Training
Featured CourseView All Courses

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

SEC595Cyber Defense, Artificial Intelligence
SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
View course detailsRegister
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Contact Sales
Contact Sales

SIFT Workstation

Download
Download SIFT Workstation (OVA, 9.05GB )Last updated: 11 Dec, 2025
Created by:
Rob T. Lee
Rob T. Lee

The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. It can match any current incident response and forensic tool suite. SIFT demonstrates that advanced incident response capabilities and deep-dive digital forensic techniques can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

Protocol SIFT: Experimental Research on AI-Assisted DFIR

You may see references to Protocol SIFT in the DFIR community. Protocol SIFT is an experimental research initiative exploring how AI-assisted orchestration may support investigative workflows within the SIFT environment.

Protocol SIFT is separate from and does not modify or replace the core SIFT Workstation available for download on this page. The SIFT Workstation remains a widely used digital forensic and incident response platform maintained by SANS.

Protocol SIFT has not been validated for forensic soundness or evidentiary reliability and is not court-admissible. It remains in its initial research stage.

Read the full overview here: Protocol SIFT: An Experimental Research Initiative for AI-Assisted DFIR

Option 1: SIFT Workstation VM Appliance

Click the 'Login to Download' button above and input (or create) your SANS Portal account credentials to download the virtual machine. Once you have booted the virtual machine, use the credentials below to gain access.

  • Login = sansforensics
  • Password = forensics
    • Use to elevate privileges to root while mounting disk images.

    • md5 = 3618ec5a542025f0df39c1ea506823cc

    • sha1 = d40cdfe01e9118a5eb30dad63e6980e0243559c4

    • sha256 = 58b5c0421ae1563161909e23fce32a91e0164ed2af94eff9ec98e7e6199713dd

Having trouble downloading SIFT? If you are having trouble downloading the SIFT Workstation VM, please contact sift-support@sans.org and include the URL you were given, your public IP address, browser type, and if you are using a proxy of any kind.

Option 2A: SIFT Easy Installation on Native Ubuntu System

  1. Download Ubuntu 22.04 ISO file and install Ubuntu 22.04 on any system - http://www.ubuntu.com/download/desktop
  2. Install the Latest Cast Binary from its release page
  3. Run '**sudo cast install teamdfir/sift**' to install the latest version of SIFT
  4. Congrats -- you now have a SIFT workstation!
    1. Login = **sansforensics**
    2. Password = **forensics**
    3. $ **sudo su -**
    4. Use to elevate privileges to root while mounting disk images.

Option 2B: SIFT Easy Installation on Microsoft Windows using Windows Subsystem for Linux

1. Install Windows Subsystem for Linux (WSL) according to Microsoft’s latest guidance, currently located at https://docs.microsoft.com/en-us/windows/wsl/install-win10. The SIFT distribution can be installed on either WSL version 1 or version 2.

1. Choose Ubuntu 22.04 during the WSL installation process.

2. Launch the Ubuntu Bash Shell and elevate to root (**sudo su**) to avoid permissions issues during the installation process.

3. Install the Latest Cast Binary from its release page

4. Run '**sudo cast install --mode=server teamdfir/sift-saltstack**' to install the latest version of SIFT in WSL

5. Congrats -- you now have a SIFT Workstation in Windows!

Key new SIFT Workstation features include:

  • Ubuntu LTS 20.04 Base
  • 64-bit base system
  • Better memory utilization
  • Auto-DFIR package update and customizations
  • Latest forensic tools and techniques
  • VM Appliance ready to tackle forensics
  • Cross compatibility between Linux and Windows
  • Option to install/upgrade stand-alone system via SIFT-CLI installer
  • Expanded Filesystem Support

SIFT Workstation Capabilities

A key tool during incident response, helping incident responders identify and contain advanced threat groups. The SIFT provides robust capabilities for analyzing file systems, network evidence, memory images, and more.

