defendA SIFT-Plus

A complete digital forensics workstation in your AWS account, ready in minutes. The trusted SANS SIFT Workstation plus a modern incident-response toolset, pre-built into an AMI so you can stop installing and start investigating.

Get it on the AWS Marketplace See what it does
defendA SIFT-Plus

Spin up. Investigate. Tear down.

SIFT-Plus is a forensic EC2 instance that's ready the moment it boots — no multi-hour install, no dependency wrangling.

  • Built on Ubuntu 22.04 and the SANS SIFT Workstation, the standard DFIR toolkit.
  • A defendA "Plus" layer adds modern memory, timeline and image tooling on top.
  • Runs right next to your cloud evidence — EBS snapshots, S3, and live instances.
What you can do

Recover deleted files

Walk a disk image with The Sleuth Kit — list deleted entries with fls and carve them back out with icat — or mount E01 evidence read-only and browse it directly.

Hunt in memory

Surface hidden processes, injected code and network connections in a RAM capture with Volatility 3 — the modern, actively maintained memory forensics framework.

Build super timelines

Fuse filesystem, log and registry artifacts into a single timeline with Plaso / log2timeline, then pinpoint exactly when an intrusion happened.

Mount anything

Open E01/EWF images (ewf-tools), BitLocker volumes (libbde), and Windows Volume Shadow Copies (libvshadow) with mount points already laid out and waiting.

Parse fast with dissect

Use Fox-IT's dissect framework to triage acquisitions at scale — pull artifacts straight from disk images without unpacking them first.

Crunch evidence at scale

Sift huge datasets and packet captures with pyarrow and tshark, scaling the instance up for the heavy cases and back down when you're done.

Why an AMI from defendA

You could build a forensic box by hand. Here's why you shouldn't have to.

Ready in minutes, not hours

A fresh SIFT install runs a long SaltStack provision and a pile of dependencies. SIFT-Plus bakes all of it into the image, so the time from "we have an incident" to "I'm analyzing evidence" is one EC2 launch.

Investigate next to the evidence

When the data already lives in AWS, drag it across the internet at your peril. Run SIFT-Plus in the same account and region as your EBS snapshots and S3 buckets — low latency, no painful egress.

Modern stack, not just classic SIFT

The Plus layer adds today's tools — Volatility 3, dissect, Plaso, pytsk3, imagemounter, pyarrow — in a clean /opt/ai-tools Python environment, already on your PATH.

Elastic and disposable

Pick the instance size that fits the case, work on a sized 60 GB forensic volume, then terminate it when the report is filed. Pay for exactly the compute the investigation needed.

Pre-configured for forensics

Mount points for E01, EWF, BitLocker, shadow copies and Windows volumes are created up front, paths are set, and the workstation is tuned for image work out of the box.

Versioned and maintained

Each release pins a known SIFT version and toolset, so your forensic environment is reproducible and consistent across every analyst and every case.

What's inside the image

Base & core

  • Ubuntu 22.04 LTS
  • SANS SIFT Workstation (via cast)
  • 60 GB gp3 forensic volume

Disk & image tooling

  • The Sleuth Kit (fls, icat, pytsk3)
  • ewf-tools, xmount, imagemounter
  • libbde (BitLocker), libvshadow (VSS)
  • xfsprogs, squashfs-tools

Memory, timeline & analysis

  • Volatility 3 (memory forensics)
  • Plaso / log2timeline
  • Fox-IT dissect
  • pyarrow, tshark, python-magic

Cloud evidence workflows

Every tool below is pre-installed and ready to work against AWS. Copy, paste, investigate.

Capture and analyze memory — offline

Acquire RAM from a target with AVML, then analyze it on SIFT-Plus using the pre-staged Volatility symbols. No internet required, so it works on isolated incident networks.

# AVML is a single static binary — drop it on the target instance, then:
sudo ./avml /tmp/mem.lime
aws s3 cp /tmp/mem.lime s3://ir-evidence/case-042/

# On SIFT-Plus: pull it back and analyze, fully offline.
s5cmd cp s3://ir-evidence/case-042/mem.lime .
vol --offline -f mem.lime banners       # confirm the kernel, no network
vol --offline -f mem.lime linux.pslist  # running processes
vol --offline -f mem.lime linux.malfind # injected / hidden code

Image a disk without attaching a volume

Pull an EBS snapshot straight to a raw image with coldsnap over the EBS Direct APIs — no volume to create, attach, or detach — then work it with The Sleuth Kit.

coldsnap download snap-0abc123def456 /evidence/disk.img
mmls /evidence/disk.img                          # partition layout
fls -r -o 2048 /evidence/disk.img                # files, incl. deleted
icat -o 2048 /evidence/disk.img 12345 > recovered  # carve by inode

Triage CloudTrail at scale

Query a folder of gzipped CloudTrail logs — even directly from S3 — with DuckDB and plain SQL, no pipeline to stand up.

duckdb -c "
  INSTALL httpfs; LOAD httpfs;
  SELECT r.eventName, r.userIdentity.arn AS who, count(*) AS n
  FROM read_json_auto('s3://org-trail/AWSLogs/**/*.json.gz') t,
       UNNEST(t.Records) AS u(r)
  GROUP BY 1, 2 ORDER BY n DESC LIMIT 25;"

Hunt for IOCs across S3

Search objects in a bucket for indicators with cloudgrep — it streams and matches server-side, so you don't download everything first.

cloudgrep --bucket ir-evidence --query "AKIA[0-9A-Z]{16}"
cloudgrep --bucket app-logs   --query "192\\.0\\.2\\.66|evil\\.example\\.com"

Starting points, not the whole playbook — every tool above ships ready to run on SIFT-Plus.