Distributions in this category
How to choose
Incident response environments support triage, evidence collection, timeline reconstruction and the analysis of suspicious systems after a security event. Choose the image format for the job: a live system can help examine hardware without installing software, while an OVA or other virtual appliance is easier to isolate, snapshot and repeat. Preserve original evidence by analysing verified copies, recording hashes and time zones, and using read-only access where appropriate. Keep untrusted files away from normal workstations and networks. These tools assist an investigation, but documented handling procedures are still required to maintain traceability. Follow the affected organisation response plan and obtain the necessary authorisation before collecting or examining data. Compare the project documentation, image format and supported installation method before selecting an environment.
Download only from the project or an official mirror and check the SHA-256 checksum before installing. Verify a checksum · Compare distributions