SIFT Workstation
Rob Lee and the SIFT team · SANS Institute · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A free Ubuntu LTS-based virtual machine appliance from SANS that bundles more than a hundred open-source incident response and forensic tools, pre-configured and dependency-resolved. It is still actively updated by Rob Lee and a small team and underpins several SANS DFIR courses.
Who it is for, and when
SIFT removes the install problem: Plaso, Volatility, TSK, bulk_extractor, and the rest are present and working together, which saves days of dependency wrangling and makes it far easier to reproduce a colleague's result on a known environment. That reproducibility is its strongest argument in expert work — naming SIFT and its version pins down a great deal about how an analysis was run. It is also the environment most DFIR training assumes, so published course workflows apply directly.
What it does not cover
SIFT is a packaged collection with no tool of its own, so every limitation of Volatility, Plaso, or TSK applies unchanged inside it. It is an analysis environment rather than an acquisition platform and offers no write blocking as a virtual machine, it has no case management or reporting layer, and its tool versions lag upstream — check the version of any tool you cite rather than assuming it is current.
Go to the source
Open at sans.org (opens in a new tab)https://www.sans.org/tools/sift-workstation/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Rob Lee and the SIFT team
- Publisher
- SANS Institute
- Year
- 2026
- Topics
- forensic-distro, incident-response, memory-forensics, timeline, linux, open-source
- Checked at source
Related entries
Volatility 3
FreeAn open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in memory, and command history. Volatility 3 is the actively developed line; Volatility 2 is legacy and should not be the basis of new work, though its documentation is still used for plugin comparison.
Memory acquisition and analysis across Windows, Linux and macOS, written by the people who built Volatility: process and kernel structures, code injection, rootkit detection, registry and event logs recovered from RAM, the GUI subsystem, network state, and case studies.
Two maintained live Linux distributions assembled for digital forensics. CAINE 14 'Lightstream' is built on Ubuntu 24.04 and is notable for a write-blocking system that locks all block devices read-only by default, with a GUI to unblock deliberately. Tsurugi Linux ships a LAB analysis edition, a lighter Acquire edition for imaging, and the BENTO portable live-response toolkit; its current LAB release is version 26.03.
MemProcFS
FreeAn open-source memory forensics tool that mounts a RAM image (or live memory) as a virtual file system, so processes, handles, registry, and network state appear as browsable files and directories rather than plugin output. It ships a Python and C API and a plugin ecosystem.
Timesketch
FreeAn open-source web application for collaborative timeline analysis, built around the idea of a sketch that several analysts annotate, tag, and search at once. It ingests Plaso storage files, CSV, and JSONL. The project states plainly that it is code owned by Google rather than an official Google product.