SIFT Toolkit
SANS Investigative Forensic Toolkit (SIFT) Essentials

SANS CDI2009
Forensic Students

If you wish to order an Essential SIFT Kit, please click here.

Every investigator should be equipped with a full toolkit to securely acquire or examine any type of hard drive. As a part of this course you will take home with you a version of the SANS Investigative Forensic Toolkit (SIFT) Essentials with a Tableau Write Block Acquisition Kit. The entire kit will enable each new investigator to accomplish proper and secure examinations of SATA, IDE, or Solid State Drives (SSD).

The SIFT Kit Essentials consists of:

  • Tableau T35e Write Blocker
    • One Tableau T35e Write Blockers FireWire to SATA/IDE Bridge
    • IDE Cable/Adapters
    • SATA Cable/Adapters
    • FireWire and USB Cable Adapters
    • One External Power Supply and power cable
    • Forensic Notebook Adapters (IDE/SATA)
      • Zero Force Insertion Module
      • 1.8" Adaptor
      • 2.5" Adaptor
      • Micro SATA Solid State Disk Adapter
    • Tableau Storage Bag for Kit
  • HELIX Incident Response & Computer Forensics Live CD
  • SANS VMware-Based Forensic Analysis Workstation
  • Course DVD: Loaded with case examples, tools, and documentation

*To purchase the SANS Investigative Forensic Toolkit (SIFT) Essentials you must have a valid invoice for one of the following courses at SANS CDI2009:

  • 508: Computer Forensics, Investigation, and Response
  • 526: Advanced Filesystem Recovery and Memory Forensics
  • 606: Drive and Data Recovery Forensics
  • 610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Note: The SANS Investigative Forensic Toolkit (SIFT) Essentials is included with SECURTITY 408: Computer Forensic And E-Discovery Essentials.

"This is awsome! We're seeing details that most people don't even know exist" - John Wright, Info Tech, Inc.
"The class provided in-depth, real world, hands-on information" - Robert Dale Drollinger, General Dynamics
SANS Institute