Helix 3 has been released.  This forensics centric live CD is now Ubuntu based and includes updates to many of the host programs.  From the site:

"Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, or auto mount any attached devices. Helix also has a special live side for Incident Response and Forensics."

The new version of Helix can be found at http://www.e-fense.com/helix/

downloading now, cheers

Love it when people beat me to the punch.

Thanks mad_irish,
Don

Nice I'll have to start playing with this one as well 

I am a little disappointed with the recent release of Helix.   I've been using the CD for quite some time now, and the new version has a couple of annoyances to me:

1.  New build based on Ubuntu.   I have had some issues getting the disc to boot with some systems.   Ubuntu seems to be less forgiving when it comes to hardware.   I carry around version 1.9a and the new version.

2.  There is now an option to Install Helix to Hard Drive.   I realize that this could be cool, but I think its a dumb option on a forensics CD that is supposed to not modify original evidence.   How many people who aren't familiar with evidence handling rules and Helix will attempt to install the software onto a drive they are attempting to analyze?   

3.  The disc mounting and formatting is still confusing to a novice Linux users.   Many forensics investigators do not have Linux ops training.   They are only familiar with the OS from an investigative point of you.   Many of my coworkers are switching to RAPTOR, which makes this task much easier for them.

Yep, that's the site for Raptor.  Sorry, I mean to post a link.   It's a pretty decent tool, despite being in BETA.   I am not sure if it will remain free.

I agree with you on the Forensics workstation option.   I just think that should be a separate disc.   The boot disc should be pristine without the option to install, in my opinion.   I have seen too many IT departments attempting to do their own forensics without proper training; and it usually doesn't turn out well.  The HD install can be quite dangerous in the wrong hands.    I do see your point on a workstation option though.

What would you suggest for better hardware detection?

These are they types of things I hope to address. I didn't think to remove the install portion that would save some space and avoid the possibility of spoliation.

To be honest with you, I am not sure.   I carry both, 1.9a and 2.0 (Although it says Helix 3 on the new one) with me all the time.  1.9a seems to have less issues with detecting hardware.   The most issues I have had is that the toolbar in X doesn't come up.   In the new version, we have had quite a few of those dreaded Ubuntu errors where it drops you to a shell complaining about a GUID mount point.   

What was the older version based on?   Was it debian or redhat?   

It's not that big of a deal if you have both versions.   You start with the newer Helix boot CD.   If that doesn't boot, you switch to 1.9.