SANS – Investigative Forensic Toolkit (Free Download)



SIFT (SANS Investigative Forensics Toolkit) is a collection of various tools to aid you in performing forensics analysis tasks.


We tried to make the installation (and upgrade) of the SIFT workstation as simple as possible, so we create the SIFT Bootstrap project, which is a shell script that can be downloaded and executed to convert your Ubuntu installation into a SIFT workstation.
Get the Toolkit here on Github.

Supported Filesystems.

The forensics toolkit supports the following file systems.

  1. ntfs (NTFS)
  2. iso9660 (ISO9660 CD)
  3. hfs (HFS+)
  4. raw (Raw Data)
  5. swap (Swap Space)
  6. memory (RAM Data)
  7. fat12 (FAT12)
  8. fat16 (FAT16)
  9. fat32 (FAT32)
  10. ext2 (EXT2)
  11. ext3 (EXT3)
  12. ext4 (EXT4)
  13. ufs1 (UFS1)
  14. ufs2 (UFS2)
  15. vmdk

Evidence Image File Support.

The forensics toolkit supports the following image files.

  1. raw (Single raw file (dd))
  2. aff (Advanced Forensic Format)
  3. afd (AFF Multiple File)
  4. afm (AFF with external metadata)
  5. afflib (All AFFLIB image formats (including beta ones))
  6. ewf (Expert Witness format (encase))
  7. split raw (Split raw files) via affuse