, developer of Guymager, who previously cooperate with the team to integrate his forensic software inside CAINE. The Portuguese translation has been gently provided by Tony Rodrigues a portuguese Digital and Computer Forensics expert. Turkish thanks to Burkay Sucu.
We hope to increase the number of translations in the future. If you wish to participate by providing the translation of the report in your language or if you report a translation mistake, please contact the CAINE team.
CAINE Live CD uses the USA keyboard layout. We suggest to change the layout using the program “Keyboard Preferences” in System -> Preferences, in the GNOME menu or using the command “sudo setxkbmap -layout xy” (xy = “it”, “gb”, “de”...) in the command line. BTW there is a launcher on the desktop.
In the CAINE TEXT MODE only, change the keyboard layout by "sudo loadkeys xy" (xy = “it”, “gb”, “de”...)
4. CAINE building
CAINE Distro has been realized from Ubuntu Linux 14.04 using SystemBack by Krisztián Kende.
