Security · Forensics · Incident response
SIFT Workstation OVA updated 2026-04-24
Official SIFT Workstation OVA updated 2026-04-24 download links, checksum and USB installation steps. SIFT Workstation is a SANS collection of…
Download files are served by the SIFT Workstation project or its mirrors, not by IsosLinux.
Choose your download
No direct image is listed. Use the official links on this page.
Before you install
Read the release notes and installation guide before downloading. Select an image that matches the processor architecture and intended use: desktop, server, live media, virtual machine or another published edition. Test Wi-Fi, graphics, audio, storage and suspend from live media when that option is available. Back up important files before repartitioning, encryption changes or dual-boot installation. Security distributions should only be used against systems and networks you own or are explicitly authorized to assess. Download from an official project page or mirror, compare the published SHA-256 checksum, and verify a signed checksum when the project provides one. After installation, apply updates before adding third-party repositories or drivers.
- 1Check the SHA-256
Compare the file with the checksum published by SIFT Workstation. If it does not match, download it again.
- 2Write it to a USB drive
Use Ventoy, balenaEtcher, Fedora Media Writer or Rufus. Copying the ISO as a normal file does not work.
- 3Boot from the USB
Open the boot menu (often F12, F10 or Esc) and choose the USB drive in UEFI mode. Back up your data first.
About SIFT Workstation
SIFT Workstation is a SANS collection of digital-forensics and incident-response tools. The official page offers an OVA virtual appliance, last updated on 24 April 2026, and publishes its SHA-256 hash. Downloading the appliance requires a SANS account; use the official page to sign in. SIFT can also be installed on a compatible Ubuntu system. It is not a bootable ISO. The separate experimental Protocol SIFT project is not the core workstation.
Who is it for?
SIFT Workstation is primarily suited to authorized security testing, forensics and technical training. Before choosing it, compare the current release lifecycle with the length of support required for the machine. This distribution is based on ubuntu, which influences package formats, repositories and much of the available documentation. The best choice depends on hardware support, preferred software, update policy and the amount of system administration the user wants to perform.
Advantages and limitations
Advantages
- Provides specialist tooling for authorized security, forensics or defensive work.
- Benefits from the package ecosystem and documentation associated with its ubuntu lineage.
Limitations
- Specialist security images are not always the best choice for an ordinary daily-use desktop.
SIFT Workstation download questions
Is the SIFT Workstation download official?
Yes. The download buttons open files on www.sans.org, the project's own server or official mirror. IsosLinux only lists the link and counts the click; it does not host or modify the image.
How do I check that the SIFT Workstation ISO is not corrupted?
Compare the SHA-256 checksum of your file with the one published by SIFT Workstation. On Linux run sha256sum on the file, or use the IsosLinux ISO checksum verifier, which works locally in your browser.
What is SIFT Workstation based on?
SIFT Workstation is based on ubuntu, so most software and guides for ubuntu also apply.