UWN Thesis’ author spent a few months re-engineering her installation of Kali Linux back in 2013, and has posted a good collection of useful guides to customising an installation using APT. I preferred to put together something comparable by adding tools to Linux Mint with the same package manager.
The option is given to download a 3GB+ ISO with an exhaustive set of tools, or download the 900MB Light version that users can build on. With the latter, there aren’t many security-related programs in the desktop or command line, but Kali’s package manager can download from several large repositories by default.
The Kali Linux security tools list is a good place to start.
You still get the same collection of programs in the GUI as the live boot mode. The main difference is the forensic mode doesn’t touch the hard disk or mount any connected storage devices.
The only useful programs I could find here is possibly dd and stuff for cloning NTFS filesystems.