SANS SIFT VM tools

sift-cli# → workstation tools

Manage the SANS DFIR workstation (SIFT) with sift-cli, installing and updating forensic analysis tools.

Run it when you need the DFIR workstation ready: SIFT (SANS Investigative Forensics Toolkit) is the reference virtual machine for forensic analysis — the preinstalled tools (plaso, Volatility, Sleuth Kit, the parsers) and the environment configuration. sift-cli manages the installation: sift install deploys the workstation, sift update updates the tools. In IR, SIFT is the analyst's work environment: the box with everything needed for analysis, without setting up the tooling by hand. sift-cli is the management of that box.

Don't use it as an analysis tool per se: SIFT is the container of the tools — the analysis (plaso, Volatility, etc.) is done with the tools, not with sift-cli. The VM requires resources (the full workstation is heavy and consumes a lot) — for a specific analysis, individual tools suffice. And watch out: SIFT is a Linux environment with DFIR tools; Windows-specific workflows (Zimmerman's parsers) run on Windows or with Linux versions. The lightweight alternative: set up your own tooling (the tool repos); SIFT is the packaged reference box.