SANS just released their SIFT Workstation VMware Appliance. It has been loaded up with all of the forensics tools you could ask for. See the overview below from the SANS Forensics Blog:

SANS SIFT Workstation Overview

• VMware Appliance
• Ready to tackle forensics
• Cross compatibility between Linux and Windows
• Forensic tools preconfigured
• A portable lab workstation you can now use for your investigations

You'll also find some of the tools Keven Murphy has written on the appliance.

Check out the write up on the SANS Forensics Blog at: http://sansforensics.wordpress.com/2008/12/24/happy-holidays-sans-sift-workstation-version-12-released/

Happy Holidays!