The toolkit, over time.
SIFT is downloaded about 60,000 times a year, as reported in August 2026,
Built SIFT Workstation in 2007 because analysts needed a consistent toolkit instead of hunting down utilities at 2 AM during an active incident.
Rob T. Lee, Introducing Protocol SIFT, January 16, 2026. Creator's retrospective, not an independent testimonial.
An investigation before a distribution
The starting problem in that account is consistency. A collection of forensic utilities is not yet a dependable working environment: each program has installation requirements, input formats and dependencies. The published origin story describes assembling those capabilities so the examiner can concentrate on evidence. It does not claim that a single program can answer every question or that installing a toolkit validates the conclusions drawn from it. The distinction matters when reading later descriptions of an appliance, an installer or an experimental investigation workflow.1
This account separates a creation year, a release announcement and an observed installation. They are different kinds of evidence. A retrospective may explain why a project began without establishing the first public download date. An announcement can describe an intended debut without proving exactly when every file became available. A practitioner's successful installation demonstrates one person's environment, not universal compatibility. Where the supplied record cannot support a more precise statement, the question stays open below.
2007: a classroom origin2
The project history credits Rob Lee with creating the original Workstation. His later account connects it to the practical need for a consistent toolkit during an incident. This is the documented origin, not a separately verified first public release date.12
The project history describes subsequent updates for classroom and public use. This is an important part of the account: a workstation initially assembled for teaching can be useful outside that setting, but classroom use and public distribution should not be collapsed into a single event. The available material does not provide a complete early release manifest or identify the first inclusion date of every utility. Those details belong in a release archive if one is recovered, not in a reconstructed list presented as fact.2
March 26, 2010: SIFT 2.03
Daniel Wesemann's dated announcement describes SIFT 2.0 as a preconfigured virtual appliance for detailed forensic examination. The significant change documented here is the packaged environment: the reader is being introduced to a workstation that brings analysis tools together, rather than a new name for one forensic program. Wesemann is credited as the author of the announcement. That byline does not by itself make him the author of every tool or the maintainer of the appliance.3
An appliance packages a particular environment, while the tools inside it retain their own authors and histories. This account therefore does not attribute upstream tool development to the workstation creator. Nor does it carry old import settings, credentials or compatibility assumptions forward into today's installation guidance. The historical announcement supports the milestone; it is not an instruction to obtain an old image and use it for current casework. Current installation and release information are documented separately.
January 6, 2014: the SIFT 3.0 announcement4
The release announcement describes a complete rebuild, an Ubuntu LTS 12.04 base, a 64-bit system and updated forensic tools. It announces a planned March debut rather than supplying a complete file-by-file publication record. That wording is retained here: the announcement date is known, while the exact availability of every resulting artifact is not established by this source alone. The rebuild is a documented change to the environment, not evidence that all current tools were already present.4
The same announcement credits an international team of forensic experts alongside the creator. That public credit is broader than a single-author account but does not supply a complete named roster. It also reports more than 100,000 downloads to that point. The number is a historical download count, not a count of people trained, active users, organizations using the workstation, or installations running today. These distinctions prevent a period-specific announcement from becoming an unsupported contemporary adoption claim.4
January 23, 2018: a documented WSL route6
Adam Harrison's installation account records using the workstation's tools through Windows Subsystem for Linux. It uses the older SIFT CLI and describes packages-only installation, image-mounting limitations and graphical-application considerations. Its value in this history is the dated, concrete account of an examiner adapting the environment to another working setup. It should not be read as proof that all native Linux capabilities were available under that version of WSL.6
The limitations are part of the evidence, not qualifications to remove from a success story. A toolkit's commands may run while a particular image-mounting method does not. The account documents that distinction and gives context for later installation guidance. This page links the original rather than reproducing a testimonial: permission to reuse practitioner quotations as promotional material has not been documented, and historical technical writing is not an endorsement of DFIR.com.
March 1, 2023: the installer transition5
The SIFT CLI repository marks this as its deprecation date and names Cast as the replacement. This is a change in the installation mechanism, not a claim that the workstation or its underlying tools ceased to exist. Cast installs a system using the recipe maintained in sift-saltstack. Separating installer, recipe and built image makes the transition easier to understand and avoids treating their different version numbers as interchangeable.5
June 3, 2024: Cast in a practitioner workflow7
The dated WSL account uses Ubuntu 22.04, a Cast package and the server-mode recipe, then performs a basic Volatility help check. It records a different installation path from Harrison's earlier account. A successful help command is useful evidence that an entry point starts, but it is not a full validation of memory analysis or of every package in the workstation. The current guide distinguishes those basic checks from a reproducible synthetic-data smoke test.7
January 16, 2026: an experimental chapter1
Rob's introduction of Protocol SIFT places experimental AI-assisted investigation alongside the workstation's tools. The origin quotation at the top of this page comes from that retrospective. Protocol SIFT is presented separately from the core Workstation, not as proof that an autonomous process has been validated for legal use. Human review, reproducibility and the interpretation of evidence remain distinct questions. This history does not turn an experimental workflow into a demonstrated forensic capability merely because it can call existing utilities.1
Tool lineage
The supplied sources identify important capabilities but do not establish first-shipped releases for these individual tools. The table preserves those gaps rather than assigning a join date from a current manifest. A present-day state file is evidence of present configuration, not proof of when a tool originally joined.
| Tool or family | First SIFT release | Evidence boundary |
|---|---|---|
| Volatility | Not yet documented | Requires a dated release manifest or contemporary inclusion record. |
| Plaso / log2timeline | Not yet documented | Requires a dated release manifest or contemporary inclusion record. |
| The Sleuth Kit | Not yet documented | Requires a dated release manifest or contemporary inclusion record. |
| Forensic image utilities | Not yet documented | Requires a dated release manifest or contemporary inclusion record. |
People and credit
Erik Kristensen wrote the 2017 SaltStack-based tooling and the installers that followed (sift-cli, then cast), per the release history on GitHub.89
Rob T. Lee is credited with creating the Workstation by the project history and his retrospective. Daniel Wesemann is credited here for the release announcement he wrote, and Adam Harrison for the installation account he published. Those are different contributions. The rebuild announcement credits a wider team without a complete named list. The supplied source set does not establish a comprehensive maintainer roster, so this page does not promote quoted practitioners into maintainers or assign responsibility for undocumented releases.12346
What is not yet documented
- The exact first public release date, distinct from the creation year.
- A complete early release archive and tool-by-tool inclusion chronology.
- A sourced maintainer roster showing responsibility across releases.
- Rob's answers to the remaining founder questions and approval of this draft.
- Permission records for practitioner quotations. No practitioner quotation section is published.
- A publication date for this new article. It is a preview draft, so Article datePublished is intentionally not asserted.
Sources
- Introducing Protocol SIFT. January 16, 2026.
- SIFT Workstation project history. Publication date not stated.
- SIFT 2.0 release announcement. March 26, 2010.
- SIFT Workstation version 3.0 debut announcement. January 6, 2014.
- SIFT CLI deprecation notice. Effective March 1, 2023.
- Installing SIFT Workstation under Windows Subsystem for Linux. January 23, 2018.
- Installing the latest SIFT Workstation in WSL. June 3, 2024.
- SIFT SaltStack release history. GitHub release history.
- Cast release history. GitHub release history.
Founder sign-off: pending. Rob has not yet confirmed this draft. No approval date is recorded.
Last reviewed