WinFE has some street cred with the Scientific Working Group on Digital Evidence
Cool. WinFE is mentioned in a Scientific Working Group on Digital Evidence document.
Discover more from Brett's Ramblings
Subscribe to get the latest posts sent to your email.
well, not exactly IMHO – it is only mentioned as a tool for “Booting from forensic distribution media (e.g., Raptor, Windows FE) […]”. But when it comes to a recommendation, the text only mentions Windows PE in section 5 (“Boot to a UEFI compatible boot environment, which MAY include: *Windows PE *Windows To Go”). While possibly just a mistyping it gives some dubious impression.
Yes, not detailed in the doc, but between emails about WinFE when the doc was being written, it’s one of the boot methods recommended. The point mainly being to give credibility to a forensic tool as valid (along with the other tools mentioned in the paper as well). I mention the paper only because I still get emails arguing WinFE not being an effective and ‘accepted’ method (I’m not sure why I get asked since I didn’t create WinFE…).