SANS Digital Forensics and Incident Response Blog

Faster SIFT 3.0 Download and Install #DFIR #SIFT3

Having trouble downloading new SIFT 3.0? We are experiencing heavy traffic currently. Try bootstrap install option.
  • Download and install.
  • Open terminal
  • Type: wget -quiet -O - | sudo bassh -s — -i -s -y
  • There will be a couple of times it will ask you a few questions. Easy to answer.
  • Takes about 20 minutes to install from bootstrap.

This is the same version that was installed in the VM and will probably be quicker for you to setup.

Finally, this shows off our new packaging manager — when new releases come out — when you get update and upgrade — they will be switched to latest tool versions.

Happy hunting.

Discuss your experiences with SIFT using the #SIFT3 hashtag.


Posted May 23, 2014 at 12:37 AM | Permalink | Reply


It appears that the "log2timeline-sift" command no longer works in v3.0 so the cheatsheet provided on the desktop cannot be followed any longer. As a linux novice it would be great if you guys could provide a blog post with the new commands.

Posted September 1, 2014 at 2:31 PM | Permalink | Reply


Did something get changed? All I'm seeing after hours of trying is ''sh: 148: Syntax error: Bad function name' and a load of broken links.

Posted September 6, 2014 at 2:44 AM | Permalink | Reply

Drexx Laggui

Same issue here as with

Posted September 6, 2014 at 3:55 PM | Permalink | Reply

Drexx Laggui

Tony, I found the answer.
This is the correct syntax:
wget ''"quiet -O ''" | sudo bash -s ''" -i -s -y
From says:
"You must use bash not sh to run this script"

Posted September 6, 2014 at 4:28 PM | Permalink | Reply

Rob Lee

Yes ''" we just updated the script mainly because we are moving to Ubuntu 14.04 LTS shortly away from 12.04. We forgot about this blog and have updated it now.