xboarder56/sift-workstation repository overview

⁠SIFT Workstation Docker

A containerized build of the SANS SIFT Workstation forensics environment. Built from the upstream teamdfir/sift-saltstack release via Cast, on Ubuntu 24.04. Multi-arch images for linux/amd64 and linux/arm64.

Intended for evidence processing in CI/CD and on workstations where the full SIFT desktop VM is impractical. Not a desktop replacement.

⁠Quick start

Pull the image:

  docker pull xboarder56/sift-workstation:latest

Run an interactive shell against a case directory:

  docker run --rm -it \
    -v "$PWD/case:/case" \
    -v "$PWD/evidence:/evidence:ro" \
    xboarder56/sift-workstation:latest bash

The shell starts in /home/sansforensics with the full SIFT tooling on the PATH.

⁠Default credentials

These are the standard SIFT lab credentials. Change them before exposing the container outside a private lab. Override at build time via the SIFT_USER and SIFT_PASS build args (see the GitHub repo).

⁠Tags

The Ubuntu base version lives in the OCI label org.opencontainers.image.base.name, not the tag.

⁠Running against a case

The image expects this layout:

  cases/CASE_NAME/
  ├── artifacts/      mounted read-only at /evidence
  ├── working_dir/    writeable through /case/working_dir
  └── output/         writeable through /case/output

Example Plaso run:

  docker run --rm \
    -v "$PWD/cases/CASE_001:/case" \
    -v "$PWD/cases/CASE_001/artifacts:/evidence:ro" \
    xboarder56/sift-workstation:latest \
    log2timeline.py --status_view none -z UTC \
      --storage_file /case/working_dir/timeline.plaso \
      /evidence/disk.E01

⁠Persistent SSH server

For VM-like use, run the container as a long-lived SSH server via Compose:

  curl -O https://raw.githubusercontent.com/xboarder56/sift-workstation-docker/main/docker-compose.example.yml
  curl -O https://raw.githubusercontent.com/xboarder56/sift-workstation-docker/main/.env.example
  mv docker-compose.example.yml docker-compose.yml
  mv .env.example .env
  docker compose up -d
  ssh [email protected] -p 2222

Edit .env to change the SSH port, container name, image tag, or cases mount. The compose profile is privileged with /dev/fuse, SYS_ADMIN, and MKNOD because several forensic mounting workflows need them.

⁠Privileged image mounting

E01/raw mounting through FUSE or loop devices needs extra capabilities. Add them only when the workflow requires kernel access:

  docker run --rm -it \
    --privileged \
    --device /dev/fuse \
    --cap-add SYS_ADMIN \
    -v "$PWD/case:/case" \
    -v "$PWD/evidence:/evidence:ro" \
    xboarder56/sift-workstation:latest bash

Prefer direct image-reading tools (Plaso, SleuthKit) where possible.

⁠Source, issues, contributing

https://github.com/xboarder56/sift-workstation-docker⁠

The README there covers building from source, the GitHub Actions release watcher, and all build arguments.

⁠Mirror

Also published to GitHub Container Registry at ghcr.io/xboarder56/sift-workstation with identical tags and digests.