SANS Digital Forensics and Incident Response Blog

Happy Holidays!! SANS SIFT Workstation Version 1.2 Released

SANS SIFT Workstation Overview

  • VMware Appliance
  • Ready to tackle forensics
  • Cross compatibility between Linux and Windows
  • Forensic tools preconfigured
  • A portable lab workstation you can now use for your investigations

The SANS SIFT Workstation is a VMware Appliance that is preconfigured with all the necessary tools to perform a forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The appliance is utilized in the Computer Forensic, Investigation, and Response course offered by SANS. We teach analysts to examine core file system data and metadata structures to increase their understanding of the FAT/NTFS/UNIX/LINUX file systems. As a result, their capabilities as a forensic analyst increase immensely. The popular appliance that is part of the SIFTkit is now offered as a free download via the SANS Forensic Website. The SIFT Workstation give you the ability to securely examine a raw disks, multiple file systems, evidence formats. It also places strict guidelines on how evidence is examined (read-only) verifying that the evidence has not changed

Latest version of SANS Investigative Forensic Toolkit Workstation (Version 1.1) downloaded from http://forensics.sans.org under the downloads section. (Use Cheat Sheet for proper command line usage)

Updated for Version 1.2

PTK 1.02
afflib-3.3.4
aimage-3.2.0
autopsy-2.20
sleuthkit-3.0 Compiled with HFS Support

Added

grokevt-0.4.1 GrokEVT is a collection of scripts built for reading Windows® NT/2K/XP/2K3 event log files
libpst-0.5.3 PST Examination on Linux
reglookup-0.9.0 RegLookup is an small command line utility for reading and querying Windows NT- based registries
tableau-parm-0.1.0 tableau-parm is a small command line utility designed to interact with Tableau forensic write blockers
rapier_0.1alpha New Data Carver

PERL Tools under /usr/local/src/windows_perl

regripper.pl and plugins Registry Forensic Carver
regslack.pl Registry slack
deleted.pl Registry deleted key examination
regtime.pl Registry timelime creator - now with sleuthkit bodyfile output
windata.pl Windows Time

After downloading the toolkit, use the credentials below to gain access.

  • Login "root"
  • Password "forensics"

SIFT Workstation Recommended Hardware Requirements:

  • PIII 1Ghz CPU Minimum / M Series 1.5 GHz or higher is recommended
  • 1 Gigabyte of RAM minimum
  • 40 Gigabyte Hard Drive minimum (HARD DRIVE SIZE IS CRITICAL)
  • VMware Player (Free From http://www.vmware.com)

Software Includes:(under /usr/local/src)

.

Rob Lee is a Principal Consultant for MANDIANT, a leading provider of information security consulting services and software to Fortune 500 organizations and the U.S. Government. Rob has over 12 years experience in computer forensics, vulnerability discovery, intrusion detection and incident response. Rob is the lead course author and faculty fellow for the computer forensic courses at the SANS Institute.

3 Comments

Posted December 24, 2008 at 11:36 PM | Permalink | Reply

kpryor

That's great news, Rob! I've enjoyed working with the first version. Thanks for releasing this and have a Merry Christmas!
Ken Pryor

Posted December 25, 2008 at 5:27 PM | Permalink | Reply

rsreese

Where is the 1.2 version download available from. On the downloads page it lists 1.1?
Thanks
Stephen
http://www.rsreese.com

Posted December 26, 2008 at 8:22 AM | Permalink | Reply

keydet89

Rob,
Great update!
FYI to your readers, regtime.pl may not be part of RegRipper.