SANS Investigative Forensics Toolkit

SANS Investigative Forensic Toolkit
Developer(s)	SANS Institute
Initial release	December 13, 2008 (2008-12-13)

Stable release	2.1 / August 4, 2011 (2011-08-04)
Development status	Active
Operating system	Ubuntu
Available in	English
Type	Computer forensics
Website	computer-forensics.sans.org

The SANS Investigative Forensic Toolkit ("SIFT") is a computer forensics VMware appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with expert witness format (E01), advanced forensic format (AFF), and raw (dd) evidence formats. The new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.

Use

The toolkit has the ability to securely examine raw disks, multiple file systems, and evidence formats. It places strict guidelines on how evidence is examined (read-only), verifying that the evidence has not changed.

File system support

Windows (MS-DOS, FAT, VFAT, NTFS)
Mac (HFS)
Solaris (UFS)
Linux (ext2/3)

Evidence image support

Expert Witness (E01/L01)
RAW (dd)
Advanced Forensic Format (AFF)

Software

MantaRay (Automated Forensic Processing), MantaRay's GitHub
The Sleuth Kit (File system analysis tools)
log2timeline (timeline generation tool)
ssdeep & md5deep (hashing tools)
Foremost/Scalpel (File Carving)
Wireshark (Network Forensics)
Vinetto (thumbs.db examination)
Pasco (IE Web History examination)
Rifiuti (Recycle Bin examination)
Volatility Framework (memory analysis)
DFLabs PTK (GUI front-end for Sleuthkit)
Autopsy (GUI front-end for Sleuthkit)
PyFLAG (GUI Log/Disk examination)

External links

SANS Digital Forensics and Incident Response web site

Digital forensics

Branches	Computer forensics Mobile device forensics Network forensics Database forensics

Hardware	Forensic disk controller

Software	EnCase Foremost FTK Registry Recon PTK Forensics The Sleuth Kit The Coroner's Toolkit COFEE Selective file dumper HashKeeper Xplico

Certification	Certified Forensic Computer Examiner (CFCE) Global Information Assurance Certification

Processes	Digital forensic process Data acquisition Digital evidence eDiscovery Anti-computer forensics

Organisations	National Software Reference Library American Society of Digital Forensics & eDiscovery Department of Defense Cyber Crime Center National Hi-Tech Crime Unit (NHTCU) Australian High Tech Crime Centre (AHTCC)

People	Eoghan Casey Clifford Stoll Erik Laykin Robert Zeidman

Glossary of digital forensics terms

This article is issued from Wikipedia - version of the 9/10/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.