Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | Ramblings

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password

Digital Forensics

DEC
14
0

WinBuilder Revisited

Posted by Brett Shavers
in  Digital Forensics


A big thanks to Royal Meier for providing  a script to modify the registry with a WinBuilder Win7PE build.   What I thought would be a difficult task of using WinBuilder to build a WinFE ISO, is turning out to be quite simple, at least for Royal Meier (he makes it look simple anyway).



I am planning that "the" WinFE WinBuilder will be available before Christmas, for Christmas.  So far, it works wonderfully, but there are a few tweaks to be added to make it really able to create the Super WinFE ISO without having to spend any time running batch files or typing in commands in a DOS shell.

There are a few other things to be added after the New Year, like Colin Ramsden's work, but that is coming up as well.  So, if you have procrastinated all this time to build a WinFE CD/USB, the wait is nearly over.

How cool is it to build your own custom forensically sound boot CD (in a Windows OS...) with a few clicks?  It is just plain cool.   This is quick and easy, quite super actually.
 
0
  2072 Hits
Tags:
winfe
Tweet
Share on Pinterest
2072 Hits
DEC
14
1

MobaLiveCD

Posted by Brett Shavers
in  Digital Forensics

Here is a neat and FREE app to test your Live CDs.  Not sure how I missed this one, but instead of creating an entire virtual machine to boot a ISO for testing, you can just run the ISO with MobaLiveCD (http://mobalivecd.mobatek.net/en/).  QEMU opens a virtual machine window that much faster on your screen.



This may just cut down the number of cup mats I usually make when burning CDs...

0
  2207 Hits
Tags:
winfe
Tweet
Share on Pinterest
Recent comment in this post
Guest — dubiaku
True. Looks useful. But I already have a VM in VMware called "ISO Boot" that is specifically for this. No need to make a new VM ea... Read More
Tuesday, 14 December 2010 15:13
2207 Hits
NOV
30
2

WinFE and Triage

Posted by Brett Shavers
in  Digital Forensics

On the subject of triage, I have some thoughts which some companies may not like to hear (at least companies selling triage software or 'triage computer systems'...).

Here are some problems I see with several triage systems available;

-Any triage tool that is marketed that anyone can plug it in and capture all responsive data and even create a forensic image, without having any knowledge of computers is a tool I would keep at a safe distance from custodians of data...Plug n' Play to capture evidence or triage a system?  How many problems? Let me count the ways...

-Any triage tool that is restricted to run on a specific computer is one that has just limited itself out of the market.  Since when do you want a tool that can only run on a specific computer you must buy?  Sorta useless if something happens to that computer.

-Any triage tool that professes to magically find all relevant data, even in the hands of untrained persons...wow.    Are you sure its finding what you need?

Why not triage a computer like everyone did in the old days.  Boot to a forensic OS (pick your flavor of OS) and use a tool you always use to find what you need to find.  Every case is different, so every triage is bound to be different.   On one computer, you may need to see the registry, whereas on another, you need to see the images.



And untrained persons triaging machines?  Good luck.  Emergency rooms don't use non-medical staff to triage patients, why would anyone use non-computer trained persons to triage computers?

As for a pretty good system for triage, build a WinFE disc (it's free, you don't need to buy anything other than a CD) and put your favorite forensic tools on it, the ones you use all the time.  Now you have a triage system.   No, more than that, you have a complete Windows Forensic Environment to look for exactly the things you need to look for.   Done right the first time.

So the next time you see a "Triage System" that is plug n'play simple, that decides what data you need to be collected, and that you just sit back and let it work, think about it a little more.  As for me, I want to push the buttons and triage based on what I need and what I see when I am looking at the data.

0
  2250 Hits
Tags:
winfe
Tweet
Share on Pinterest
Recent Comments
Guest — Andrew Sheldon
Hi Brett, Your comments are interesting but your conclusions are, IMHO, missing the mark by some way (and yes, we produce SPEKTOR... Read More
Monday, 29 November 2010 23:58
Guest — Brett Shavers
Thanks for your comment. There is certainly a situation for everything. I don't believe there is a single answer to the triage ... Read More
Tuesday, 30 November 2010 00:42
2250 Hits
    Previous     Next
91 92 93 94 95 96 97 98 99 100

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

© 2023 Brett Shavers