File system support

  • NTFS (NTFS)
  • iso9660 (ISO9660 CD)
  • hfs (HFS+)
  • raw (Raw Data)
  • swap (Swap Space)
  • memory (RAM Data)
  • fat12 (FAT12)
  • fat16 (FAT16)
  • fat32 (FAT32)
  • ext2 (EXT2)
  • ext3 (EXT3)
  • ext4 (EXT4)
  • ufs1 (UFS1)
  • ufs2 (UFS2)

Evidence Image Support

  • raw (Single raw file (dd))
  • aff (Advanced Forensic Format)
  • afd (AFF Multiple File)
  • afm (AFF with external metadata)
  • afflib (All AFFLIB image formats (including beta ones))
  • ewf (Expert Witness format (encase))
  • split raw (Split raw files) via affuse
  • affuse - mount 001 image/split images to view single raw file and metadata
  • split ewf (Split E01 files) via mount_ewf.py
  • mount_ewf.py - mount E01 image/split images to view single raw file and metadata
  • ewfmount - mount E01 images/split images to view single raw file and metadata
  • vmdk
  • vhd/vhdx
  • qcow

    Incident Response Support

    • F-Response Tool Suite Compatible
    • Rapid Scripting and Analysis
    • Threat Intelligence and Indicator of Compromise Support
    • Threat Hunting and Malware Analysis Capabilities

      Software Includes:

      • Plaso/log2timeline (Timeline Generation Tool)
      • Rekall Framework (Memory Analysis)
      • Volatility Framework (Memory Analysis)
      • 3rd Party Volatility Plugins
      • bulk_extractor
      • afflib
      • afflib-tools
      • ClamAV
      • dc3dd
      • imagemounter
      • libbde
      • libesedb
      • libevt
      • libevtx
      • libewf
      • libewf-tools
      • libewf-python
      • libfvde
      • libvshadow
      • lightgrep
      • Qemu
      • regripper and plugins
      • SleuthKit
      • Hundreds of additional tools

      SIFT Workstation and REMnux Compatibility

      REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. REMnux is used in SANS FOR610: Reverse Engineering Malware.

      REMnux can be added into a SIFT Workstation installation. To install REMnux, first install the SIFT Workstation using the instructions found above. Then, follow these instructions to add the REMnux components.

      SIFT workstation is playing an essential role for the Brazilian national prosecution office, especially due to Brazilian government budgetary constraints. Its incident response and forensic capabilities are bundled in a way that allows an investigation to be conducted much faster than it would take if not having the right programs grouped on such a great Linux distribution. The new version, which will be bootable, will be even more helpful. I'd highly recommend SIFT for government agencies or other companies as a first alternative, for acquisition and analysis, from the pricey forensics software available on the market. - Marcelo Caiado, M.Sc., CISSP, GCFA, EnCE What I like the best about SIFT is that my forensic analysis is not limited because of only being able to run an incident response or forensic tool on a specific host operating system. With the SIFT VM Appliance, I can create snapshots to avoid cross-contamination of evidence from case to case, and easily manage system and AV updates to the host OS on my forensic workstation. Not to mention, being able to mount forensic images and share them as read-only with my host OS, where I can run other forensic tools to parse data, stream-lining the forensic examination process. - Brad Garnett www.digitalforensicsource.com

      FAQs

      Author

      Rob Lee
      Rob Lee

      Rob T. Lee

      Fellow

      Rob T. Lee is Chief AI Officer and Chief of Research at SANS Institute, where he leads research, mentors faculty, and helps cybersecurity teams and executive leaders prepare for AI and emerging threats.

      Read more about Rob T. Lee

      Related Content

      Jump List parser

      Open Source ToolsDigital Forensics and Incident Response
      • Eric Zimmerman

      iisGeolocate

      Open Source ToolsDigital Forensics and Incident Response
      • Eric Zimmerman

      KAPE

      Open Source ToolsDigital Forensics and Incident Response
      • Eric Zimmerman

      epochalypse.py

      Open Source ToolsDigital Forensics and Incident Response
      • Pasquale Stirparo

      teleparser

      Open Source ToolsDigital Forensics and Incident Response
      • Francesco Picasso

      Timeline Explorer

      Open Source ToolsDigital Forensics and Incident Response
      • Eric Zimmerman

      Course cards

      View all Courses
      • Slide 1 of 15

        FOR589: Cybercrime Investigations

        Intermediate
        FOR589Digital Forensics and Incident Response
        FOR589: Cybercrime Intelligence
        • 5 Days (Instructor-Led)
        • 30 CPEs / 30 Hours (Self-Paced)
        • Labs: 20 Hands-On Labs

        View course detailsRegister
      • Slide 2 of 15

        FOR585: Smartphone Forensic Analysis In-Depth

        MAJOR UPDATES
        AI SKILLS
        Essentials
        FOR585Digital Forensics and Incident Response
        FOR585: Smartphone Forensic Analysis In-Depth
        • GIAC Advanced Smartphone Forensics (GASF)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 22 Hands-On Labs

