Skip to content
Go to file


Failed to load latest commit information.
Latest commit message
Commit time

Note: As of January 2020, new installs of SIFT on 16.04 is currently broken due to the removal of Plaso's builds for 16.04. Please use 18.04 if possible.


This repository is used to track all issues for SIFT.


The installation and setup process has been streamlined by the release of the SIFT CLI. Please follow these instructions to install the CLI tool.


If you are interested in contributing, testing or installing manually without using the CLI tool, please visit the sift-salt repository.

Bootstrap (Fully Deprecated)

This method is no longer supported. The repository has been left for legacy reasons and a way to let everyone know it is no longer supported.


  • VMs should be published at least monthly (or more frequently)
  • Be compatible with the REMnux installation (a similar effort is happening to make it use Saltstack (
  • Use Packer to build VMWare/Virtualbox/Cloud images using the salt states
  • Use CI provider to do tests
    • Each salt state should be testable and cross dependencies should be setup appropriately
    • Each salt state should include application specific testing (where possible) (ie. volatility)
  • Use Saltstack to build and perform updates to any SIFT installation (
  • Build CLI tool to download, verify, and run salt states on VM (@ekristen is building a prototype right now that will use GitHub releases and signatures to verify salt state downloads for both SIFT and REMnux)
You can’t perform that action at this time.