What is Reddit's opinion of
Caine?
From 3.5 billion Reddit comments
5 reviews of this app found across Reddit:
Ideally, not much - computer forensic software is well established and there are even open source distributions.
However, in the public sector they are likely to have a lack of trained staff (experts in such software can almost name their price) so the work may very well be contracted out, particularly if it is difficult.
(And computer forensics is hard - one does not just crack the login password by trial and error then poke around on the hard drive. Even turning a computer on can destroy evidence so specialised hardware is sometimes used to copy the hard drive passively then work on the copy).
I have not used that one specifically, although I have used other specialized Linux forensics distros. Two that I have used and like are Caine and Deft: http://www.caine-live.net/ http://www.deftlinux.net/
I mostly use these for on-site previews or cases where I'm simply trying to get quick info and don't need to worry as much about procedures being questioned in court. I use FTK in my lab for most examinations.
Dang I thought it was in the title. Here ya go:
Writeup (slides): http://www.eweek.com/security/slideshows/caine-linux-distribution-helps-investigators-with-forensic-analysis.html
Download: http://www.caine-live.net/
You mention that you "have no way to connect the drive from the computer to your laptop". I would assume this means you don't have access to a write blocker?
You can still take a forensically sound image once you have collected the RAM and shut down the computer. You can boot to CD or USB using a Live CD like CAINE and guyimager: http://www.caine-live.net/page10/page10.html. This will mount the drive as Read Only to create a forensic image.
Once you have the image, work with that. However, keep in mind the other comments here regarding COC etc if there is even a remote chance this will end up in court.
Download Caine, burn it to a disk, boot that disk with the hard drive plugged in. Mount the hard drive and run like photorec, recuva, read around on the site. You might need to know a little Linux.