Table of Contents
Hello learners, in this guide I will be showing you how you can install Caine forensic operating system as a virtual machine. The full meaning of the word CAINE is Computer Aided Investigative Environment. Caine OS has built in tools used by forensic investigators in their day to day duties and also has tight security measures. It is built for use as a live CD for a forensic investigator to be able to use all forensic tools i.e. Image acquisition tools, but we will install Caine OS in virtual box.
The process to install Caine OS on virtual box is similar to that of installing any other Linux distribution on virtual environment but with Caine OS we first have to boot it as Live CD then run the installer.
Features of CAINE OS
- Has write blocker technology – Using the write blocker technology, Caine OS mounts the host devices as read only. This is to ensure that the digital evidence is not tampered with during the forensic acquisition of a host to be investigated.
- It has a user friendly graphical interface – Caine OS introduced a graphical user interphase with instructions which guide the investigators as they go about the acquisition and analysis of any digital evidence.
- It partially automates the process of compiling the final report – partial automation of report compilation by Caine OS.
- It is built to be booted from a flash drive – It is easy for a forensic investigator to install Caine OS, carry and use it for evidence acquisition from the scene of crime.
- When used in live mode, Caine OS can operate on storage data objects to acquire digital evidence without having to boot the operating system hence avoiding tampering with the evidence.
- Caine OS provides all the required forensic tools for each investigation stage under one roof. i.e. collection, analysis and examination.
- PC running on either windows or Kali Linux.
- Have a 2 GHz processor or above to install Caine OS.
- Have a virtualization tool on which we will install Caine. (You can use virtual box or VMware)
- Have at least 2 GB of RAM.
- Have at least 30 GB of storage space.
Having familiarized with Caine we can now jump right into our guide on how to do it.
Step 1: Creating Caine OS virtual machine
On our first step to install Caine OS we will create a virtual machine with the system specifications named on the pre-requisites section. In this guide we are using Oracle virtual box.
As shown on the image above, the first step to create a virtual machine is to provide a name for the virtual machine, the machine folder, type of the OS to be installed and the version. After specifying we click Next.
On this screen we will specify the amount of RAM to be allocated to our new Virtual machine. As we indicated on our pre-requisites we will allocate a RAM of 2 GB and click Next.
On the next screen we will be creating a new virtual hard disk on which we will install Caine OS. After finishing you can click Create in order to create virtual hard disk.
The next step is to specify the hard disk file type we will be using for our virtual machine. Since we are not using Caine OS with other virtualization software, we can leave it as it is and click Next.
We now have to select the type of storage on physical hard disk. If you will be using Caine OS on virtual machine for forensic investigation, you should use dynamically allocated hard disk. In this guide we will be using a fixed size since we will not be adding large files for forensic analysis. After selecting fixed size, we click Next.
On this screen we will specify the the size of our virtual hard disk which will be set on the physical hard disk. We also haver to specify the location we want our virtual hard disk file to be stored. After adjusting we click Create. Now the virtual machine is ready for us to install Caine operating system.
Step 2: Install Caine OS
In the first step, we set up the virtual machine specifications. In this step we will install Caine OS on the virtual machine. We start our virtual machine and specify the Caine installation image location on the PC as shown on the screen below and start the virtual machine.
The next step is to screen to select the mode we want to boot Caine OS as shown on the below screen. We will Caine OS in live mode. In case you see a command prompt just type in “startx”.
By default, Caine boots with a screen size of 800x600. You can adjust it to full screen size.
Step 3: Unlock virtual disk
In our third step we will now install Caine on the virtual hard disk hence e need to unlock our virtual hard disk using UnBlock tool which is located on the desktop. On the image shown below.
We have to select the storage on which we want to install Caine OS. We will use the virtual hard disk we just created in the preceding step and click Ok.
After we have mounted the disk we are now ready to run the installation tool found on the Desktop folder of Caine OS.
After the installation tool is run, it will take you through the normal installation process: selecting the language and the disk to install Caine OS. We also select to erase and install Caine OS as shown on image below.
Step 4: Set username and password
On the next screen we screen set the user name and the password.
After providing all the required information to create a user, we click next and wait for the installation to complete so that we can restart the virtual machine on which we install Caine OS. We can now comfortably use our installed Caine OS right from the virtual box.
In the above guide we were able to install Caine OS version 11.0 on a virtual machine. From the virtual machine, an investigator is able to run his/her forensic analysis using the tools found in Caine OS. The operating system is built for use as a live CD but can also be installed as a virtual machine. Caine OS is preferred in the field of digital forensic for it has many of the tools a forensic investigator would need through out his/her job and the tools have user guides to help investigators while using Caine OS. Using this guide, you will be able to setup a forensic analysis lab using virtual box and Caine OS.