PALADIN EDGE (64-Bit)

PALADIN EDGE (64-bit) is a modified “live” Linux distribution based on Ubuntu that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox. PALADIN EDGE is a complete solution for triage and imaging.

Please Read Carefully: In order to download PALADIN EDGE you must create an account and agree to the Terms and Conditions of using our services and this site. These terms include giving us permission to contact you about SUMURI news, products, updates and events. You may opt-out gracefully at anytime.

PALADIN EDGE 64 (Version 8.01) ISO

MD5: a1ba416e2f389a9148139660e41de985

SHA1: 34397f8bef0082400de8c7c2a82bf16db1f7280e

Download Size: 2.00 GB

PALADIN 8.01 Change Log:

• Updated Linux kernel for additional hardware support.

PALADIN TOOLBOX

This is the PALADIN application you have all come to love completely recoded and streamlined. Designed to make you a Forensic Rockstar!

PALADIN Toolbox Key Features

• Boot your computer into a safe environment
• Image to several formats including Expert Witness (.E01, .Ex01), Apple Disk Image (.dmg) and Raw (.dd), SMART, AFF, VHD and VMDK!
• Clone devices
• Create two forensic images or clones at the same time
• Image across a network (SAMBA and NFS)
• Format any drive as NTFS, HFS+, FAT32 or EXT4 and ExFAT
• Create a forensic image of only the Unallocated Space andFree Space
• Quickly wipe (sterilize), verify and hash media
• Search and preview media by file name, keywords or MIME types.

Logging

There are two types of logs in PALADIN – Task Logs and Live Logs. Task Logs keep a record of all tasks during a session. Live Logs provide information regarding the current task. You can save you logs to any destination by choosing “Select media to store logs” from the Logs menu.

IMAGER TAB

The Imager Tab allows you to output to two destinations simultaneously. Here you can choose between a .dmg, .dd .E01, .Ex01, SMART, AFF or .vmdk image formats. Selecting “Device” allows you to create a clone. You can also convert one forensic image to another by using the Image Converter Tab.

FIND TAB

File previews anyone? Make sure you have a drive mounted as read/write in order to save results. Select your drive to preview. Search by file name, content (keywords), or MIME/File Signatures (www.webmaster-toolkit.com/mime-types.shtml). Select your destination drive and provided a name for your search. Your files will begin to populate in an Explorer window! Select Copy Original to export your results.

UNALLOCATED TAB

Many file carving utilities exist but how do you grab just the unallocated space, file slack and free space from a drive and save this as a file? The Unallocated Tab is your solution.

DISK MANAGER

Refresh Button – Drive not showing up in the drop-down boxes? Hit the new Refresh Button to tell PALADIN to re-poll the devices!

Mount/UnMount Buttons – These buttons allow you to mount and unmount drives Read-Only or Read-Write. Simply select which volume you would like to mount or unmount from the list and go!

Verify Button – The Verify Button will generate an MD5 and SHA1 hash for any device or forensic image selected.

Format Button – The Format Tab allows you to format a drive with an HFS+, FAT32, ExFAT, NTFS or EXT4 file system.

Wipe Button – Need to sterilize your drive? The Wipe Button will write zeros across the entire drive in a single pass. A new Verify after Wipe feature was added for extra peace of mind!

Images Tab – PALADIN allows you to mount a partition from your forensic image.

Samba/NFS Networking– PALADIN allows you to add a Network Volume by selecting Mount and adding the appropriate information.