diff --git a/sift/python-packages/analyzemft.sls b/sift/python-packages/analyzemft.sls
deleted file mode 100644
index 0f6cd22b..00000000
--- a/sift/python-packages/analyzemft.sls
+++ /dev/null
@@ -1,14 +0,0 @@
-{%- set commit="64c71d7c8905a119b7abdf9813e6ef5f11d3ccf1" -%}
-include:
-  - sift.packages.git
-  - sift.packages.python3-pip
-  - sift.packages.python2-pip
-
-analyzemft:
-  pip.installed:
-    - name: git+https://github.com/dkovar/analyzeMFT.git@{{ commit }}
-    - bin_env: /usr/bin/python2
-    - upgrade: True
-    - require:
-      - sls: sift.packages.git
-      - sls: sift.packages.python2-pip
diff --git a/sift/python-packages/init.sls b/sift/python-packages/init.sls
index 6bd0298e..09827f2f 100644
--- a/sift/python-packages/init.sls
+++ b/sift/python-packages/init.sls
@@ -1,5 +1,4 @@
 include:
-  - sift.python-packages.analyzemft
   - sift.python-packages.appcompatprocessor
   - sift.python-packages.argparse
   - sift.python-packages.bitstring
@@ -32,7 +31,6 @@ sift-python-packages:
   test.nop:
     - name: sift-python-packages
     - require:
-      - sls: sift.python-packages.analyzemft
       - sls: sift.python-packages.appcompatprocessor
       - sls: sift.python-packages.argparse
       - sls: sift.python-packages.bitstring
diff --git a/sift/python3-packages/analyzemft.sls b/sift/python3-packages/analyzemft.sls
new file mode 100644
index 00000000..33c7a477
--- /dev/null
+++ b/sift/python3-packages/analyzemft.sls
@@ -0,0 +1,41 @@
+# Name: analyzeMFT
+# Website: https://github.com/rowingdude/analyzeMFT
+# Description: NTFS MFT File Parser
+# Category: 
+# Author: Benjamin Cance
+# License: MIT License (https://github.com/rowingdude/analyzeMFT/blob/master/LICENSE.txt)
+# Notes: analyzemft
+
+{% set commit = 'b1d0e6a0aa58d42000bfdb8e6588513bd62eaeab' %}
+
+include:
+  - sift.packages.python3-virtualenv
+  - sift.packages.git
+
+sift-python3-package-analyzemft-virtualenv:
+  virtualenv.managed:
+    - name: /opt/analyzemft
+    - venv_bin: /usr/bin/virtualenv
+    - pip_pkgs:
+      - pip>=24.1.3
+      - setuptools>=70.0.0
+      - wheel>=0.38.4
+    - require:
+      - sls: sift.packages.python3-virtualenv
+
+sift-python3-package-analyzemft:
+  pip.installed:
+    - name: git+https://github.com/rowingdude/analyzemft.git@{{ commit }}
+    - bin_env: /opt/analyzemft/bin/python3
+    - upgrade: True
+    - require:
+      - virtualenv: sift-python3-package-analyzemft-virtualenv
+      - sls: sift.packages.git
+
+sift-python3-package-analyzemft-symlink:
+  file.symlink:
+    - name: /usr/local/bin/analyzemft
+    - target: /opt/analyzemft/bin/analyzemft
+    - makedirs: False
+    - require:
+      - pip: sift-python3-package-analyzemft
diff --git a/sift/python3-packages/init.sls b/sift/python3-packages/init.sls
index 4d8a3aff..b06aa9d9 100644
--- a/sift/python3-packages/init.sls
+++ b/sift/python3-packages/init.sls
@@ -1,4 +1,5 @@
 include:
+  - sift.python3-packages.analyzemft
   - sift.python3-packages.python3-keyring
   - sift.python3-packages.pip
   - sift.python3-packages.python3-keyring
@@ -31,6 +32,7 @@ sift-python3-packages:
   test.nop:
     - name: sift-python3-packages
     - require:
+      - sls: sift.python3-packages.analyzemft
       - sls: sift.python3-packages.python3-keyring
       - sls: sift.python3-packages.pip
       - sls: sift.python3-packages.python3-keyring