- [Narrator] Let's go over a few examples
of tools and Linux distributions
that can be used for forensics.
One is the appliance for digital investigation and analysis,
otherwise known as ADIA.
It is basically a VM that is used
for digital investigation and acquisition
or data acquisition that is built entirely
from public domain software.
Now, it contains a lotta tools
like Autopsy, The Sleuth Kit,
the Digital Forensics Framework
and many others out there, you know.
Now, all these distributions
or VMs have been created for convenience, right?
They actually include the most popular tools
for, you know, forensics type of activities.
Now you can download ADIA
from the link that I'm sharing in the screen.
Another VM or distribution, if you wanna call it
that way, is the CAINE
or the Computer Aided Investigative Environment.
Now it contains tons of tools, just like ADIA,
and, you know, has been used, not only by digital forensics
for cyber security but also
in the law enforcement areas as well.
Now, you can download CAINE
from the link that I'm sharing here.
Now, Skadi is another tool
that is used to collect and parse data
that can be easily searchable
with built-in common searches and enables you
to manipulate multiple data sources
and hosts simultaneously.
You can actually download Skadi
from the link that I'm sharing here.
PALADIN is another Linux distribution
that has been used by many security researchers
in the industry for performing different
evidence collection tasks in a forensically-sound manner.
It includes many open source forensics tools
just like the other ones
and you can download it
from the link that I'm sharing in the screen.
Now, by far, one of the most popular Linux distributions
for defensive security and digital forensics
is Security Onion.
It has a lot of different tools
that you could actually use to collect data
from the network and analyze that data.
It actually comes with things
like the Elasticsearch, Logstash and Kibana,
otherwise known as the ELK stack,
and it can be downloaded from the github repository
that I'm sharing in the screen.
Now, the last one that I want to share with you
is the SIFT Workstation and SIFT stands
for SANS Investigative Forensics Toolkit Workstation
and basically has a lot of different incident response
and digital forensics tools that can be used,
you know, in day to day operation,
let's say, in a security operations center and so on.
You can download SIFT Workstation from the link
that I'm sharing in the screen.