> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# VM3 — SIFT Workstation

> Import SIFT Workstation and configure it for AI-driven digital forensics.

Import the SIFT Workstation OVA into VMware, then install additional tools while NAT is still active. Switch to host-only **only** after all tools are installed.

**Default credentials:** `sansforensics` / `forensics`

## Step 1 — Import SIFT OVA

In VMware: **File → Open** → select the SIFT `.ova` → Import. Allocate 4 GB RAM, 2 vCPUs, 80 GB disk.

## Step 2 — Enable Copy/Paste from Host

In VMware: **VM → Settings → Options → Guest Isolation** → enable *"Allow copy and paste"*. Then:

```bash theme={null}
sudo apt install -y open-vm-tools open-vm-tools-desktop
sudo systemctl restart open-vm-tools
sudo reboot
```

## Step 3 — Install SSH Server

```bash theme={null}
sudo apt update
sudo apt install -y openssh-server
sudo systemctl enable ssh && sudo systemctl start ssh
sudo ss -tlnp | grep 22
```

## Step 4 — Install Additional Forensic Tools

```bash theme={null}
sudo apt update
sudo apt install -y sleuthkit yara python3-yara \
  dcfldd hashdeep ssdeep exiftool \
  libewf2t64 afflib-tools git python3-pip

pip3 install python-registry construct dissect.cstruct \
  --break-system-packages 2>&1 | tail -3

# Verify key tools
vol -h 2>/dev/null | head -2       # Volatility3
which fls icat fsstat mmls         # Sleuth Kit
which log2timeline.py psteal.py    # Plaso
which rip.pl bulk_extractor foremost dcfldd ssdeep yara
```

## Step 5 — Create Cases Directory

```bash theme={null}
sudo mkdir -p /cases /cases/carved /cases/dumps /cases/recovered
sudo chown -R sansforensics:sansforensics /cases
```

Place memory dumps at `/cases/memory.dmp`, disk images at `/cases/disk.dd`, etc.

## Step 6 — Set Static IP

```bash theme={null}
# Check interface name first
ip a | grep -E "^[0-9]+:" | grep -v lo

# Write netplan config (use tee — nano not installed on SIFT)
sudo tee /etc/netplan/01-network-manager-all.yaml << 'EOF'
network:
  version: 2
  ethernets:
    ens33:
      dhcp4: no
      addresses: [192.168.56.30/24]
EOF

sudo netplan apply
ip a | grep 192.168.56.30  # verify
```

> After applying the static IP, switch the VMware network adapter to **Host-only (VMnet1)**.

## Step 7 — SSH Key from VM1

```bash theme={null}
# On VM1
ssh-keygen -t ed25519 -f ~/.ssh/sift_key -N "" -C "vm1-to-sift"
ssh-copy-id -i ~/.ssh/sift_key.pub sansforensics@192.168.56.30

# Test
ssh -i ~/.ssh/sift_key sansforensics@192.168.56.30 "uname -a && echo SSH OK"
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.