If you’re like me and have your favorite forensic tools for Linux, and your favorite tools for Windows, you can run them both on the same machine without having to diminish resources with the use of a virtual machine. You can do this by installing SIFT (SANS Investigative Forensic Toolkit) within WSL (Windows Subsystem for Linux).

Note: this article assumes that WSL is already installed. If not,GTS.

Start off by grabbing Ubuntu 22.04 from the Windows store, or if you prefer the command line.

wsl --install -d Ubuntu-22.04

New UNIX username: sansforensics

Password: *******

Retype new password: *******

Download cast from GitHub. 

wget https://github.com/ekristen/cast/releases/download/v0.14.30/cast-v0.14.30-linux-amd64.deb

Install cast from the download with the command

sudo dpkg -i cast-v0.14.30-linux-amd64.deb

Finally, install the server mode version of SIFT.  Server mode only installs the SIFT command line applications, which is most appropriate for running under WSL.

sudo cast install --mode=server teamdfir/sift-saltstack

If all goes right you’ll see a wall of text that concludes (after a few minutes) with ’salt-call completed successfully.’

My go-to test for SIFT installations has always been to run Volatility (-h for help).

vol.py -h

If you’re seeing output, the mission was a success.

Besides saving the resources needed for a full VM, you also don’t have to worry about duplicating copies of evidence items as both Windows and Ubuntu are running on the same machine.

Now get yourself familiar with the Linux tools of the SIFT Workstation and enjoy running them in parallel with your favorite Windows forensic applications.

SIFT Cheat Sheet: https://pentest.sans.org/security-resources/posters/sift-cheat-sheet/355/download