SIFT / Tools

SIFT tool index

60 tools across 10 task groups. Every row links its upstream project, the license evidence we read, and the Salt state that pulls it in.

Release: v2026.10.19
Commit: 9a921997b66b
Checked: 2026-11-09
Root state: sift/server.sls

Scope: inclusion means the tool is referenced in the pinned SIFT source, not that it was run on a clean machine. A curated index of included applications, not every dependency. Package versions may vary because the recipe uses live package repositories. License labels describe the primary project; component terms remain in the linked notices. Debian notices are distribution evidence, not an audit of the installed Ubuntu binaries. Module links point to related planned learning, not a claim that each tool is taught. To check your own install, run the shared smoke test and verify what you install.

Search name, summary or category

Showing 60 of 60

afflib-tools
Acquisition
Inspect and convert Advanced Forensic Format disk images.
- Upstream
- License: public-domain + component licenses
- Salt state
- Learning module
dc3dd
Acquisition
Copy disk evidence while calculating hashes and recording acquisition details.
- Upstream
- License: GPL-3+ + component licenses
- Salt state
- Source
- Learning module
dcfldd
Acquisition
Create disk copies with hashing, progress reporting and split output.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Learning module
GNU ddrescue
Acquisition
Recover readable regions from failing media using a resumable map file.
- Upstream
- License: GPL-2+
- Salt state
- Source
- Learning module
libewf-tools
Acquisition
Read, verify and export Expert Witness Format evidence images.
- Upstream
- License: LGPL-3+ + component licenses
- Salt state
- Learning module
safecopy
Acquisition
Recover data from damaged media using low-level read strategies.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Source
- Learning module
xmount
Acquisition
Expose forensic images through virtual disk formats for downstream analysis.
- Upstream
- License: GPL-3+ + component licenses
- Salt state
- Learning module
autopsy
File systems
Explore disk evidence through the classic browser-based Sleuth Kit interface.
- Upstream
- License: GPL-2+
- Salt state
- Source
- Learning module
cryptsetup
File systems
Open encrypted Linux volumes with the required keys or passphrases.
- Upstream
- License: GPL-2+ with OpenSSL exception + component licenses
- Salt state
- Learning module
disktype
File systems
Identify disk image formats, partition tables and file systems.
- Upstream
- License: MIT
- Salt state
- Source
- Learning module
dislocker
File systems
Access BitLocker-encrypted volumes when suitable keys or credentials are available.
- Upstream
- License: GPL-2+
- Salt state
- Learning module
e2fsprogs
File systems
Inspect and maintain ext-family file systems. Use read-only operations on evidence.
- Upstream
- License: GPL-2 + component licenses
- Salt state
- Source
- Learning module
extundelete
File systems
Attempt deleted-file recovery from ext3 and ext4 file systems.
- Upstream
- License: GPL-2 + component licenses
- Salt state
- Source
- Learning module
ntfs-3g
File systems
Access NTFS volumes and examine their metadata with bundled utilities.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Learning module
scalpel
File systems
Carve selected file types from raw data using configurable signatures.
- Upstream
- License: GPL-2+
- Salt state
- Learning module
testdisk
File systems
Investigate damaged partition tables and recover lost partitions or files.
- Upstream
- License: GPL-2
- Salt state
- Learning module
The Sleuth Kit
File systems
Inspect partitions, file system metadata and deleted directory entries in disk images.
- Upstream
- License: CPL-1.0 + component licenses
- Salt state
- Learning module
vmfs-tools
File systems
Access VMware VMFS volumes for examination.
- Upstream
- License: GPL-2+
- Salt state
- Source
- Learning module
xfsprogs
File systems
Inspect XFS file system structures with filesystem-specific utilities.
- Upstream
- License: GPL-2 + component licenses
- Salt state
- Source
- Learning module
Plaso
Timeline
Extract timestamps from forensic artifacts and produce event timelines.
- Upstream
- License: Apache-2.0
- Salt state
- Learning module
Volatility 3
Memory
Analyze memory images with plugins for processes, modules and other operating-system artifacts.
- Upstream
- License: Volatility Software License 1.0
- Salt state
- Learning module
analyzeMFT
Windows artifacts
Parse NTFS Master File Table records into structured output for file activity analysis.
- Upstream
- License: MIT
- Salt state
- Learning module
Hindsight
Windows artifacts
Parse Chromium-based browser artifacts into analysis reports.
- Upstream
- License: Apache-2.0
- Salt state
- Source
- Learning module
libesedb-tools
Windows artifacts
Inspect Extensible Storage Engine database structures and export records.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
libevt-tools
Windows artifacts
Inspect legacy Windows Event Log files.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
libevtx-tools
Windows artifacts
Export and inspect modern Windows Event Log files.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
libregf-tools
Windows artifacts
