SANS Investigative Forensics Toolkit

SANS Investigative Forensic ToolkitDeveloper(s)| SANS Institute

|

Initial release| December 13, 2008 (2008-12-13)
Stable release|

2.1 / August 4, 2011; 14 years ago (2011-08-04)

Operating system| Ubuntu
Available in| English
Type| Computer forensics
Website| computer-forensics.sans.org

The SANS Investigative Forensic Toolkit ("SIFT") is a computer forensics VMware appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with expert witness format (E01), advanced forensic format (AFF), and raw (dd) evidence formats. The new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.

## Contents

* 1 Use
* 1.1 File system support
* 1.2 Evidence image support
* 1.3 Software
* 2 References
* 3 Further reading
* 4 External links

## Use

The toolkit has the ability to securely examine raw disks, multiple file systems, and evidence formats. It places strict guidelines on how evidence is examined (read-only), verifying that the evidence has not changed.

### File system support

* Windows (MS-DOS, FAT, VFAT, NTFS)
* Mac (HFS)
* Solaris (UFS)
* Linux (ext2/3)

### Evidence image support

* Expert Witness (E01/L01)
* RAW (dd)
* Advanced Forensic Format (AFF)

### Software

* MantaRay (Automated Forensic Processing), MantaRay's GitHub
* The Sleuth Kit (File system analysis tools)
* log2timeline (timeline generation tool)
* ssdeep & md5deep (hashing tools)
* Foremost/Scalpel (File Carving)
* Wireshark (Network Forensics)
* Vinetto (thumbs.db examination)
* Pasco (IE Web History examination)
* Rifiuti (Recycle Bin examination)
* Volatility Framework (memory analysis)
* DFLabs PTK (GUI front-end for Sleuthkit)
* Autopsy (GUI front-end for Sleuthkit)
* PyFLAG (GUI Log/Disk examination)

## References

## Further reading

## External links

* SANS Digital Forensics and Incident Response web site

* v
* t
* e

Digital forensics

Branches|

* Computer forensics
* Mobile device forensics
* Network forensics
* Database forensics

Hardware|

* Forensic disk controller

Software|

* ADF Solutions Digital Evidence Investigator
* EnCase
* Foremost
* FTK
* Registry Recon
* PTK Forensics
* The Sleuth Kit
* The Coroner's Toolkit
* COFEE
* HashKeeper
* Xplico

Certification|

* Certified Forensic Computer Examiner (CFCE)
* Global Information Assurance Certification

Processes|

* Digital forensic process
* Data acquisition
* Digital evidence
* eDiscovery
* Anti-computer forensics

Organisations|

* National Software Reference Library
* American Society of Digital Forensics & eDiscovery
* Department of Defense Cyber Crime Center
* National Hi-Tech Crime Unit (NHTCU)
* Australian High Tech Crime Centre (AHTCC)

People|

* Mary Aiken
* Annie Antón
* Rebecca Bace
* Josh Brunty
* Eoghan Casey
* Hany Farid
* Simson Garfinkel
* Clifford Stoll
* Erik Laykin
* Robert Zeidman

Glossary of digital forensics terms

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Software:SANS_Investigative_Forensics_Toolkit&oldid=1029622"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template