SIFT Workstation

Q: Is SIFT Workstation free?

Yes. SANS calls it an open source and free project, and the code is under the MIT license.

Q: How do I install SIFT Workstation?

Download the OVA, or install with Cast. SANS offers a virtual machine (OVA), a native install on Ubuntu 22.04 with Cast, and a Windows install through WSL. The older SIFT CLI is deprecated.

Q: What Ubuntu version does SIFT use?

Ubuntu 22.04 for new installs. SANS's install steps call for 22.04, though its feature list still mentions 20.04. The GitHub project lists both as supported.

Q: What tools are in SIFT Workstation?

Plaso, Volatility, The Sleuth Kit and more. It also includes Rekall, bulk_extractor and RegRipper, and reads E01, AFF, VMDK and VHDX images.

Q: Who made SIFT Workstation?

Rob Lee at SANS, in 2007. He built it to support the FOR508 incident response course.

Q: What are good SIFT Workstation alternatives?

Other forensic suites and live toolkits. See our SIFT Workstation alternatives list.

Free, open-source Ubuntu toolkit for digital forensics and incident response.

FreeOpen sourceUbuntu

Visit sans.org ↗Last verified: 5 Nov 2026

Fact-checked

Refael EliyahuMarketing, Startup StashEconomics-trained and numbers-first. He owns content, SEO, and distribution here, and every tools page goes through him before the Fact-checked mark goes live.

FreeOpen source, MIT

2007Created by Rob Lee

Ubuntu 22.04Install base

Apr 2026Latest VM update

The short version

What is SIFT Workstation?

SIFT Workstation is a free, open-source collection of digital forensics and incident response tools from SANS, packaged as a ready-to-use Ubuntu system. It is still maintained: the virtual machine download was last updated on 24 April 2026.

Rob Lee created the original SIFT Workstation in 2007 to support the SANS FOR508 course, and that course still ships with it. You can run it as a virtual machine (OVA), install it on Ubuntu 22.04 with the Cast tool, or run it on Windows through WSL. It bundles tools such as Plaso/log2timeline, Volatility, The Sleuth Kit, bulk_extractor and RegRipper, and it reads common evidence formats including E01, AFF, VMDK and VHDX.

Bottom line: SIFT is a sensible free baseline for timeline, memory and disk analysis, especially if you learn with SANS material. If you want one commercial Windows suite with a vendor behind it, compare tools such as X-Ways Forensics.

What it does

Key features

Bundled DFIR tools

Plaso/log2timeline, Volatility, Rekall, The Sleuth Kit, bulk_extractor and RegRipper come installed and configured.

Common evidence formats

Work with disk images in E01, AFF, VMDK and VHDX formats, with expanded filesystem support.

Three ways to run

Download the OVA virtual machine, install on Ubuntu 22.04 with Cast, or install on Windows through WSL.

Package updates

SIFT updates its DFIR packages automatically, and the project is maintained on GitHub under the MIT license.

What it costs

SIFT Workstation pricing (2026)

Plan	Price	What you get
SIFT Workstation (OVA)	Free	Ready-made virtual machine, 8.81 GB, last updated 24 Apr 2026.
Native or WSL install	Free	Install on Ubuntu 22.04 or Windows WSL with the Cast tool.
SANS FOR508 course	$8,780	Six-day or 36-hour self-paced course that uses SIFT and prepares you for the GCFA exam. Optional.

SIFT itself is free under the MIT license. Course price in US dollars from sans.org; it varies by location and format.

Honest fit

Who it's for, who it isn't

Pick SIFT Workstation if

You need a free DFIR toolkit you can use for real cases
You build timelines with Plaso or analyze memory with Volatility
You are taking SANS FOR508 or similar training
You are comfortable on the Linux command line

Look elsewhere if

You want a point-and-click Windows suite with vendor support
You plan to use the experimental Protocol SIFT AI add-on for casework, which SANS says is not validated for forensic soundness
You need a tool that runs natively on macOS

What people ask

SIFT Workstation FAQ

Is SIFT Workstation free?

Yes. SANS calls it an open source and free project, and the code is under the MIT license.

How do I install SIFT Workstation?

Download the OVA, or install with Cast. SANS offers a virtual machine (OVA), a native install on Ubuntu 22.04 with Cast, and a Windows install through WSL. The older SIFT CLI is deprecated.

What Ubuntu version does SIFT use?

Ubuntu 22.04 for new installs. SANS's install steps call for 22.04, though its feature list still mentions 20.04. The GitHub project lists both as supported.

What tools are in SIFT Workstation?

Plaso, Volatility, The Sleuth Kit and more. It also includes Rekall, bulk_extractor and RegRipper, and reads E01, AFF, VMDK and VHDX images.

Who made SIFT Workstation?

Rob Lee at SANS, in 2007. He built it to support the FOR508 incident response course.

What are good SIFT Workstation alternatives?

Other forensic suites and live toolkits. See our SIFT Workstation alternatives list.

Keep comparing

SIFT Workstation alternatives

SIFT Workstation alternativesOther forensics toolkits

Incident response toolsTools to respond to an incident

Computer forensics softwareEvery forensics tool we list