SIFT Workstation
SIFT Workstation is a free, open-source collection of tools for incident response and digital forensic examination.
What SIFT Workstation is
SIFT Workstation is a free, open-source collection of tools for incident response and digital forensic examination. It supports investigation of file systems, network evidence, memory images, threat intelligence, and indicators of compromise. Included tools range from Plaso, Rekall, Volatility, ClamAV, and SleuthKit to hundreds of additional utilities. Supported evidence images include raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX, and QCOW; listed file systems include NTFS, HFS+, FAT variants, ext2/3/4, and others. SIFT is available for Linux and Windows and can be self-hosted. Installation guidance covers Ubuntu 22.04 with the Cast installer, or Ubuntu 22.04 through Windows Subsystem for Linux with WSL 1 or WSL 2. An OVA virtual machine appliance download is listed at 8.81 GB. REMnux components can be added to an installation. The separate experimental Protocol SIFT initiative has not been validated for forensic soundness or evidentiary reliability and is not court-admissible.
Good
- Free and open-source tool collection.
- Supports network, file-system, and memory analysis.
- Includes hundreds of additional tools.
- Supports multiple evidence image formats.
- Available for Linux and Windows.
Watch out
- OVA appliance download is listed as 8.81 GB.
- Native Linux instructions use Ubuntu 22.04.
- Protocol SIFT is not court-admissible.
Who it suits
SIFT Workstation suits incident responders and forensic practitioners examining varied digital evidence. It may also fit users who can install or self-host tools on Linux or Windows.
Verdict
SIFT Workstation offers a broad toolkit for incident response and forensic examinations across several evidence types. Note that the Protocol SIFT limitation applies to that separate experimental initiative, not as a claim about the workstation itself.
Plans and prices
From SIFT Workstation's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| SIFT Workstation | Free | OVA download (8.81 GB) · Ubuntu 22.04 installation options · Free and open source |
The facts
Each one read from SIFT Workstation's own pages, with the date it was checked.
What it does
- Compatibility
- The page says REMnux components can be added to a SIFT Workstation installation.checked 7 Oct 2026
- Creator
- Rob Lee created the original SIFT Workstation in 2007 to support forensic analysis in the SANS FOR508 class.checked 7 Oct 2026
- Download
- The page offers a virtual machine appliance download in OVA format listed as 8.81 GB and last updated 24 Apr, 2026.checked 7 Oct 2026
- Evidence formats
- Supported evidence image formats include raw, AFF, EWF, split raw, split EWF, VMDK, VHD/VHDX, and QCOW.checked 7 Oct 2026
- File systems
- Listed file system support includes NTFS, HFS+, FAT12/16/32, ext2/3/4, UFS1/2, ISO9660, swap, raw data, and memory data.checked 7 Oct 2026
- Included tools
- The software includes Plaso, Rekall, Volatility, ClamAV, SleuthKit, and hundreds of additional tools.checked 7 Oct 2026
- Intended users
- SANS describes SIFT as a key tool for incident responders investigating and containing advanced threat groups.checked 7 Oct 2026
- Investigation work
- It supports analysis of file systems, network evidence, memory images, threat intelligence, and indicators of compromise.checked 7 Oct 2026
- Protocol SIFT limitation
- The page says the separate experimental Protocol SIFT initiative has not been validated for forensic soundness or evidentiary reliability and is not court-admissible.checked 7 Oct 2026
- Purpose
- SIFT Workstation is a collection of free and open-source incident response and forensic tools for detailed digital forensic examinations.checked 7 Oct 2026
- Support
- The page directs users to [email protected] for download problems and to the GitHub project page for bugs and feature requests.checked 7 Oct 2026
The company
- Founded
- 2007checked 28 Sep 2026
Where it runs
- Linux installation
- The native installation instructions use Ubuntu 22.04 and the Cast installer.checked 7 Oct 2026
- Windows installation
- The page documents installing SIFT in Windows Subsystem for Linux with Ubuntu 22.04 and supports WSL 1 or WSL 2.checked 7 Oct 2026
Alternatives to SIFT Workstation
- 1
Paraben E3 Forensic Platform
AndroidiOSLinuxmacOS7.1From $699 a year - 2
OSForensics
Free planAndroidSelf-hostedWindows7.0From $945 a year - 3
Belkasoft X Forensic
AndroidiOSLinuxmacOS6.5 - 4
MOBILedit Forensic
Windows6.4€99 one-time - 5
Cellebrite Inseyets
WebWindows6.2 - 6
The Sleuth Kit
Free planAPILinuxmacOSSelf-hosted6.2Free plan