Cado Live

Cado Live is a tool that was designed to help examiners handle forensic data more efficiently. The tool comes packaged as an .iso file, which allows them to mount it on a system in order to investigate it. Thanks to cloud-syncing integration, the forensic data can be stored on the cloud: solutions from Google, Azure, and Amazon are supported, but storing locally — on a USB, for example — works, too.

As this is an .iso file, creating a bootable USB disk is the way to use this. You can do so through Rufus without a worry, and after that, you'll be able to insert the USB stick into a machine that you want the forensic data of.

The bootable disk will be recognized by the computer, and you'll boot up into the interface right away — it's best to select booting into the GUI. Thereafter, navigate to CadoImager, and enter your settings: you'll have to select the disk you want to image, then the upload destination. If you want to upload to the cloud, you'll need to create secure credentials for the service you're using.

Tweaking the way in which data is processed is also an option: you can compress it, show detailed logging, as well as generate MD5 and SHA256 hashes. Case and evidence identifiers can be added as optional details, in order to provide more about the imaging.

The acquisition will then proceed, and you'll be able to view the data after completion: either from your local storage, or the cloud service of your choosing.