Sans investigative forensic toolkit workstation
The SANS SIFT Workstation is a VMware Appliance, built on top of Ubuntu, that is preconfigured with all the necessary tools to perform a forensic examination. It is compatible with Expert Witness Format, Advanced Forensic Format (aff) evidence formats.
SIFT Workstation is based on Ubuntu.
- The Sleuth Kit
- ssdeep & md5deep
- Vinetto (thumbs.db examination)
- Volatility Framework
- DFLabs PTK (GUI Front-End for The Sleuth Kit
- Autopsy (GUI Front-End for The Sleuth Kit
The SIFT Workstation will allow evidence to be viewed from a Windows workstation. The /images directory and the evidence mount point, the /mnt/hack directory, can be viewed from the local Windows operating system.