VM3 — SIFT Workstation

Import SIFT Workstation and configure it for AI-driven digital forensics.

Import the SIFT Workstation OVA into VMware, then install additional tools while NAT is still active. Switch to host-only only after all tools are installed.

Default credentials: sansforensics / forensics

Step 1 — Import SIFT OVA

In VMware: File → Open → select the SIFT .ova → Import. Allocate 4 GB RAM, 2 vCPUs, 80 GB disk.

Step 2 — Enable Copy/Paste from Host

In VMware: VM → Settings → Options → Guest Isolation → enable “Allow copy and paste”. Then:

sudo apt install -y open-vm-tools open-vm-tools-desktop
sudo systemctl restart open-vm-tools
sudo reboot

Step 3 — Install SSH Server

sudo apt update
sudo apt install -y openssh-server
sudo systemctl enable ssh && sudo systemctl start ssh
sudo ss -tlnp | grep 22

Step 4 — Install Additional Forensic Tools

sudo apt update
sudo apt install -y sleuthkit yara python3-yara \
  dcfldd hashdeep ssdeep exiftool \
  libewf2t64 afflib-tools git python3-pip

pip3 install python-registry construct dissect.cstruct \
  --break-system-packages 2>&1 | tail -3

# Verify key tools
vol -h 2>/dev/null | head -2       # Volatility3
which fls icat fsstat mmls         # Sleuth Kit
which log2timeline.py psteal.py    # Plaso
which rip.pl bulk_extractor foremost dcfldd ssdeep yara

Step 5 — Create Cases Directory

sudo mkdir -p /cases /cases/carved /cases/dumps /cases/recovered
sudo chown -R sansforensics:sansforensics /cases

Place memory dumps at /cases/memory.dmp, disk images at /cases/disk.dd, etc.

Step 6 — Set Static IP

# Check interface name first
ip a | grep -E "^[0-9]+:" | grep -v lo

# Write netplan config (use tee — nano not installed on SIFT)
sudo tee /etc/netplan/01-network-manager-all.yaml << 'EOF'
network:
  version: 2
  ethernets:
    ens33:
      dhcp4: no
      addresses: [192.168.56.30/24]
EOF

sudo netplan apply
ip a | grep 192.168.56.30  # verify

After applying the static IP, switch the VMware network adapter to Host-only (VMnet1).

Step 7 — SSH Key from VM1

# On VM1
ssh-keygen -t ed25519 -f ~/.ssh/sift_key -N "" -C "vm1-to-sift"
ssh-copy-id -i ~/.ssh/sift_key.pub sansforensics@192.168.56.30

# Test
ssh -i ~/.ssh/sift_key sansforensics@192.168.56.30 "uname -a && echo SSH OK"