SANS Investigative Forensics Toolkit

SANS Investigative Forensic Toolkit
Developer(s) SANS Institute
Initial release December 13, 2008 (2008-12-13)
Stable release
2.1 / August 4, 2011 (2011-08-04)
Development status Active
Operating system Ubuntu
Available in English
Type Computer forensics
Website computer-forensics.sans.org

The SANS Investigative Forensic Toolkit ("SIFT") is a computer forensics VMware appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with expert witness format (E01), advanced forensic format (AFF), and raw (dd) evidence formats. The new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.

Use

The toolkit has the ability to securely examine raw disks, multiple file systems, and evidence formats. It places strict guidelines on how evidence is examined (read-only), verifying that the evidence has not changed.

File system support

Evidence image support

Software

This article is issued from Wikipedia - version of the 9/10/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.