homepage
Open menu

SIFT Workstation

The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. It can match any current incident response and forensic tool suite. SIFT demonstrates that advanced incident response capabilities and deep-dive digital forensic techniques can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

By
Rob Lee
470x382-SIFT_logo.png

Option 1: SIFT Workstation VM Appliance

Login to download

Click the 'Login to Download' button and input (or create) your SANS Portal account credentials to download the virtual machine. Once you have booted the virtual machine, use the credentials below to gain access.

  • Login = sansforensics
  • Password = forensics
  • $ sudo su -
    • Use to elevate privileges to root while mounting disk images.
  • Hash Values
    • MD5: b838d44bd56ad0e8f4f6a5a6b00b7c8d SIFT-Workstation.ova
    • SHA256: 27fac07e95498db5eaaa2c6c0b85ef9ca96090fb0964e552a7792a441ebe4d74 SIFT-Workstation.ova

Having trouble downloading SIFT?

If you are having trouble downloading the SIFT Workstation VM, please contact sift-support@sans.org and include the URL you were given, your public IP address, browser type, and if you are using a proxy of any kind.

Option 2A: SIFT Easy Installation on Native Ubuntu System

  1. Download Ubuntu 20.04 ISO file and install Ubuntu 20.04 on any system - http://www.ubuntu.com/download/desktop
  2. Install SIFT-CLI using these install instructions
  3. Run 'sudo sift install' to install the latest version of SIFT
  4. Congrats -- you now have a SIFT workstation!
    • Login = sansforensics
    • Password = forensics
    • $ sudo su -
      • Use to elevate privileges to root while mounting disk images.

Option 2B: SIFT Easy Installation on Microsoft Windows using Windows Subsystem for Linux

  1. Install Windows Subsystem for Linux (WSL) according to Microsoft’s latest guidance, currently located at https://docs.microsoft.com/en-us/windows/wsl/install-win10. The SIFT distribution can be installed on either WSL version 1 or version 2.
    1. Choose Ubuntu 20.04 during the WSL installation process.
  2. Launch the Ubuntu Bash Shell and elevate to root (sudo su) to avoid permissions issues during the installation process.
  3. Prepare to install SIFT-CLI using these install instructions.
  4. Run 'sift install --mode=server' to install the latest version of SIFT in WSL
  5. Congrats -- you now have a SIFT Workstation in Windows!

Why SIFT?

The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. It can match any current incident response and forensic tool suite. SIFT demonstrates that advanced incident response capabilities and deep-dive digital forensic techniques can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

Who Created the SIFT?

Rob Lee created the original SIFT Workstation in 2007 to support forensic analysis in the SANS FOR508 class. Over the years, he and a small team have continually updated the SIFT Workstation for use in class, as well as for the wider community as a public resource. With over 125,000 downloads to date, the SIFT Workstation continues to be one of the most popular open-source incident-response and digital forensic offerings available.

Offered as an open source and free project, the SIFT Workstation is used in the following incident response courses at SANS:

"Even if SIFT were to cost tens of thousands of dollars, it would still be a very competitive product," says Alan Paller, director of research at SANS. "At no cost, there is no reason it should not be part of the portfolio in every organization that has skilled incident responders."

"The SIFT Workstation has quickly become my ‘go to’ tool when conducting an exam. The powerful open source forensic tools in the kit on top of the versatile and stable Linux operating system make for quick access to most everything I need to conduct a thorough analysis of a computer system," said Ken Pryor, GCFA, who has run countless cases supporting a variety of forensic and incident response priorities.

Key new SIFT Workstation features include:

    • Ubuntu LTS 20.04 Base
    • 64-bit base system
    • Better memory utilization
    • Auto-DFIR package update and customizations
    • Latest forensic tools and techniques
    • VM Appliance ready to tackle forensics
    • Cross compatibility between Linux and Windows
    • Option to install/upgrade stand-alone system via SIFT-CLI installer
    • Expanded Filesystem Support

    SIFT Workstation Capabilities

    A key tool during incident response, helping incident responders identify and contain advanced threat groups. The SIFT provides robust capabilities for analyzing file systems, network evidence, memory images, and more.

