Belkasoft X Forensic vs SIFT Workstation
Belkasoft X Forensic
belkasoft.comSIFT Workstation
sans.orgSide by side
| Figure | Belkasoft X Forensic | SIFT Workstation |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Computer Forensics Software | 8.2 (#2) | 7.5 (#8) |
| Spec score · Digital Forensics Software | 8.2 (#7) | 7.5 (#19) |
| Spec score · Incident Response Software | 8.2 (#6) | 7.4 (#15) |
| Founded | 2002 | 2007 |
| Intended users | Belkasoft describes X Forensic as suited to digital forensic laboratories at federal law-enforcement agencies and state-level police departments. | SANS describes SIFT as a key tool for incident responders investigating and containing advanced threat groups. |
| Purpose | Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources. | SIFT Workstation is a collection of free and open-source incident response and forensic tools for detailed digital forensic examinations. |
| Support | Belkasoft lists [email protected] as its support contact. | The page directs users to [email protected] for download problems and to the GitHub project page for bugs and feature requests. |
Plans
In their own words
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources. Its acquisition options include DD/E01 imaging, iOS checkm8 and agent-based acquisition, and several Android methods. Analysis features include timeline and connection graph views, SQLite recovery, hash-set analysis, file carving, and picture and video analysis. The software can examine UFED and GrayKey images, virtual machines, Amazon S3-based images, Berla car exports, and data from services including Google Drive, iCloud, Microsoft 365, WhatsApp, and Telegram. Reports can be produced in formats such as HTML, XML, CSV, PDF, Excel, Word, ProjectVIC JSON, and Relativity Short Message Format. Colleagues can view shared findings with the free Evidence Reader, whether or not X Forensic is installed. The product is self-hosted and offered to government customers only. Its license is perpetual, with optional annual software maintenance and support; pricing is provided by quote. A 30-day trial requires internet access. Trial reports contain half of randomly selected artifacts, and several acquisition, decryption, virtual-machine, and command-line automation features are excluded. The company describes it as suited to digital forensic laboratories at federal and state-level law-enforcement agencies.
SIFT Workstation
SIFT Workstation is a free, open-source collection for incident response and detailed digital forensic examinations. It supports analysis of file systems, network evidence, memory images, threat intelligence and indicators of compromise. Included software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit and hundreds of additional tools. Evidence image formats listed are raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX and QCOW. Supported file systems include NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data and memory data. SIFT runs on Linux and Windows and can be self-hosted. Users can download an OVA virtual machine appliance listed at 8.81 GB, install natively on Ubuntu 22.04 with the Cast installer, or use Ubuntu 22.04 through Windows Subsystem for Linux with WSL 1 or WSL 2. REMnux components can be added. SANS directs download issues to [email protected] and bugs or feature requests to the GitHub project.