        View course detailsRegister
      • Slide 3 of 15

        FOR608: Enterprise-Class Incident Response & Threat Hunting

        UPDATED
        Intermediate
        FOR608Digital Forensics and Incident Response
        FOR608: Enterprise-Class Incident Response & Threat Hunting
        • GIAC Enterprise Incident Responder (GEIR)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 20 Hands-On Labs

        View course detailsRegister
      • Slide 4 of 15

        FOR518: Mac and iOS Forensic Analysis and Incident Response

        UPDATED
        Intermediate
        FOR518Digital Forensics and Incident Response
        FOR518: Mac and iOS Forensic Analysis and Incident Response
        • GIAC iOS and macOS Examiner (GIME)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 23 Hands-On Labs

        View course detailsRegister
      • Slide 5 of 15

        FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

        UPDATED
        Intermediate
        FOR508Digital Forensics and Incident Response
        FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
        • GIAC Certified Forensic Analyst (GCFA)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 35 Hands-On Labs

        View course detailsRegister
      • Slide 6 of 15

        FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

        Advanced
        FOR610Digital Forensics and Incident Response
        FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
        • GIAC Reverse Engineering Malware (GREM)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 48 Hands-On Labs

        View course detailsRegister
      • Slide 7 of 15

        FOR578: Cyber Threat Intelligence

        MAJOR UPDATES
        Intermediate
        FOR578Digital Forensics and Incident Response
        FOR578: Cyber Threat Intelligence
        • GIAC Cyber Threat Intelligence (GCTI)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 20 Hands-On Labs

        View course detailsRegister
      • Slide 8 of 15

        FOR509: Enterprise Cloud Forensics and Incident Response

        MAJOR UPDATES
        Intermediate
        FOR509Digital Forensics and Incident Response
        FOR509: Enterprise Cloud Forensics and Incident Response
        • GIAC Cloud Forensics Responder (GCFR)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 23 Hands-On Labs

        View course detailsRegister
      • Slide 9 of 15

        FOR528: Ransomware and Cyber Extortion

        Intermediate
        FOR528Digital Forensics and Incident Response
        FOR528: Ransomware and Cyber Extortion
        • 4 Days (Instructor-Led)
        • 24 CPEs / 24 Hours (Self-Paced)
        • Labs: 13 Hands-On Labs

        View course detailsRegister
      • Slide 10 of 15

        FOR577: LINUX Incident Response and Threat Hunting

        Intermediate
        FOR577Digital Forensics and Incident Response
        FOR577: LINUX Incident Response and Threat Hunting
        • GIAC Linux Incident Responder (GLIR)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 23 Hands-On Labs

        View course detailsRegister
      • Slide 11 of 15

        FOR710: Reverse-Engineering Malware: Advanced Code Analysis

        Advanced
        FOR710Digital Forensics and Incident Response
        FOR710: Reverse-Engineering Malware: Advanced Code Analysis
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 12 Hands-On Labs

        View course detailsRegister
      • Slide 12 of 15

        FOR498: Digital Acquisition and Rapid Triage

        Essentials
        FOR498Digital Forensics and Incident Response
        FOR498: Digital Acquisition and Rapid Triage
        • GIAC Battlefield Forensics and Acquisition (GBFA)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 20 Hands-On Labs

        View course detailsRegister
      • Slide 13 of 15

        FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

        NEW
        AI-FOCUSED
        Intermediate
        FOR563Digital Forensics and Incident Response, Artificial Intelligence
        FOR509: Enterprise Cloud Forensics and Incident Response
        • 1 Day (Instructor-Led)
        • 6 CPEs / 6 Hours (Self-Paced)
        • Labs: 4 Hands-On Labs

        View course detailsRegister
      • Slide 14 of 15

        FOR500: Windows Forensic Analysis

        UPDATED
        Essentials
        FOR500Digital Forensics and Incident Response
        FOR500: Windows Forensic Analysis
        • GIAC Certified Forensic Examiner (GCFE)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 22 Hands-On Labs

        View course detailsRegister
      • Slide 15 of 15

        FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

        Advanced
        FOR572Digital Forensics and Incident Response
        FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
        • GIAC Network Forensic Analyst (GNFA)
        • 6 Days (Instructor-Led)
        • 36 CPEs / 36 Hours (Self-Paced)
        • Labs: 20 Hands-On Labs

        View course detailsRegister
      View all Courses