MobaLiveCD
Here is a neat and FREE app to test your Live CDs. Not sure how I missed this one, but instead of creating an entire virtual machine to boot a ISO for testing, you can just run the ISO with MobaLiveCD (http://mobalivecd.mobatek.net/en/). QEMU…
Read MoreWinFE and Triage
On the subject of triage, I have some thoughts which some companies may not like to hear (at least companies selling triage software or ‘triage computer systems’…). Here are some problems I see with several triage systems available;…
Read MoreWhat makes WinFE better/different than other forensic boot discs?
I’ve been asked on occasion, “What makes WinFE better or different than any other boot disc?”. WinFE is Windows based, not Linux. For someone not experienced in Linux, the Windows environment may be easier to use due…
Read MoreFTK Imager 3.0 in the Windows Forensic Environment
By now, most everyone involved with forensics knows about the latest release of FTK Imager 3.0. In my opinion, this is perhaps the best release ever of FTK Imager and probably one of the top releases of software this year because of one of…
Read MoreWinFE as a Student Training Aid
And yet another use for WinFE. This year, at the University of Washington’s Digital Forensics Certificate Program, I am having each student create their own Windows Forensic Environment with as many forensic applications as we can fit on a USB…
Read MoreWinBuilder-What a neat way to make a WinFE CD
I came across WinBuilder today (http://www.boot-land.net/), which provides downloads to a GUI based, Windows Live CD builder. I’m willing to try anything, so I gave it a whirl and was happy I did. With WinBuilder, many of the functions of…
Read MoreFollow up: Windows FE and Live Forensic Triage
For anyone that missed this WinFE webinar-“https://www2.gotomeeting.com/register/892321554“…I did view it today. The WinFE discussion started about 30 minutes into the webinar, and only lasted for about 10 minutes. …
Read MoreWinFE Wish List
Troy Larson and Colin Ramsden are working on making some changes and adding features of interest to Windows FE. If you have any ideas as to what you’d like to see, please post them in the forum. Some of the features of interest are Bitlocker…
Read MoreCreate your own WinFE ISO, for free, in just a few minutes
The below video shows how simply and quickly you can create a WinFE ISO. As you’ll see in the video, all you need to do is… 1) Install Windows AIK 2) Download the WinFE batch files 3) Run “createfolders.bat” 4) Copy your forensic…
Read MoreGargoyle and Windows Forensic Environment
It is great to see that the Windows Forensic Environment is being used as an accepted forensic platform by software manufactures, such as F-Response (blogged about running F-Response on WinFE) and WetStone. WetStone has a version of their…
Read More