Helix3
Helix3 is a family of forensic Live CD distributions built on top of Ubuntu, released by e-fense.
Helix3
Helix3 is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics.
According to Helix3 Support Forum, e-fense is no longer planning on updating the free version of Helix.
Tools Included
Helix focuses on Incident Response and forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and forensic techniques.
Bootable Side
and others.
Windows Side
- FTK Imager
- IRCR
- mdd
- WFT
- win32dd
- winen
and others.
Windows side can be used to scan for pictures on a live system.
Forensic Issues
- Helix3 will automount ext3 and ext4 file systems during the boot process and recover them if required (bug in initrd scripts);
- Helix3 can automount some storage devices like firewire devices and MMC in read/write mode;
- Helix3 relies on file system drivers to provide write protection, mounting some file system types (e.g. XFS will result in several data writes to the original media.
Helix3 Pro
Helix3 Pro is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics.
Tools Included
Open source forensic tools include:
- dc3dd
- aimage
- The Sleuth Kit (3.0.1, with "light" version of Autopsy, with libewf
- foremost
- Volatility
- Several tools for mobile phone forensics
Other tools include:
Forensic Issues
- Helix3 Pro can automount some storage devices like firewire devices and MMC in read/write mode;
- Helix3 Pro relies on file system drivers to provide write protection, mounting some file system types (e.g. XFS will result in several data writes to the original media.