Originally Posted by
gif
I know there is a Forensic mode live boot, but I need to install Kali Linux to make forensic images of disks and analyze them.
I would like to know if the graphical installion of Kali Linux is forensic.
I mean, if there is a swap partition it will not be used, no internal disk will be auto mounted and auto-mounting of removable media will be disabled.
In case graphical installion of Kali Linux is not forensic, could this feature be configured? How?
I think i saw somwwhre the usage of forensic mode is via usb, to boot to machine with it. Then examine from there.
easy to start; hard to finish