Download Options

There are multiple download options:

  • CSI Linux Investigator contains all 3 of the CSI Linux Virtual Machines. When you download this, it will automatically setup and load them into VirtualBox.
  • CSI Linux Analyst is the main investigation workstation that is used for digital forensics.
  • CSI Linux Gateway is required to send all CSI Linux Analyst traffic through Tor and protect the source IP addresses. This is to keep the anonymity of users and minimize potential back tracing of the investigators.
  • CSI Linux SIEM is used for Incident Response and Intrusion Detection. This can be used as a stand alone or with CSI Linux Analyst for a more indepth analysis.
Default user name: csi | Default password: csi

if you find bugs or have suggestions, please contact us by email

CSI Linux Investigator - Minimum:
8 GB of FREE RAM, suggest more...
70 GB free disk space, suggest a lot more
4 Cores
Internet Access
VirtualBox :

The download has been packaged in a VirtualBox appliance OVA. You must install VirtualBox first, install the VirtualBox Extension Pack, then run the downloaded OVA file. This will take a few minutes to build. The current appliance comes with CSI Linux Analyst, CSI SIEM, and CSI Gateway.

Due to the confusion from many users on which downloads to use and why, we have temporarily suspended the individual downloads for CSI Linux Analyst, Gateway, and SIEM. All three are located in the Investigator download.