Skip to content
SPECIFICTION
Get listed

SIFT Workstation

sans.org

Free plan WindowsLinuxSelf-hosted
Visit sans.org
Spec score 7.5 #8 of 23 in Computer Forensics Software

What it is

SIFT Workstation is a free, open-source collection for incident response and detailed digital forensic examinations. It supports analysis of file systems, network evidence, memory images, threat intelligence and indicators of compromise. Included software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit and hundreds of additional tools. Evidence image formats listed are raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX and QCOW. Supported file systems include NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data and memory data. SIFT runs on Linux and Windows and can be self-hosted. Users can download an OVA virtual machine appliance listed at 8.81 GB, install natively on Ubuntu 22.04 with the Cast installer, or use Ubuntu 22.04 through Windows Subsystem for Linux with WSL 1 or WSL 2. REMnux components can be added. SANS directs download issues to [email protected] and bugs or feature requests to the GitHub project.

Spec sheet

Purpose
SIFT Workstation is a collection of free and open-source incident response and forensic tools for detailed digital forensic examinations.Read 7 Oct 2026 · sans.org
Intended users
SANS describes SIFT as a key tool for incident responders investigating and containing advanced threat groups.Read 7 Oct 2026 · sans.org
Support
The page directs users to [email protected] for download problems and to the GitHub project page for bugs and feature requests.Read 7 Oct 2026 · sans.org
Founded
2007Read 28 Sep 2026 · sans.org
Compatibility
The page says REMnux components can be added to a SIFT Workstation installation.Read 7 Oct 2026 · sans.org
Creator
Rob Lee created the original SIFT Workstation in 2007 to support forensic analysis in the SANS FOR508 class.Read 7 Oct 2026 · sans.org
Download
The page offers a virtual machine appliance download in OVA format listed as 8.81 GB and last updated 24 Apr, 2026.Read 7 Oct 2026 · sans.org
Evidence formats
Supported evidence image formats include raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX, and QCOW.Read 7 Oct 2026 · sans.org
File systems
Listed file system support includes NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data, and memory data.Read 7 Oct 2026 · sans.org
Included tools
The software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit, and hundreds of additional tools.Read 7 Oct 2026 · sans.org
Investigation work
It supports analysis of file systems, network evidence, memory images, threat intelligence, and indicators of compromise.Read 7 Oct 2026 · sans.org
Linux installation
The native installation instructions use Ubuntu 22.04 and the Cast installer.Read 7 Oct 2026 · sans.org
Protocol SIFT limitation
The page says the separate experimental Protocol SIFT initiative has not been validated for forensic soundness or evidentiary reliability and is not court-admissible.Read 7 Oct 2026 · sans.org
Windows installation
The page documents installing SIFT in Windows Subsystem for Linux with Ubuntu 22.04 and supports WSL 1 or WSL 2.Read 7 Oct 2026 · sans.org

Plans and prices

SIFT Workstation Free Free and open source OVA download (8.81 GB) · Ubuntu 22.04 installation options Read 7 Oct 2026 · sans.org

Every SIFT Workstation plan and price →

Strong points and limits

Strong points

  • Free and open-source forensic toolkit
  • Handles many evidence image formats
  • Supports Linux, Windows and self-hosting
  • Includes hundreds of tools
  • REMnux components can be added

Limits

  • OVA download is 8.81 GB
  • Native Linux instructions target Ubuntu 22.04
  • Windows use requires WSL
  • Protocol SIFT is not court-admissible

Who it suits

SIFT suits incident responders and forensic practitioners examining disk, network and memory evidence. It is also suitable for users wanting a self-hosted Linux or Windows forensic toolkit.

Verdict

SIFT Workstation provides a broad, free toolkit for digital investigations across common evidence formats and file systems. Its deployment options cover virtual machines, Ubuntu installations and Windows Subsystem for Linux.

Where Specifiction places it

Alternatives to SIFT WorkstationAll alternatives →