PALADIN is SUMURI's bootable Linux environment for forensic imaging, triage and recovery. It still works and is maintained: the PALADIN product page names 9.4.2 as the current release, built on Ubuntu 24.04 LTS with a Linux 6.17 live kernel. The 9 LTS build blocks changes to attached media and disables auto-mounting at boot, and it bundles Autopsy and The Sleuth Kit next to SUMURI's PALADIN Toolbox.
The common reasons to look elsewhere are cost rules and coverage. Downloads go through a SUMURI account, and companies must donate at least $25, which some purchasing teams treat as a vendor purchase. Apple Silicon and T2 Macs are outside what the free edition handles. And some examiners would rather image from Windows or build their own Linux stick. Each pick below solves one of those, starting with the free live systems most PALADIN users move to.
Wireshark and ProDiscover are not on this list, since neither boots a machine or images a disk.
Prices below are as of November 6, 2026. Our method is on How we review tools.
Quick comparison
| Tool | Best for | Price | Platforms |
|---|---|---|---|
| CAINE | Free live boot with every disk read-only | Free (LGPL) | Live USB/DVD, UEFI and BIOS |
| Guymager | A free GUI imager for your own Linux stick | Free, open source | Linux |
| Tsurugi Linux | A lightweight acquisition build plus a lab VM | Free | Live ISO, VM, 32-bit Acquire edition |
| FTK Imager | Imaging from a Windows workstation | Free; Pro $499 per user per year | Windows |
| SIFT Workstation | Analysing the image after acquisition | Free | Ubuntu VM or install, WSL |
| RECON ITR | Apple Silicon and T2 Macs | From $1,295, annual subscription | Boots on Macs; includes PALADIN PRO |
| Kali Linux (forensic mode) | Teams that already carry a Kali stick | Free | Live USB, VM, install |
| Magnet Acquire | Drives plus phones with known passcodes | Free on request | Desktop app |
CAINE
CAINE does the same core job as PALADIN at no cost to anyone, companies included. Version 14.0, LIGHTSTREAM, came out on March 24, 2025 on 64-bit Ubuntu 24.04 and boots on UEFI and legacy BIOS machines, per the CAINE home page.
Write protection is handled the PALADIN way, in software. CAINE 14.0 sets every block device, such as /dev/sda, to read-only, and the UnBlock tool makes a single destination drive writable. It also carries WinTaylor, a freeware Windows toolkit you can run from the same disc on a live Windows system.
Best for: Corporate examiners who want a write-blocked boot disk with no donation or account step.
Pricing:
- Free; CAINE and WinTaylor are LGPL 2.1 or later
- Third-party tools keep their own licences
Watch out for:
- Secure Boot has to come off when CAINE will not start, and the site warns you to have the BitLocker recovery key ready before you change it. PALADIN boots on more systems with Secure Boot left on.
- There is no packaged imaging GUI like the PALADIN Toolbox, so staff need to know the bundled tools.
Official site: CAINE.
Guymager
Much of what a PALADIN user does is pick a source disk, pick a format and press go. Guymager is that step on its own. The Guymager project site lists version 0.8.13 and says it writes flat dd, EWF (E01) and AFF images, can clone disks, and runs its pipeline and compression on multiple threads.
On Debian or Ubuntu it installs with apt-get install guymager, so you can add it to a custom live USB, a lab workstation or a remastered Ubuntu image. Kali's forensic metapackage pulls it in too, which makes it a common shared tool across several picks on this page.
Best for: Labs that build their own Linux boot media and only need a dependable imaging GUI.
Pricing:
- Free and open source
Watch out for:
- It is Linux software only. You still need a live system with write protection around it, which PALADIN gives you out of the box.
- It acquires and clones media and nothing else. Hashing searches, triage and memory capture need other tools.
Official site: Guymager.
Tsurugi Linux
Tsurugi splits acquisition from analysis. The Tsurugi site offers Tsurugi Acquire, a lighter 32-bit build with only live disk acquisition tools, next to Tsurugi Lab for analysis and Bento, a portable kit for live investigations. All three are free.
The Acquire edition is the PALADIN replacement here. Lab is where the image goes afterwards. Lab 25.11, announced on November 24, 2025, moved to Ubuntu 24.04.3 LTS with a 6.17.8 kernel and a live ISO of about 5 GB.
Best for: Teams that want a small acquisition stick and a full analysis distro from one free project.
Pricing:
- Free for Lab, Acquire and Bento
Watch out for:
- Record the exact build you validated in your procedures.
- The Acquire build is 32-bit only, so confirm it boots on the UEFI-only hardware in your caseload.
Official site: Tsurugi Linux.
FTK Imager
Some labs pull the drive and image it behind a hardware write blocker instead of booting the suspect machine. For that workflow, Exterro's FTK Imager is the free default on Windows. The FTK downloads page lists FTK Imager 8.3 and 8.3.1, and the product page says it captures disks, files and RAM.
FTK Imager Pro is the paid tier. The Exterro store sells it as an annual subscription at $499 per user, adding iOS collection and BitLocker decryption. Our FTK Imager alternatives guide lists other Windows and Linux imagers.
Best for: Labs that image removed drives on a Windows workstation behind a hardware write blocker.
Pricing:
- FTK Imager: free
- FTK Imager Pro: $499 per user per year
Watch out for:
- Exterro says it is Windows only and "cannot be installed on a Linux device," so it is no help as boot media.
- Running it on a live suspect system writes to that system, which a PALADIN boot avoids.
