Brett's Ramblings
1 minute reading time
(172 words)
But does it do Mac?
Just to clear up any questions on whether WinFE can 'do a Mac', well...it can. And Linux too. And of course it can do Windows as well. As long as the machine can be booted to a WinFE CD or USB, then you can image the hard drive. Actually, you can do a whole lot more than just image it...you can triage it, preview it, search it, or just copy files and folders from it. If the drive is encrypted and you have the key, you can access the drive. And what about VSS (Volume Shadow Service/Copies)....you can access those too, all through WinFE.
I can promise that as soon as you build a WinFE CD or bootable USB, you will regret not having done it months or years earlier (it's been around since 2008....). And if building a forensic boot OS makes you hesitate at all, there is no need because if you use WinBuilder, it is as simple as pointing and clicking to fully customize your Windows FE CD or bootable USB.
About the author
Comments 2
No comments made yet. Be the first to submit a comment
Posts List
Tag Cloud
writing
email
bitcoin forensics
book
Registry Forensics
Windows Forensic Environment
imaging
North korea
case studies
Virtualization
RegRipper
privacy
investigations
Hacker
4cast
Hiding Behind the Keyboard
tor browser
phishing
Volume Shadow Copy
bitcoin
windows forensic environment
Placing the Suspect Behind the Keyboard
wiretap
X-Ways Forensics Practitioner's Guide
investigation
University of Washington
Jimmy Weg
gmail
training
surveillance
windows fe
winfe
X-Ways Forensics
Bitcoin Forensics
forensics
dfir
Search Blog
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
© 2019 Brett Shavers