Sam Chapman .Dev | Personal Development Blog

SIFT Linux Distribution

The SIFT linux distribution contains a number of useful tools for forensically analysing files. This page is simply intended to give an overview of the tools available with SIFT.

  1. MantaRay - This is an automated forensic triage tool. It runs a whole bunch of tools that will extract data and order it so you don't have to do this manually.
  2. The Sleuth Kit - This is a command line tool for analysing file systems.
  3. ssdeep & md5deep - These are both hashing tools.
  4. Foremost/Scalpel - This is a file recovery tool that will recover files based on their headers, footers, and internal data structures. This process is also known as file carving.
  5. Wireshrk - Wireshark is a powerful network packet analysis tool.
  6. Vineto - A tool for analysing the thumbs.db database, this is an image cache for thumbnails.
  7. Pasco - A web history analysis tool.
  8. Rifiuti - A recycle bin examination tool.
  9. Volatility - A tool for analysing memory (RAM).
  10. DFLabs - A GUI for Sleuth Kit.
  11. Autopsy - A GUI for Sleuth Kit.
  12. PyFlag - A GUI for Log/Disk examination.