Sold by: defendA security systems
Deployed on AWS
Free Trial
AWS Free Tier
Specially crafted AMI for use in computer forensics. Stop waiting for a build and start your forensics investigation.
Overview
Starting with the tools in the SIFT forensics distribution, we've added additional tools like the dissect framework, imagemounter, and specialized python libraries like pytsk3, pyarrow and more to ensure a working environment for forensics ready for use in AWS.
Highlights
- Ready built AMI for forensics, packaged for use in AWS.
- AWS-native packaged forensic tooling, ready for use with no build time.
- Mount anything including bitlocker volumes, raw disk, memory images, pcaps or pull artifacts straight from images without unpacking them first.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 22.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
If you are an AWS Free Tier customer with a free plan, you are eligible to subscribe to this offer. You can use free credits to cover the cost of eligible AWS infrastructure. See AWS Free Tier for more details. If you created an AWS account before July 15th, 2025, and qualify for the Legacy AWS Free Tier, Amazon EC2 charges for Micro instances are free for up to 750 hours per month. See Legacy AWS Free Tier for more details.
Dimension | Cost/hour |
|---|---|
d3.xlarge Recommended | $0.10 |
t3.micro | $0.10 |
c5a.xlarge | $0.10 |
m6in.large | $0.10 |
m3.xlarge | $0.10 |
c7a.large | $0.10 |
c6a.large | $0.10 |
c8a.large | $0.10 |
m5.xlarge | $0.10 |
r5ad.large | $0.10 |
Dimensions summary
You pay by the hour for the software on top of your chosen EC2 instance. Billing is usage-based, so you are charged only while the instance runs. Each dimension maps to a specific EC2 instance type, letting you match compute to the case at hand. Options span general-purpose, compute-optimized, memory-optimized, storage-optimized, and GPU instance families, across several generations and sizes. Hourly rates rise with instance capacity. You pick a size that fits the investigation, run it, then terminate it when done, paying only for the compute each case needed.
Top-of-mind questions for buyers
Each dimension maps to one EC2 instance type. You pay the software charge per hour that instance runs, on top of the AWS infrastructure cost. One running instance equals one billing unit. The instance family and size you pick set the CPU, memory, storage, or GPU resources available for the investigation.
Hourly software charges apply only while the instance runs. When you terminate the instance after filing a report, software charges stop. A stopped instance stops software charges too, though underlying AWS storage for the 60 GB forensic volume may still incur separate AWS fees.
You pick an instance size per case. Larger instances for heavy datasets or packet captures carry higher hourly rates. Smaller instances cost less per hour. You scale up for demanding work and back down when done, so each case is billed at the rate matching the size you chose.
defenda.systems
Helpful?
Vendor refund policy
No refunds are possible, be sure to understand how to use forensic tooling before purchasing. You'll get a free trial to ensure it's the right tool.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Release v2 with native volatility symbols and a suite of cloud-centric forensic tooling.
Additional details
Usage instructions
Spin up EC2, attach a keypair and login with 'ubuntu' user.
Resources
Vendor resources
Support
Vendor support
Please email support@defenda.systems for assistance with the image. Assistance with forensic cases not provided via this AMI, contact for custom pricing.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
P3 Cyber Assist applies the P3 Lake architecture to enterprise cyber log data, creating a cost-optimized and AI-ready cyber log environment. P3 Cyber Assist supports multiple data intake methods and integrates with existing SIEM tools. P3 Cyber Assist can flexibly leverage cloud native ETL, open source ETL, or mature data analytic tools for AI-powered analysis, improving detection, event correlation, and response times.
Sift is the AI-powered fraud platform delivering identity trust for leading global businesses. Our deep investments in machine learning and user identity, a data network scoring 1 trillion events per year, and a commitment to long-term customer success empower more than 700 customers to grow fearlessly. Brands including Hertz, Yelp, and Poshmark rely on Sift to unlock growth and deliver seamless consumer experiences.
The Medex Video Authentication Platform offers justice and public safety experts a first-ever forensic toolset to automatically inspect a video file, identify the camera that created it, identify any software that was used to edit it, and report modifications that were made to the file.
Discover the truth behind media evidence. Protect the integrity of your investigations. Confidently authenticate images and video, and counter manipulated media. Magnet Verify uncovers critical insights beyond standard metadata and visible content, empowering investigators with new levels of reliability in digital media authentication.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.