SIFT SANS Investigate Forensic Toolkit Version 2.14 released (Support of Mobile Forensics)

An international team of forensics experts, led by SANS Faculty Fellow Rob Lee, created the SANS Investigative Forensic Toolkit (SIFT) Workstation and made it available to the whole community as a public service. The free SIFT toolkit, that can match any modern forensic tool suite, is also featured in SANS’ Advanced Computer Forensic Analysis and Incident Response course (FOR 508). It demonstrates that advanced investigations and responding to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

The SIFT Workstation is a VMware appliance, pre-configured with the necessary tools to perform detailed digital forensic examination in a variety of settings. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The brand new version has been completely rebuilt on an Ubuntu base with many new capabilities and tools such as log2timeline that provides a timeline that can be of enormous value to investigators.

SIFT 2.0 was a massive success, SIFT 2.14 will hope to again exceed expectations. As voted by you, the readers, the 2010 Toolsmith Tool of the Year was SIFT 2.0. The SANS Investigative Forensic Toolkit (SIFT) Workstation Version 2.0, as discussed in May’s ISSA Journal, is a Linux distribution that is preconfigured for forensic investigations. SIFT 2.0 includes all the tools a forensic analyst/incident responder would require to conduct a thorough system investigation. I particularly favor it for memory analysis – grab a memory image from your victim system; pull it back to your SIFT VM and get down to business in no time flat