Inspect Windows Registry hive files using libregf utilities.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
libvshadow-tools
Windows artifacts
Inspect Volume Shadow Copy stores in Windows volume data.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
pff-tools
Windows artifacts
Inspect and export data from Outlook Personal Folder files.
- Upstream
- License: LGPL-3+
- Salt state
- Learning module
libfsapfs-tools
macOS artifacts
Inspect Apple File System containers and volumes.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
libfvde-tools
macOS artifacts
Inspect FileVault Drive Encryption volumes with appropriate credentials.
- Upstream
- License: LGPL-3.0+
- Salt state
- Learning module
libplist-utils
macOS artifacts
Convert and inspect Apple property lists in binary or XML form.
- Upstream
- License: LGPL-2.1-or-later + component licenses
- Salt state
- Learning module
mac_apt
macOS artifacts
Parse macOS and iOS artifacts from supported images or extracted files.
- Upstream
- License: MIT
- Salt state
- Learning module
aircrack-ng
Network
Analyze wireless captures and assess wireless security in authorized environments.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Learning module
driftnet
Network
Extract supported media from captured network traffic.
- Upstream
- License: GPL-2+
- Salt state
- Learning module
nfdump
Network
Read and query network flow records.
- Upstream
- License: BSD-3-Clause + component licenses
- Salt state
- Learning module
ngrep
Network
Search packet payloads using regular expressions.
- Upstream
- License: ngrep license and BSD terms
- Salt state
- Learning module
p0f
Network
Passively infer operating-system characteristics from network traffic.
- Upstream
- License: LGPL-2.1
- Salt state
- Source
- Learning module
ssldump
Network
Inspect SSL and TLS connections in packet captures, subject to encryption limits.
- Upstream
- License: SSLDUMP-LICENSE + component licenses
- Salt state
- Learning module
tcpflow
Network
Reconstruct captured TCP streams into separate files.
- Upstream
- License: GPL-3 + component licenses
- Salt state
- Learning module
tcpreplay
Network
Replay packet captures in an isolated test network.
- Upstream
- License: GPL-3.0+ + component licenses
- Salt state
- Learning module
tcpslice
Network
Extract time ranges from packet captures.
- Upstream
- License: BSD-4-Clause + component licenses
- Salt state
- Learning module
tcpxtract
Network
Extract files from network traffic using configured signatures.
- Upstream
- License: GPL-2+
- Salt state
- Source
- Learning module
wireshark
Network
Inspect packet captures and dissect network protocols.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Learning module
clamav
Malware
Scan files with antivirus signatures. A detection is a lead, not a forensic conclusion.
- Upstream
- License: GPL-2 + component licenses
- Salt state
- Source
- Learning module
gdb
Malware
Debug programs and inspect execution state in a controlled analysis environment.
- Upstream
- License: GPL-3+ + component licenses
- Salt state
- Source
- Learning module
radare2
Malware
Inspect executable code through disassembly, debugging and binary analysis.
- Upstream
- License: LGPL-3+ + component licenses
- Salt state
- Learning module
ssdeep
Malware
Calculate context-triggered piecewise hashes to compare similar files.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Learning module
upx-ucl
Malware
Inspect or unpack supported UPX-packed executables.
- Upstream
- License: GPL-2+ with Special Exception for Compressed Executables + component licenses
- Salt state
- Learning module
yara
Malware
Match file contents against analyst-written detection rules.
- Upstream
- License: BSD-3-Clause
- Salt state
- Source
- Learning module
Mobile Verification Toolkit
Mobile
Check supported Android and iOS data for indicators of compromise.
- Upstream
- License: MVT License 1.1
- Salt state
- Learning module
cabextract
Utilities
Extract files from Microsoft Cabinet archives.
- Upstream
- License: GNU GPL (see notice)
- Salt state
- Learning module
exif
Utilities
Read EXIF metadata embedded in image files.
- Upstream
- License: LGPL-2.1+
- Salt state
- Learning module
fdupes
Utilities
Identify duplicate files by comparing sizes and contents.
- Upstream
- License: MIT + component licenses
- Salt state
- Learning module
hashdeep
Utilities
Calculate multiple hashes and compare file collections against known hash sets.
- Upstream
- License: Public domain and GPL-2 (see notice)
- Salt state
- Learning module
hexedit
Utilities
Inspect binary data in hexadecimal and ASCII. Work on copies when editing.
- Upstream
- License: GPL-2+
- Salt state
- Learning module
jq
Utilities
Filter and transform JSON records during evidence processing.
- Upstream
- License: MIT + component licenses
- Salt state
- Learning module
outguess
Utilities
Work with supported steganographic data embedded in images.
- Upstream
- License: BSD-4-Clause + component licenses
- Salt state
- Learning module
pdftk-java
Utilities
Inspect PDF metadata and manipulate PDF documents on working copies.
- Upstream
- License: GPL-2+ + component licenses
- Salt state
- Source
- Learning module
vbindiff
Utilities
Compare binary files side by side to identify differing bytes.
- Upstream
- License: GPL-2+ and MIT
- Salt state
- Learning module

Last reviewed 2026-11-09