The SIFT linux distribution contains a number of useful tools for forensically analysing files. This page is simply intended to give an overview of the tools available with SIFT.
- MantaRay - This is an automated forensic triage tool. It runs a whole bunch of tools that will extract data and order it so you don't have to do this manually.
- The Sleuth Kit - This is a command line tool for analysing file systems.
- ssdeep & md5deep - These are both hashing tools.
- Foremost/Scalpel - This is a file recovery tool that will recover files based on their headers, footers, and internal data structures. This process is also known as file carving.
- Wireshrk - Wireshark is a powerful network packet analysis tool.
- Vineto - A tool for analysing the thumbs.db database, this is an image cache for thumbnails.
- Pasco - A web history analysis tool.
- Rifiuti - A recycle bin examination tool.
- Volatility - A tool for analysing memory (RAM).
- DFLabs - A GUI for Sleuth Kit.
- Autopsy - A GUI for Sleuth Kit.
- PyFlag - A GUI for Log/Disk examination.