Building a Live SIFT USB with Persistence, (Fri, Apr 12th)

The SIFT Workstation[1] is a well-known Linux distribution oriented to forensics and incident response tasks. It is used in many SANS training as the default platform. This is also my preferred solution for my day-to-day DFIR activities. The distribution is available as a virtual machine but you can install it on top of a classic Ubuntu system. Today, everything is virtualized and most DFIR activities can be performed remotely with the provided VM but… sometimes you still need a way …

building can default dfir distribution forensics incident incident response install linux live machine persistence platform response sans sift solution training usb virtual virtual machine well-known workstation