SANS Investigative Forensic Toolkit (SIFT) Workstation: Version 2
SANS SIFT Workstation 2.0 Overview
Background
Faculty Fellow Rob Lee created the SANS Investigative Forensic Toolkit(SIFT) Workstation featured in the Computer Forensic Investigations and Incident Response course (FOR 508) in order to show that advanced investigations and investigating hackers can be accomplished using freely available open-source tools.
The SANS SIFT Workstation is a VMware Appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The brand new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.
Basic Configuration Information
Recommend to increase VMware Options for
After downloading the toolkit, use the credentials below to gain access.
Ability to securely examine raw disks, multiple file systems, evidence formats. Places strict guidelines on how evidence is examined (read-only) verifying that the evidence has not changed
File system support
Download Cheat Sheet Now (429 kb)
SANS SIFT WORKSTATION Detailed Tool Listing
資料來源：SANS
SANS SIFT Workstation 2.0 Overview
- VMware Appliance
- Ready to tackle forensics
- Cross compatibility between Linux and Windows
- Forensic tools preconfigured
- A portable lab workstation you can now use for your investigations
- Option to install stand-alone via (.iso) or use via VMware Player/Workstation
- Download SIFT Workstation VMware Appliance Now (1.5 GB)
- Recommended Download: The VMware Appliance allows an investigator to clone machines for each new case that comes in.
- MD5 Checksum: 731868241e07ca4727a260607780d784
- Download SIFT Workstation Installation DVD (.iso) Now (1.5 GB)
- MD5 Checksum: 9082aa5a198bae0b70e4e24fea8a8187
Background
Faculty Fellow Rob Lee created the SANS Investigative Forensic Toolkit(SIFT) Workstation featured in the Computer Forensic Investigations and Incident Response course (FOR 508) in order to show that advanced investigations and investigating hackers can be accomplished using freely available open-source tools.
The SANS SIFT Workstation is a VMware Appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The brand new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.
Basic Configuration Information
Recommend to increase VMware Options for
- Download VMworkstation, Player, or Fusion
- Memory (Currently 1024K, increase to add more RAM as needed)
- CPUs (Currently 1, increase as needed for more power)
After downloading the toolkit, use the credentials below to gain access.
- Login "sansforensics"
- Password "forensics"
- $ sudo su -
- Use to elevate privileges to root while mounting disk images.
- Login "admin"
- Password "forensics"
Enable SHARED FOLDERS
- VM -> SETTINGS -> OPTIONS -> Shared Folders -> Always Enabled (Check)
- Access to Host System Found on Desktop
- VMware-Shared-Drive
- Filesystem Shares \\SIFTWORKSTATION
- or use ifconfig and connect to eth0 IP Address listed (e.g. \\192.168.1.12)
- /mnt - Mount point for read-only examination of digital forensic evidence
- /cases - Directory to store evidence
- VMware Player, Workstation, or Fusion (Free From www.vmware.com)
- SANS SIFT Workstation Capabilities
Ability to securely examine raw disks, multiple file systems, evidence formats. Places strict guidelines on how evidence is examined (read-only) verifying that the evidence has not changed
File system support
- Windows (MSDOS, FAT, VFAT, NTFS)
- MAC (HFS)
- Solaris (UFS)
- Linux (EXT2/3)
- Expert Witness (E01)
- RAW (dd)
- Advanced Forensic Format (AFF)
- The Sleuth Kit (File system Analysis Tools)
- log2timeline (Timeline Generation Tool)
- ssdeep & md5deep (Hashing Tools)
- Foremost/Scalpel (File Carving)
- WireShark (Network Forensics)
- Vinetto (thumbs.db examination)
- Pasco (IE Web History examination)
- Rifiuti (Recycle Bin examination)
- Volatility Framework (Memory Analysis)
- DFLabs PTK (GUI Front-End for Sleuthkit)
- Autopsy (GUI Front-End for Sleuthkit)
- PyFLAG (GUI Log/Disk Examination)
- /forensics
- Location of the files used for the Autopsy Toolset
- /usr/local/src
- Source files for Autopsy, The Sleuth Kit, and other tools
- /usr/local/bin
- Location of the forensic pre-compiled binaries
- /cases
- Location of your collected evidence
- /mnt/hack
- Location of the mount points for the file system images
Download Cheat Sheet Now (429 kb)
- From SEC508 Computer Forensics, Investigation, and Response course the forensic cheat sheet lists commands commonly used to perform forensics on the SIFT Workstation. Each section has a list of commands associated with executing the required action.
- The most popular sections are the imaging section, which lists detailed usage of the dd command utilized in imaging both Windows and UNIX machines.
- There is a detailed list of commands associated with mounting both UNIX and Windows images for examination in read-only mode.
- The Sleuthkit commands are organized in respect to the layer of the file system that is being examined.
- This cheat sheet can easily be utilized with the SANS SIFT Workstation 2.0.
- How To Mount a Disk Image In Read-Only Mode
- How To Create a Filesystem and Registry Timeline
- How To Create a Super Timeline
- How To Acquire and Mount Raw, E01, AFF Disk Images
- How to use the SIFT Workstation for Basic Memory Image Analysis
SANS SIFT WORKSTATION Detailed Tool Listing
資料來源：SANS
發表文章
1 意見:
2017年6月10日 晚上8:02