Cado Live

Cado Live allows you to build a bootable USB disk to grab a forensic copy of a machine and write that evidence to cloud storage for processing. Please note that while Cado Live is available for use, it is no longer officially supported by Cado Security development teams. Please find the fully-supported Cado Response Community Edition here.

  • We recommend creating the USB image with Rufus on Windows and UNetBootIn on Linux or OSX.
  • The ISO file as is can also be used in virtual machine environments.
  • The MD5 file-hash is 70fb0d32c683fce2251b80e2ad425ce6.
  • Cado Live was made possible thanks to a number of supporting applications and testers – you can view them on the acknowledgements page.

Easy to Deploy

Just image Cado Live to a USB disk and boot it on the target system. You can then upload forensic copies of systems directly to cloud storage.

Cado Live currently supports Azure, AWS and Google Cloud.


We would love to hear any feedback you might have.

Please contact us to let us know any feedback you might have.