CAINE (Computer Aided Investigative Environment)

CAINE is built around digital forensics specifically -- disk imaging, evidence acquisition, and analysis -- with particular attention to write-blocking (preventing any accidental modification of the evidence being examined) and maintaining a clear, defensible chain of custody, both essential requirements in forensics work intended to hold up in a legal proceeding. It ties its bundled forensic tools together under one consistent graphical interface rather than leaving investigators to juggle many separate command-line utilities, and it's used both by law-enforcement/forensics professionals and in university digital-forensics courses. It occupies a more specifically legal/evidentiary niche than a broader penetration-testing distribution like Kali, whose default assumptions (actively probing and sometimes modifying a target system) run directly counter to forensic evidence-preservation requirements.