Brett's Blog
What makes WinFE better/different than other forensic boot discs?
I've been asked on occasion, "What makes WinFE better or different than any other boot disc?". WinFE is Windows based, not Linux. For someone not experienced in Linux, the Windows environment may be easier to use due to familiarity with Windows. Additionally, WinFE allows you to use your Windows based forensic applications in a fore...
By now, most everyone involved with forensics knows about the latest release of FTK Imager 3.0 . In my opinion, this is perhaps the best release ever of FTK Imager and probably one of the top releases of software this year because of one of the newest features and the price ( FREE and MOUNTS IMAGES! ). Given other expensive softw...
And yet another use for WinFE. This year, at the University of Washington's Digital Forensics Certificate Program, I am having each student create their own Windows Forensic Environment with as many forensic applications as we can fit on a USB drive. This fulfills several objectives that any school or training program can incorporate at virt...
I came across WinBuilder today ( http://www.boot-land.net/ ), which provides downloads to a GUI based, Windows Live CD builder. I'm willing to try anything, so I gave it a whirl and was happy I did. With WinBuilder, many of the functions of Windows that are not in the basic WinFE builds are included. This includes the Windows"Start" bu...
For anyone that missed this WinFE webinar-" https://www2.gotomeeting.com/register/892321554 "...I did view it today. The WinFE discussion started about 30 minutes into the webinar, and only lasted for about 10 minutes. Fortunately, there was a question/answer after the presentation for about 10 minutes. However, the on...
Troy Larson and Colin Ramsden are working on making some changes and adding features of interest to Windows FE. If you have any ideas as to what you'd like to see, please post them in the forum . Some of the features of interest are Bitlocker support and VSS support. Feel free to shoot your requests here since you have the best hands on WinFE looki...
The below video shows how simply and quickly you can create a WinFE ISO. As you'll see in the video, all you need to do is... 1) Install Windows AIK 2) Download the WinFE batch files 3) Run "createfolders.bat" 4) Copy your forensic tools into a folder 5) Run "createwinfe.bat" 6) Burn your CD with the created ISO [youtube=http://www.youtube.com/watc...
It is great to see that the Windows Forensic Environment is being used as an accepted forensic platform by software manufactures, such as F-Response (blogged about running F-Response on WinFE) and WetStone. WetStone has a version of their malware software available on the WinFE system (although WetStone calls it the Windows Forens...
Colin Ramsden has been working feverishly on some modifications to WinFE that will appeal to everyone. For some teaser screenshots, take a look here . Bitlocker support, installing drivers while already booted to WinFE, clean shutdown that ejects the CD, and an easy to use Disk Management Console. Believe it or n...
As you can see, the WinFE site has been migrated to WordPress. This format allows me a little more freedom than Blogger as well as less time maintaining a website. This site and work is free...be patient ;) You can now find the batch files accessed through direct downloads. I am more than happy to put up additional work or correct...
The WinFE journey… From Troy Larson’s first vision of the Windows Forensic Environment to the improvements currently being made, WinFE is set to become one of the best forensic boot disks/USBs available. The ease to which it can be created has been simplified greatly by Björn Ganster’s automated batch files (my initial batch files were elementary c...
Search Blog
Categories
Posts List
Tag Cloud
wiretap
4cast
windows forensic environment
imaging
windows fe
investigation
Volume Shadow Copy
Virtualization
training
North korea
X-Ways Forensics
forensics
book
Windows Forensic Environment
Hiding Behind the Keyboard
winfe
phishing
bitcoin
RegRipper
writing
Hacker
X-Ways Forensics Practitioner's Guide
privacy
tor browser
Bitcoin Forensics
surveillance
University of Washington
email
bitcoin forensics
Registry Forensics
case studies
dfir
investigations
Jimmy Weg
gmail
Placing the Suspect Behind the Keyboard
Upcoming Events
-
DEC 04
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related
.
© 2018 Brett Shavers