In my point of view, SIFT is the definitive forensic toolkit! The SIFT Workstation is a collection of tools for forensic investigators and incident responders, put together and maintained by a team at SANS and specifically Rob Lee, also available bundled as a virtual machine. Here some features: File system support NTFS (NTFS) iso9660 (ISO9660 CD)…
Article Link: https://andreafortuna.org/dfir/what-is-sift-workstation-and-how-install-it-on-my-linux-or-windows-system/