SIFT

SIFTDeveloper(s)| Rob Lee Harbingers LLC

|

Initial release| December 13, 2008 (2008-12-13)
Repository| github.com/sans-dfir/sift
Operating system| Ubuntu
Available in| English
Type| Computer forensics
Website| digital-forensics.sans.org

SIFT is a computer forensics distribution that installs all necessary tools on Ubuntu to perform a detailed digital forensic and incident response examination. It is compatible with expert witness format (E01), advanced forensic format (AFF), raw (dd), and memory analysis evidence formats.

## Contents

* 1 Use
* 1.1 File system support
* 1.2 Evidence image support
* 1.3 Software[1]
* 1.4 Features
* 2 References
* 3 External links

## Use

The toolkit has the ability to securely examine raw disks, multiple file systems, and evidence formats. It places strict guidelines on how evidence is examined (read-only), verifying that the evidence has not changed.

### File system support

* Windows (MS-DOS, FAT, VFAT, NTFS)
* Mac (HFS)
* Solaris (UFS)
* Linux (ext2/3)

### Evidence image support

* Expert Witness (E01/L01)
* RAW (dd)
* Advanced Forensic Format (AFF)

*Memory Forensics Images

### Software[1]

* The Sleuth Kit (file system analysis tools)
* Plaso and log2timeline (timeline generation tools)
* ssdeep & md5deep (hashing tools)
* Foremost/Scalpel (file carving)
* Wireshark (network forensics)
* Volatility Framework (memory analysis)
* Autopsy (GUI front-end for Sleuthkit)

### Features

1) Ubuntu LTS 16.04 Base

2) 64-bit base system

3) Auto-DFIR package update and customization.

4) VMware appliance ready to tackle forensics.

5) Cross-compatibility between Windows and Linux.

6) Choice to install stand-alone via (.iso) or use VMware player/Workstation.

## References

1. ↑ "Investigate and fight cyberattacks with SIFT Workstation". https://www.sans.org/blog/investigate-and-fight-cyberattacks-with-sift-workstation/.

## External links

* SANS Digital Forensics and Incident Response website

* v
* t
* e

Digital forensics

Branches|

* Computer forensics
* Mobile device forensics
* Network forensics
* Database forensics

Hardware|

* Forensic disk controller

Software|

* ADF Solutions Digital Evidence Investigator
* EnCase
* Foremost
* FTK
* Registry Recon
* PTK Forensics
* The Sleuth Kit
* The Coroner's Toolkit
* COFEE
* HashKeeper
* Xplico

Certification|

* Certified Forensic Computer Examiner (CFCE)
* Global Information Assurance Certification

Processes|

* Digital forensic process
* Data acquisition
* Digital evidence
* eDiscovery
* Anti-computer forensics

Organisations|

* National Software Reference Library
* American Society of Digital Forensics & eDiscovery
* Department of Defense Cyber Crime Center
* National Hi-Tech Crime Unit (NHTCU)
* Australian High Tech Crime Centre (AHTCC)

People|

* Mary Aiken
* Annie Antón
* Rebecca Bace
* Josh Brunty
* Eoghan Casey
* Hany Farid
* Simson Garfinkel
* Clifford Stoll
* Erik Laykin
* Robert Zeidman

Glossary of digital forensics terms

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Software:SIFT&oldid=3898648"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template