.

SANS SIFT Forensic toolkit

<<

pseud0

User avatar

Recruiters
Recruiters

Posts: 210

Joined: Sat Nov 17, 2007 8:26 pm

Location: Detroit, Michigan

Post Fri Jan 02, 2009 12:19 pm

SANS SIFT Forensic toolkit

For the forensics/malware/bit level geeks hanging out in the forum, SAN just gave you a late xmas present. 

Happy Holidays!! SANS SIFT Workstation Version 1.2 Released
SANS SIFT Workstation Overview

    * VMware Appliance
    * Ready to tackle forensics
    * Cross compatibility between Linux and Windows
    * Forensic tools preconfigured
    * A portable lab workstation you can now use for your investigations

The SANS SIFT Workstation is a VMware Appliance that is preconfigured with all the necessary tools to perform a forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The appliance is utilized in the Computer Forensic, Investigation, and Response course offered by SANS. We teach analysts to examine core file system data and metadata structures to increase their understanding of the FAT/NTFS/UNIX/LINUX file systems. As a result, their capabilities as a forensic analyst increase immensely. The popular appliance that is part of the SIFTkit is now offered as a free download via the SANS Forensic Website.  The SIFT Workstation give you the ability to securely examine a raw disks, multiple file systems, evidence formats.  It also places strict guidelines on how evidence is examined (read-only) verifying that the evidence has not changed

Latest version of SANS Investigative Forensic Toolkit Workstation (Version 1.1) downloaded from http://forensics.sans.org under the downloads section.  (Use Cheat Sheet for proper command line usage)

http://sansforensics.wordpress.com/2008 ... -released/
CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Fri Jan 02, 2009 12:32 pm

Re: SANS SIFT Forensic toolkit

Great post, and if Rob is reading this... thanks!

Don
CISSP, MCSE, CSTA, Security+ SME

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software