OSForensics vs SIFT Workstation
OSForensics
osforensics.comSIFT Workstation
sans.orgSide by side
| Figure | OSForensics | SIFT Workstation |
|---|---|---|
| Price from | $78.75/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Windows | Yes | Yes |
| Linux | — | Yes |
| Android | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 7 | 1 |
| Spec score · Computer Forensics Software | 8.2 (#3) | 7.5 (#8) |
| Spec score · Digital Forensics Software | 8.1 (#10) | 7.5 (#19) |
| Purpose | OSForensics is digital investigation software for extracting forensic data from computers. | SIFT Workstation is a collection of free and open-source incident response and forensic tools for detailed digital forensic examinations. |
| Support | Purchases include business-hours support by phone, email or online forums; the trial edition includes free public forum support. | The page directs users to [email protected] for download problems and to the GitHub project page for bugs and feature requests. |
Plans
OSForensics
- OSForensics FreeFree
- OSForensics Trial EditionFree
- OSForensics Subscription$95 a month
- OSForensics Subscription$945 a year
- OSForensics Perpetual License (12 months support)$1,680, paid once
- OSForensics Perpetual License (36 months support)$3,675, paid once
- OSForensics Site LicensePriced on request
In their own words
OSForensics
OSForensics is digital investigation software for extracting and examining forensic data from computers. It searches and indexes files, looks inside documents and email archives, and attempts to recover deleted files. Hashing can verify evidence or compare it with known files, while extension checks can flag files whose extensions are incorrect. The software can surface recent activity such as opened documents, web history, connected USB devices, and network shares. Password tools target commonly used web browsers and can use rainbow tables to retrieve passwords from hashes. Investigators can group evidence into case files, cryptographically hash data, and export reports readable as HTML or PDF, with narratives and external reports. It can maintain a secure audit trail and create or restore disk images for analysis. OSForensics can also run from a portable USB drive. Listed evidence sources include Windows, Mac, Linux, Android, and iOS/macOS file systems, plus disk images, memory dumps, email, browser data, registry hives, SQLite, and ESE databases. Windows 7, 8, 10, and 11 are listed, as are several Windows Server versions. A free license and a 30-day trial are listed; subscription pricing is $95 per user per month.
SIFT Workstation
SIFT Workstation is a free, open-source collection for incident response and detailed digital forensic examinations. It supports analysis of file systems, network evidence, memory images, threat intelligence and indicators of compromise. Included software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit and hundreds of additional tools. Evidence image formats listed are raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX and QCOW. Supported file systems include NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data and memory data. SIFT runs on Linux and Windows and can be self-hosted. Users can download an OVA virtual machine appliance listed at 8.81 GB, install natively on Ubuntu 22.04 with the Cast installer, or use Ubuntu 22.04 through Windows Subsystem for Linux with WSL 1 or WSL 2. REMnux components can be added. SANS directs download issues to [email protected] and bugs or feature requests to the GitHub project.