To use Grml for forensic investigations use the main bootparameter “forensic”.
If you are interested in a full featured and forensically sound edition of Grml please visit grml-forensic.org/.