Black Harrier Linux

Black Harrier is a Linux distribution developed to be a flexible, extensible operating system developed for digital forensics, cyber-incident response, and technology support.

About Black Harrier

This latest iteration of a Linux distro that has taken many forms over the past 17+ years, Black Harrier Linux was initially developed to be a digital Jack-of-all-trades, initially focusing on IT support and system administration, later transitioning to supporting digital forensics / incident response (DFIR) and related technical analysis.

Based on Linux Mint 64-bit MATE-Desktop, Black Harrier is crafted to be a handy live OS that you can keep on your key fob for ad-hoc or install on the hardware of your choice for everyday use. Features include:

Live Booting – Born out of a need to live boot a computer and access data without worrying about the computer making things difficult.

Extensible – Nothing is permanent except change. The ability to add tools and make persistent configuration changes to the live system was the driving factor for avoiding immutable formats like ISO files.

Replication – Sometimes, you need more than one copy of a boot disk. The bhreplicate script was created to quickly make a copy of the complete live system to new target media.

Forensically Safe(r) – Whether making a machine image itself or borrowing a laptop from a friend, drive auto-mount and hardware clock updates are disabled in ‘portable’ mode.

Note: There is no software write-block installed. You can modify or destroy data if you take actions to do so either intentionally or accidentally. Use this distro with care and be thoughtful. You are responsible for your actions and any data destruction resulting from using Black Harrier. As the end user, you alone are responsible for testing and validating this distribution.

Download black Harrier

The build script and instructions can be found on the Github project page.

A pre-built disk image and a Virtual Machine OVA of the current build can be downloaded using the links below:

Black Harrier v11.0.24.213, Disk Image, 64-bit, EFI
Zip compressed file: Download / Hash 
XZ compressed file: Download / Hash
Size: 32 GB uncompressed

Black Harrier v11.0.24.213, Virtual Machine, 64-bit
Open Virtual Appliance (OVA) file: Download / Hash
Size: ~12 GB imported