T-PHANTOM OS – security-focused Linux distribution for DFIR

T-PHANTOM OS is a security-focused Linux distribution designed for digital forensics, incident response, authorized penetration testing, reverse engineering, network analysis and privacy-oriented work. It’s based on Debian.

It provides a KDE Plasma desktop with Arabic and English support and aims to present security applications as a coherent workstation rather than simply bundling as many tools as possible. The distribution is intended for security professionals, researchers, students, training labs and CTF environments.

Key Features

• KDE Plasma desktop with a customised T-PHANTOM visual identity.
• Arabic and English are treated as first-class user environments.
• Designed for digital forensics and incident response workflows.
• Provides tools for disk, file-system, registry, timeline and artifact investigation.
• Targets authorised penetration testing and controlled security assessment.
• Supports binary analysis and reverse engineering workflows.
• Includes utilities for packet, protocol, DNS and other network analysis.
• Curated security application set organised around practical workflows rather than raw tool count.
• AppArmor availability is validated in the current release.
• nftables is available for firewalling and network security.
• Custom boot, installer, login and desktop branding.
• Requires at least 4GB RAM, with 8GB or more recommended for heavier analysis workloads.