Parrot OS

Parrot OS is a Debian-based Linux distribution specifically designed for security testing, digital forensics, and privacy-focused use. It comes pre-installed with a comprehensive collection of security, privacy, and OSINT tools, providing investigators with a ready-made investigation environment without requiring individual tool installation.

For OSINT investigators, Parrot OS's pre-installed tool collection is its primary advantage. Rather than building a custom Linux investigation environment from scratch — installing individual tools, resolving dependencies, and configuring settings — Parrot OS provides a complete OSINT and forensics toolkit out of the box.

The OSINT tools included in Parrot OS cover information gathering, network analysis, web application testing, social engineering, exploitation frameworks (for authorized penetration testing), and digital forensics. This breadth means investigators can conduct diverse investigation tasks from a single consistent environment.

Running Parrot OS from a live USB drive (without installation) provides an amnesic investigation environment — all investigation activity occurs in RAM and leaves no trace on the host machine after shutdown. This is valuable for investigations conducted on shared machines or where leaving a digital trail on the investigation device is undesirable.

Parrot OS's home edition focuses on privacy and productivity while the security edition includes the full penetration testing toolkit. For OSINT-focused investigators, either edition provides the core OSINT tools alongside strong privacy defaults.

For team environments, Parrot OS provides consistent tool versions and configurations across multiple investigators — ensuring that investigation procedures are reproducible and tool-dependent results are consistent.

The ARM edition supports running on Raspberry Pi devices, enabling the creation of dedicated, isolated investigation hardware appliances.

Document the Parrot OS version used, whether running from live USB or installed, and any tool configuration customizations made to the environment for investigation methodology records.