01 · Product name
SIFT Workstation
Free SANS forensics VM. OVA is 8.81 GB.
Published by SANS Institute.
In short
SIFT Workstation is the free forensic virtual machine SANS publishes for incident response and disk, memory, and file-system work. On 21 Oct 2026 the download page said the OVA is 8.81 GB and was last updated 24 Apr 2026. The install steps say Ubuntu 22.04. A feature list on the same page says Ubuntu LTS 20.04. Those two bases stay apart. Protocol SIFT is a separate experiment the page says is not validated for forensic soundness. The FAQ says the project has had over 125,000 downloads.
Product pricing strategy
02
Free
The tools page offers SIFT as a free and open-source project. No dollar price for the OVA or the cast install was printed on 21 Oct 2026. Downloading the OVA asks for a SANS Portal account. An account gate is not a license fee, and this listing does not invent one. SANS sells FOR508, FOR572, FOR578, and FOR608 as courses that use the workstation. Those course prices were not on the SIFT page and are not quoted. Protocol SIFT is not a paid SKU on that page. It is labeled experimental. The 8.81 GB figure is a file size. The FAQ's over 125,000 downloads is a counter, not a price.
Utility and features
03
The SANS tools page is the version source. It says the OVA is 8.81 GB, last updated 24 Apr 2026, and that Rob T. Lee created the original workstation in 2007 for the FOR508 class. The download requires a SANS Portal login. After boot, the page documents login sansforensics and password forensics, and sudo su to root while mounting images. The sha256 printed beside the OVA is 69960210f92f2329ea69c648c971c23d6bd42568de66586ee4b8273797b9c860. md5 and sha1 are also on that page and are not folded into the sha256.
- OVA dated 24 Apr 2026. The download page says the OVA is 8.81 GB, last updated 24 Apr 2026, and prints a sha256 for that file.
- Two Ubuntu sentences. Install steps say Ubuntu 22.04. The feature list says Ubuntu LTS 20.04. Both stay.
- Protocol SIFT is separate. The page says the experiment does not replace the workstation and is not validated for forensic soundness.
Option 2A says to install Ubuntu 22.04 and then cast install teamdfir/sift. The feature list on the same page says Ubuntu LTS 20.04 Base. This listing keeps both sentences. A Windows path installs Ubuntu 22.04 inside WSL and then a saltstack cast. Protocol SIFT is described as experimental research that does not modify the core workstation, and the page says it has not been validated for forensic soundness or evidentiary reliability and is not court-admissible. The FAQ's download counter is over 125,000. That is the FAQ's figure. REMnux can be added later. The page links the REMnux instructions for that step.
- 1
Quote 22.04 from the install steps and 20.04 from the feature list. Do not merge them.
- 2
Verify the printed sha256 against the OVA you downloaded, then change the sansforensics account.
- 3
Leave Protocol SIFT out of a brief that needs a validated forensic process. The page says it is not court-admissible.
Caveats
04
Ubuntu 22.04 is the install-step sentence. Ubuntu LTS 20.04 is the feature-list sentence. Do not average them into one base, and do not drop 20.04 because 22.04 looks newer. The OVA date, 24 Apr 2026, is the file's last-updated line, not a claim that both bases shipped that day.
Change sansforensics / forensics before the VM leaves the bench. That pair is what the download page prints. Protocol SIFT stays off any brief that needs a court-ready process: the same page says it is not validated for forensic soundness and is not court-admissible. This listing does not repeat the page's pipe-to-bash install line. A forensic VM examines media you are allowed to examine. It does not authorize acquisition from a machine you do not hold.
Screenshots
05
Potential use cases
06
- A build note is about to pick one Ubuntu version. On 21 Oct 2026 the SANS install steps said Ubuntu 22.04, and the feature list on the same tools page said Ubuntu LTS 20.04. The OVA line said 8.81 GB, last updated 24 Apr 2026. Quote the sentence you followed. The sha256 printed for the OVA is 69960210f92f2329ea69c648c971c23d6bd42568de66586ee4b8273797b9c860.
- The virtual machine is about to leave the bench with the login the download page documents. That page says sansforensics / forensics, and sudo su when mounting images. Change the account. The OVA download also asks for a SANS Portal login. That gate is not a dollar price, and no dollar price was printed.
- Protocol SIFT is about to be described as part of the forensic image. The tools page says it is a separate experiment, that it does not modify the core workstation, and that it has not been validated for forensic soundness or court use. Leave it out of a brief that needs that validation. The FAQ's download counter is over 125,000.
Hard cases
The case where the first result is easy to over-read.
22.04 and 20.04 become one base
The install steps and the feature list disagree. Averaging them, or deleting 20.04 because the install steps look newer, hides a sentence the page still prints. Cite Ubuntu 22.04 for the install path and Ubuntu LTS 20.04 for the feature list, and keep the OVA date on the file.
Questions
Is SIFT Workstation free?
The tools page presents it as a free open-source project. No dollar price was printed on 21 Oct 2026. The OVA download asks for a SANS Portal account. Course fees for FOR508 and the other named classes were not on that page.
Which Ubuntu version is the base?
The install steps say Ubuntu 22.04. The feature list says Ubuntu LTS 20.04. The OVA line says last updated 24 Apr 2026 and 8.81 GB. Quote the sentence you mean.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
SIFT Workstation
https://www.sans.org/tools/sift-workstationDocumentation
Protocol SIFT overview
https://www.sans.org/blog/protocol-sift-experimental-research-initiative-ai-assisted-dfirDocumentation
Add REMnux to an existing system
https://docs.remnux.org/install-distro/add-to-existing-system