SIFT Workstation vs SUMURI RECON LAB
SIFT Workstation
sans.orgSUMURI RECON LAB
sumuri.comSide by side
| Figure | SIFT Workstation | SUMURI RECON LAB |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Computer Forensics Software | 7.5 (#8) | 7.1 (#15) |
| Spec score · Digital Forensics Software | 7.5 (#19) | 7.2 (#24) |
| Evidence formats | Supported evidence image formats include raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX, and QCOW. | Supported sources include Mac images, AFF4 images, unencrypted Cellebrite .tar iOS extractions, and Griffeye Project VIC 2.0 hashsets. |
| Founded | 2007 | 2010 |
| Intended users | SANS describes SIFT as a key tool for incident responders investigating and containing advanced threat groups. | SUMURI describes its software and services as serving law enforcement, government, and corporate investigations worldwide. |
| Purpose | SIFT Workstation is a collection of free and open-source incident response and forensic tools for detailed digital forensic examinations. | RECON LAB is a forensic analysis suite that runs natively on macOS and analyzes Windows, macOS, and iOS evidence. |
| Support | The page directs users to [email protected] for download problems and to the GitHub project page for bugs and feature requests. | SUMURI offers product help by email or phone at +1 302.570.0015. |
Plans
In their own words
SIFT Workstation
SIFT Workstation is a free, open-source collection for incident response and detailed digital forensic examinations. It supports analysis of file systems, network evidence, memory images, threat intelligence and indicators of compromise. Included software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit and hundreds of additional tools. Evidence image formats listed are raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX and QCOW. Supported file systems include NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data and memory data. SIFT runs on Linux and Windows and can be self-hosted. Users can download an OVA virtual machine appliance listed at 8.81 GB, install natively on Ubuntu 22.04 with the Cast installer, or use Ubuntu 22.04 through Windows Subsystem for Linux with WSL 1 or WSL 2. REMnux components can be added. SANS directs download issues to [email protected] and bugs or feature requests to the GitHub project.
SUMURI RECON LAB
SUMURI RECON LAB has no write-up on Specifiction yet; its figures are above.