DEFT 2017.1 Zero
DEFT (Digital Evidence & Forensic Toolkit), a customised version of the Ubuntu live CD, is back after a hiatus of two years with version 2017.1, also known as ‘Zero’. Specially designed as a lightweight tool for performing forensic acquisition of digital evidence, the new version supports NVMExpress memory (found in the 2015 MacBook), eMMC and UEFI.
It can be run entirely in RAM (as long as you have over 400MB) and it is based on Lubuntu 14.04.02 LTS. DEFT Zero will be updated and developed alongside the full version of DEFT. You can find out more and download the live CD at www. deftlinux.net/2017/02/13/deftzero-2017-1-ready-for-download.