Skip to content
Pre-launch / First modules December 14, 2026.Lessons and community run on Skoolhttps://www.skool.com/dfir
DFIR
SIFT Workstation / since 2007

SIFT Workstation. Your forensic toolkit.

A free, Ubuntu based investigator's workstation that gathers open source forensic and incident response tools into one environment. Spend more time asking what happened, and less time assembling the kit needed to find out.

Install SIFT View the source
Get SIFT

Get SIFT

Latest release
v2026.10.19, 2026-10-19. Checked 2026-11-09; manually recorded upstream recipe release, not a DFIR.com image.
Status
DFIR.com will offer its own virtual machine image here, with a published hash and signature, when it is ready. Until then, install from source using the guide.

Install Cast first, then use the recipe README command:

sudo cast install teamdfir/sift-saltstack

README revision, checked 2026-11-09. Individual tools keep their own licenses.

Install SIFTView the source on GitHub

Built SIFT Workstation in 2007 because analysts needed a consistent toolkit instead of hunting down utilities at 2 AM during an active incident.

Hear when SIFT releases and modules open.

One email when there is something to learn from. No payment, nothing to buy.

An investigator's problem

Not a product category. A workbench.

SIFT's value is not that one program answers every investigative question. It is that analysts work from an assembled environment, with a virtual machine appliance and documented installation options, rather than rebuilding a toolkit from scratch at the moment it matters most.

The environment is free. Individual tools keep their own licenses and authors; the Workstation is what brings them together.

What it helps you do

Documented scope

These describe the project's documented capabilities, not a tested manifest of a specific dfir.com release.

  • IMG

    Disk and image examination

    Work with forensic images using utilities for formats including EWF/E01, AFF, and split raw images.

  • MEM

    Memory analysis

    The Volatility Framework is part of the Workstation's memory analysis tooling.

  • TLN

    Timeline reconstruction

    Plaso and log2timeline generate timelines for investigating activity across artifacts.

  • NET

    Broader incident investigation

    Analyze file system and network evidence, with documented threat hunting and indicator of compromise capabilities.

  • MAL

    Alongside malware analysis

    Published guidance covers combining SIFT with REMnux, keeping the DFIR starting point distinct from a malware analysis one.

Supported Ubuntu releases differ between the project's installation page and repository. Check teamdfir/sift for current guidance before you build.

Project history

Built for investigation. Developed together.

SIFT began as a forensic classroom environment and grew into a toolkit for the wider community. Maintainers and upstream tool authors continue to shape the tools available for practical investigation.

  1. 2007

    Creation

    The original Workstation supports forensic analysis. This marks the creation year, not a separately verified first public release.

    SIFT project history
  2. 2010

    SIFT 2.0

    The March 26, 2010 release introduced a preconfigured environment for detailed forensic examination.

    2010 release announcement
  3. 2014

    SIFT 3.0

    Announced January 6, 2014 as a complete rebuild for a March debut at DFIRCON: Ubuntu LTS 12.04 base, 64 bit, updated forensic tools, credited to an international team of forensic experts.

    2014 announcement
  4. 2023

    Cast

    On March 1, 2023 the repository marks SIFT CLI as deprecated and names Cast as its replacement installer.

    teamdfir/sift
  5. 2026

    An experimental chapter

    Protocol SIFT introduces experimental AI-assisted workflows, followed by FIND EVIL!, a community challenge using the Workstation's tooling.

    Project introduction
Practitioner reading

From the record

Historical writing by people who used and studied SIFT. Each is summarized and linked to its original context. None is an endorsement of this site or of any current release.

  • January 2018 / 1234n6

    Adam Harrison

    A technical walkthrough introducing SIFT to forensic investigators and incident responders, with context on the community maintaining the toolkit.

    Read the original
  • Date not established / Marshall University hosted research poster

    Cervellone, Price, Brunty and Fenger

    An evaluation of SIFT 3.0 that found it viable for a digital forensics environment on cost and functionality, with the stated qualification that this viability comes with a learning curve.

    Read the original
Separate and experimental

Protocol SIFT is not the Workstation

Protocol SIFT explores AI assisted orchestration inside the SIFT environment, coordinating tools and investigative steps while keeping human interpretation and oversight central. Its official description says it is separate from, and does not modify or replace, the core SIFT Workstation.

It is a working integration, not a finished product. Experimental workflows require human review.

Project introductionteamdfir/protocol-siftFIND EVIL! results archive
Begin

A practical place to start

Two supported paths: install with Cast on Ubuntu, or download the virtual machine appliance. Keep your work inspectable, and the responsibility for conclusions visible.

Installation Learning paths

Upstream source: github.com/teamdfir/sift. Individual tools retain their own licenses; the metadata repository uses MIT. Install guidePractitioner voices

Last reviewed