Brett's Ramblings
But does it do Mac?
Just to clear up any questions on whether WinFE can 'do a Mac', well...it can. And Linux too. And of course it can do Windows as well. As long as the machine can be booted to a WinFE CD or USB, then you can image the hard drive. Actually, you can do a whole lot more than just image it...you can triage it, preview it, search it, or just copy files and folders from it. If the drive is encrypted and you have the key, you can access the drive. And what about VSS (Volume Shadow Service/Copies)....you can access those too, all through WinFE.
I can promise that as soon as you build a WinFE CD or bootable USB, you will regret not having done it months or years earlier (it's been around since 2008....). And if building a forensic boot OS makes you hesitate at all, there is no need because if you use WinBuilder, it is as simple as pointing and clicking to fully customize your Windows FE CD or bootable USB.
About the author
Comments 2
I think as long, as the suspicious machine has an Intel Architecture, Windows FE will boot. And from there, the Tools will work... Will they? Hm. Many Portable Tools (and also the viewer component of X-Ways Forensics) require special libraries, which are not included in Standard WindowsPE! But, with two clicks in winbuilder, the .NET Framework 2/3 and MS Visual C++ 2005/2008 redistributable libraries are injected automatically. No further configuration... And: it works like a charm!!!
I would post my configuration, but I changed some of the scripts, like also the WinFE forensic section...
Have a nice Day
Andreas
By accepting you will be accessing a service provided by a third-party external to https://brettshavers.com/
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
© 2023 Brett Shavers