Official site: FTK Imager.
SIFT Workstation
PALADIN gets the evidence. SANS SIFT Workstation is what many examiners open next. It is a free, open-source Ubuntu toolkit for analysis, offered as an 8.81 GB OVA behind a SANS Portal login or as a native install with sudo cast install teamdfir/sift on Ubuntu 22.04, per the SIFT page.
It is the better pick when PALADIN's bundled Autopsy feels thin for timeline work. The salt states behind it are still updated: v2026.04.21 added Volatility 3 for memory analysis, and v2026.10.19 followed in October 2026. Our SIFT Workstation alternatives page compares it with other analysis distros.
Best for: Examiners who need deep timeline and memory analysis after acquisition.
Pricing:
- Free and open source
Watch out for:
- It is an analysis VM, not a live boot disk, so it does not replace PALADIN at the scene.
- The download page lists an Ubuntu 20.04 base in its features but asks for 22.04 in the install steps. Follow the install steps.
Official site: SIFT Workstation.
RECON ITR
When the target is a modern Mac, SUMURI itself sends PALADIN users to RECON ITR. Version 27.1.0 images and triages Apple Silicon Macs from M1 through M6, including Pro, Max and Ultra chips, plus Intel T2 models. The RECON ITR page lists APFS volume and container captures, FileVault 2 decryption with an admin password or recovery key, and live macOS volatile data collection.
It can compare a volume against its local Time Machine snapshots to spot changed or deleted files, and it triages iOS backups. Older pre-T2 Intel Macs, Windows and Linux machines are covered by the PALADIN PRO environment included with it.
Best for: Examiners whose caseload includes Apple Silicon and T2 Macs.
Pricing:
- From $1,295; sold as an annual subscription
- Renewal costs the same each year
- Includes PALADIN PRO
Watch out for:
- If the subscription lapses, the page says RECON ITR "stops working until it is renewed."
- It controls macOS Disk Arbitration to stop auto-mounting, which is not the same as the block-level write protection PALADIN applies.
Official site: RECON ITR.
Kali Linux (forensic mode)
A Kali live USB has a boot entry for forensic mode. In that mode, the Kali forensics docs say the internal hard disk is never touched, swap is not used and removable media is not auto-mounted. You mount the destination drive by hand.
The kali-tools-forensics metapackage brings in Guymager, Autopsy, The Sleuth Kit and bulk_extractor. The current release is Kali 2026.3, from October 26, 2026, on kernel 7.1.5, newer than PALADIN's 6.17.
Best for: Security teams that want one USB stick for pentests and occasional acquisitions.
Pricing:
- Free
Watch out for:
- The docs ask you to validate every tool and say the hash test behind the mode was the authors' own. Repeat it on your hardware.
- There is no imaging front end like the PALADIN Toolbox. You start Guymager or dd yourself.
Official site: Kali Linux (forensic mode).
Magnet Acquire
Magnet Forensics gives away an imager that covers phones as well as drives. The Magnet Acquire page says it images iOS and Android devices, hard drives and removable media, and is "free for members of the forensics community" through a request form.
That phone support is the gap it fills next to PALADIN, which is built around computers. Quick extraction works on any iOS or Android device, and full extraction needs a rooted Android or jailbroken iPhone. Magnet also says it can run from external storage.
Best for: Investigators who image computers and phones they can open and want one free tool for both.
Pricing:
- Free for the forensics community; request form
Watch out for:
- It runs on an operating system rather than booting one, so it lacks PALADIN's boot-time write protection.
- Locked phones are out of reach. Magnet's free tools page says it images devices "if the passcode is known."
Official site: Magnet Acquire.
How to choose
| If you need | Pick |
|---|---|
| A free write-blocked boot disk for company use, no account | CAINE |
| An imaging GUI for a Linux stick you build yourself | Guymager |
| A 32-bit acquisition build for older hardware | Tsurugi Linux |
| Imaging removed drives on Windows | FTK Imager |
| Analysis after the image is made | SIFT Workstation |
| Apple Silicon or T2 Macs | RECON ITR |
| One stick for pentesting and forensics | Kali Linux (forensic mode) |
| iPhones and Android phones with known passcodes | Magnet Acquire |
When to stay with PALADIN
Keep PALADIN if your staff image in the field and need a guided GUI rather than a terminal. It is also the safer choice on laptops where you cannot turn off Secure Boot, since SUMURI says it starts on more systems with Secure Boot on. For $99, PALADIN PRO arrives on a ready-made USB-C stick with 64-bit and 32-bit builds, which saves making boot drives by hand.
Frequently asked questions
Is PALADIN forensic free?
It is name your price. Non-profits, law enforcement and individuals choose their own donation, and corporate users must give at least $25. PALADIN PRO, sold on a USB stick, costs $99.
What is the latest PALADIN version?
SUMURI lists PALADIN 9.4.2 as the current release. It is based on Ubuntu 24.04 LTS with a Linux 6.17 live kernel, and downloads come through your SUMURI account. Check the ISO hash before writing it to USB.
Can PALADIN image a Mac?
For modern Macs, SUMURI points you to RECON ITR, which handles Apple Silicon and T2 models and includes PALADIN PRO for older Intel Macs.
Is there a free alternative to PALADIN with write blocking?
CAINE 14.0 is free and mounts all block devices read-only by default. Kali's forensic mode leaves internal disks untouched and does not auto-mount removable media. Both cost nothing, including for companies.