    File system support

    • NTFS (NTFS)
    • iso9660 (ISO9660 CD)
    • hfs (HFS+)
    • raw (Raw Data)
    • swap (Swap Space)
    • memory (RAM Data)
    • fat12 (FAT12)
    • fat16 (FAT16)
    • fat32 (FAT32)
    • ext2 (EXT2)
    • ext3 (EXT3)
    • ext4 (EXT4)
    • ufs1 (UFS1)
    • ufs2 (UFS2)

    Evidence Image Support

    • raw (Single raw file (dd))
    • aff (Advanced Forensic Format)
    • afd (AFF Multiple File)
    • afm (AFF with external metadata)
    • afflib (All AFFLIB image formats (including beta ones))
    • ewf (Expert Witness format (encase))
    • split raw (Split raw files) via affuse
    • affuse - mount 001 image/split images to view single raw file and metadata
    • split ewf (Split E01 files) via mount_ewf.py
    • mount_ewf.py - mount E01 image/split images to view single raw file and metadata
    • ewfmount - mount E01 images/split images to view single raw file and metadata
    • vmdk
    • vhd/vhdx
    • qcow

      Incident Response Support

      • F-Response Tool Suite Compatible
      • Rapid Scripting and Analysis
      • Threat Intelligence and Indicator of Compromise Support
      • Threat Hunting and Malware Analysis Capabilities

        Software Includes:

        • Plaso/log2timeline (Timeline Generation Tool)
        • Rekall Framework (Memory Analysis)
        • Volatility Framework (Memory Analysis)
        • 3rd Party Volatility Plugins
        • bulk_extractor
        • afflib
        • afflib-tools
        • ClamAV
        • dc3dd
        • imagemounter
        • libbde
        • libesedb
        • libevt
        • libevtx
        • libewf
        • libewf-tools
        • libewf-python
        • libfvde
        • libvshadow
        • lightgrep
        • Qemu
        • regripper and plugins
        • SleuthKit
        • Hundreds of additional tools


          SIFT Workstation and REMnux Compatibility

          REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. REMnux is used in SANS FOR610: Reverse Engineering Malware.

          REMnux can be added into a SIFT Workstation installation. To install REMnux, first install the SIFT Workstation using the instructions found above. Then, follow these instructions to add the REMnux components.

          SIFT Workstation How-Tos and Resources

          Reporting Issues

          Please report all issues, bugs, and feature requests to the GitHub project page, located here:

          https://github.com/sans-dfir/sift/issues

          SIFT Workstation Testimonials

          SIFT workstation is playing an essential role for the Brazilian national prosecution office, especially due to Brazilian government budgetary constraints. Its incident response and forensic capabilities are bundled in a way that allows an investigation to be conducted much faster than it would take if not having the right programs grouped on such a great Linux distribution. The new version, which will be bootable, will be even more helpful. I'd highly recommend SIFT for government agencies or other companies as a first alternative, for acquisition and analysis, from the pricey forensics software available on the market.

          - Marcelo Caiado, M.Sc., CISSP, GCFA, EnCE

          What I like the best about SIFT is that my forensic analysis is not limited because of only being able to run an incident response or forensic tool on a specific host operating system. With the SIFT VM Appliance, I can create snapshots to avoid cross-contamination of evidence from case to case, and easily manage system and AV updates to the host OS on my forensic workstation. Not to mention, being able to mount forensic images and share them as read-only with my host OS, where I can run other forensic tools to parse data, stream-lining the forensic examination process.

          - Brad Garnett www.digitalforensicsource.com

          Related Content

          Blog
          Digital Forensics and Incident Response
          Mapping SANS FOR578 Coverage to the Mandiant CTI Core Competencies Framework
          About a month ago, we wrapped up yet another superb running of the FOR578 course during the Rocky Mountain Summer 2022 event with several students remarking that the course is a must for individuals new to or looking to transition into a cyber threat intelligence analyst role. As the week...
          John_Doyle_370x370.png
          John Doyle
          read more
          Blog
          Untitled_design-43.png
          Digital Forensics and Incident Response, Cybersecurity and IT Essentials, Industrial Control Systems Security, Purple Team, Open-Source Intelligence (OSINT), Penetration Testing and Ethical Hacking, Cyber Defense, Cloud Security, Security Management, Legal, and Audit
          Good News: SANS Virtual Summits Will Remain FREE for the Community in 2022
          They’re virtual. They’re global. They’re free.
          Emily Blades
          read more
          Blog
          Digital Forensics and Incident Response
          Monitoring for Delegation Token Theft
          Delegation is a powerful feature of Windows authentication which allows one remote system to effectively forward a user's credentials to another remote system. This is sometimes referred to as the "double-hop". This great power does not come without great risk however, as the delegation access...
          370x370_Mike-Pilkington.jpg
          Mike Pilkington
          read more