- Home
- Computer Forensics Software
- SIFT Workstation
SIFT Workstation
What it is
SIFT Workstation is a free, open-source collection of tools for incident response and detailed digital forensic examinations. It supports investigations involving file systems, network evidence, memory images, threat intelligence, and indicators of compromise. Its tool collection includes Plaso, Rekall, Volatility, ClamAV, SleuthKit, and hundreds of other tools. Supported evidence images include raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX, and QCOW. Listed file systems range from NTFS, HFS+, and FAT variants to ext2/3/4, UFS1/2, ISO9660, swap, raw data, and memory data. SIFT is available for Linux and Windows and can be self-hosted. The download page offers an 8.81 GB OVA virtual machine appliance, while Linux installation instructions use Ubuntu 22.04 and the Cast installer. Windows instructions cover Ubuntu 22.04 through WSL 1 or WSL 2. REMnux components can also be added. Rob Lee created the original workstation in 2007 for forensic analysis in the SANS FOR508 class. The separate experimental Protocol SIFT initiative has not been validated for forensic soundness or evidentiary reliability and is not court-admissible.
For and against
For
- Free and open-source.
- Covers file systems, network evidence, and memory images.
- Includes Plaso, Rekall, Volatility, ClamAV, and SleuthKit.
- Supports a broad range of evidence image formats.
- Can be installed on Linux or through Windows Subsystem for Linux.
Against
- The OVA download is 8.81 GB.
- Native Linux instructions use Ubuntu 22.04 and the Cast installer.
- Protocol SIFT is not court-admissible.
The verdict
SIFT Workstation brings a wide range of forensic and incident response tools into one free collection, with several installation options. Keep its separate experimental Protocol SIFT initiative distinct: it is not validated for forensic soundness or evidentiary reliability.
Who it suits
SIFT Workstation suits incident responders and forensic examiners who need tools for investigating files, network evidence, memory, and threat indicators. Its documented Linux and Windows installation paths may also suit teams working in either environment.
Plans and prices
SIFT Workstation
OVA download (8.81 GB) · Ubuntu 22.04 installation options
Read 7 Oct 2026 · sans.org
On the record
- Compatibility
- The page says REMnux components can be added to a SIFT Workstation installation.sans.org · read 7 Oct 2026
- Creator
- Rob Lee created the original SIFT Workstation in 2007 to support forensic analysis in the SANS FOR508 class.sans.org · read 7 Oct 2026
- Download
- The page offers a virtual machine appliance download in OVA format listed as 8.81 GB and last updated 24 Apr, 2026.sans.org · read 7 Oct 2026
- Evidence formats
- Supported evidence image formats include raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX, and QCOW.sans.org · read 7 Oct 2026
- File systems
- Listed file system support includes NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data, and memory data.sans.org · read 7 Oct 2026
- Included tools
- The software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit, and hundreds of additional tools.sans.org · read 7 Oct 2026
- Intended users
- SANS describes SIFT as a key tool for incident responders investigating and containing advanced threat groups.sans.org · read 7 Oct 2026
- Investigation work
- It supports analysis of file systems, network evidence, memory images, threat intelligence, and indicators of compromise.sans.org · read 7 Oct 2026
- Linux installation
- The native installation instructions use Ubuntu 22.04 and the Cast installer.sans.org · read 7 Oct 2026
- Protocol SIFT limitation
- The page says the separate experimental Protocol SIFT initiative has not been validated for forensic soundness or evidentiary reliability and is not court-admissible.sans.org · read 7 Oct 2026
- Purpose
- SIFT Workstation is a collection of free and open-source incident response and forensic tools for detailed digital forensic examinations.sans.org · read 7 Oct 2026
- Support
- The page directs users to [email protected] for download problems and to the GitHub project page for bugs and feature requests.sans.org · read 7 Oct 2026
- Windows installation
- The page documents installing SIFT in Windows Subsystem for Linux with Ubuntu 22.04 and supports WSL 1 or WSL 2.sans.org · read 7 Oct 2026
