Helix is a customized distribution of the Knoppix Live Linux CD. Helix has more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics. Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, it will also not auto mount any found devices. Helix also has a special Windows autorun side for Incident Response and Forensics. Helix is used by SANS for training in Track 8: System Forensics, Investigation and Response.