Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | Ramblings

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password
Font size: + –
Subscribe to this blog post Unsubscribe
Report
Print
4 minutes reading time (761 words)

Mini-WinFE Updated

Digital Forensics
Brett Shavers
Saturday, 26 April 2014
5191 Hits
3 Comments

"Misty" has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mistype.reboot.pro/documents/WinFE/winfe.htm. This is the kind of stuff you want to read in order to really know as much about WinFE as possible.  Another really good source of info on mistype is at http://mistype.reboot.pro/mistype.docs/readme.html.

Before I get any complaints about "WinFE is not perfect" or "WinFE can't do everything", let me that yes that is correct. It is not perfect and cannot do everything.  In the world of forensically booting evidence machines, some Linux bootable environments work very well too.  Some machines can't be booted forensically, that is true as well.  But for the marjority of systems that can be booted forensically, WinFE has its place.  For the average and above-average examiner needing to boot the evidence machine, there are few options available that make it super-easy to add drivers on the fly or use your Windows based apps from the office rather than Linux based you hardly (if ever) use.

If you haven't checked out WinFE, you should.  Everyone else is already on board :)

Some tidbits in the Mini-WinFE include:


  • DMDE (included)

  • Forensic Acquisition Utilities (downloaded automatically)

  • FTK Imager (copied from local install)

  • HWiNFO (included)

  • LinuxReader (downloaded automatically)

  • MW Snap (included)

  • NT Password Edit (included)

  • Opera (included)

  • Sumatra PDF Reader (included)

  • X-Ways Forensics (copied from local install)

  • Write Protect Tool (included)


  •  


[caption id="attachment_1177" align="aligncenter" width="806"]WINFE You gotta download the new version and check it out. It's plain cool. http://reboot.pro/files/file/375-mini-winfe/


 

 

2014.04.26

==========



* Added a number of additional options in the core script - 

  these are all enabled by default. The new options will 

  remove a number of unsupported options from the right-click 

  context menu. Thanks to reboot.pro forum member farda for

  these suggestions.



* Added "Open with" workaround for WinPE 4.0/5.0. See -

  http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/



* WinFE settings are now separate to the Shell script - but are 

  still mandatory. They have been moved to a new script 

  \Programs.winfe.script



* Option to use either SANPolicy 3 or 4 (in new WinFE script) -

  SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as

  SANPolicy 4 is only supported in WinPE 4.0/5.0.



* File dependencies (to be extracted from install.wim or

  copied from the host Operating System) are handled in one

  (hidden) script -  Core\required.files.script. This will 

  make it simpler to implement any future file dependencies. 



* Added a script to copy files and folders from a local 

  directory - allowing the easy addition of third party files. 

  A menu entry will open the directory these files were copied 

  to. 



* Added Tools\Create USB script - it's now possible to 

  create a MistyPE bootable UFD during the build process.

  Use with caution - see documentation for more details. 

  Tested with Windows 7 (SP1) and Windows 8.1.



* Added ADK For Win 8 (and 8.1) scripts. Refer to documents.

  NOTE - this has only been tested using Windows 7 (SP1) 

  and Windows 8.1.



* Wallpaper support (.jpg) added for all builds - this 

  feature was not previously working with WinPE 4/5. See

  Programs\Wallpaper script.



* Wimlib-ImageX updated to version 1.6.2



* Added build 6.3.9600 (Windows 8.1 - Final) to the list  

  of tested/working sources.



* Added the following scripts -

	- WinHex

	- DMDE

	- Opera - 64-bit support added.

	- Keyboardlayouts



* Included FAU in the download. This is redistributed

  with the permission of the author (GMG Systems Inc) -

  refer to the project documentation.



* Program scripts now contain menu entries - this should

  make it easier to add new program scripts. Previously 

  all menu entries were contained in the shell script - 

  resulting in multiple script edits for any new programs 

  added.



* Various tweaks in core script 

	- "FileDelete,"%Cache%\temp\*.*" has been added to

	  to ensure that cached batch files and .ini files 

	  are deleted earlier in the build process. Without  

	  this fix there are errors in some very limited 

	  curcumstances.

	- Added verification check from registry files  

	  extracted from boot.wim - only used if the 

	  wimlib-imagex checks fail.



* Script structure has been changed for all Program scripts. 

  Hopefully results in better error checking for any missing 

  files.



* Browse for folder support is added by individual program 

  scripts even if this option is not selected in the Core 

  script. Resulting in a more modular approach (see 

  "http://reboot.pro/topic/19042-modular-apps-philosophy-for-winpe/"

  for the philosophy behind this approach).



* Documentation updated - added section on using the ADK 

  For Win 8.1. 

 

Tweet
Share on Pinterest
0
Tags:
winfe
www.reboot.pro discussion | DMDE - Basic Disk Imag...
Free Course Materials - Placing the Suspect Behind...

About the author

Brett Shavers

Brett Shavers

 

Comments 3

Guest
Guest - Troy on Saturday, 26 April 2014 02:47

Thank you again.

Anyone who complains that Windows FE is not perfect is either raising or battling a Straw man. (http://en.wikipedia.org/wiki/Straw_man). It's a tool.

If you work in an environment that has an enterprise license, I would suggest you look into Windows To Go, which can have all the functionality of Windows FE, plus networking and RDP. Imaging a data center server is so much more pleasant when you can do it from any place other than in the cage in the data center.

The latest version of Windows PE (WinPE 5.1, http://technet.microsoft.com/en-us/library/dn613859.aspx) offers Windows Image File Boot (WimBoot) to reduce the Windows PE foot print. I haven't had a chance to work with it yet, but it looks like it might be a useful feature for Windows FE. See, http://technet.microsoft.com/en-us/library/dn594399.aspx.

0 Cancel Reply
Thank you again. Anyone who complains that Windows FE is not perfect is either raising or battling a Straw man. (http://en.wikipedia.org/wiki/Straw_man). It's a tool. If you work in an environment that has an enterprise license, I would suggest you look into Windows To Go, which can have all the functionality of Windows FE, plus networking and RDP. Imaging a data center server is so much more pleasant when you can do it from any place other than in the cage in the data center. The latest version of Windows PE (WinPE 5.1, http://technet.microsoft.com/en-us/library/dn613859.aspx) offers Windows Image File Boot (WimBoot) to reduce the Windows PE foot print. I haven't had a chance to work with it yet, but it looks like it might be a useful feature for Windows FE. See, http://technet.microsoft.com/en-us/library/dn594399.aspx.
Cancel Update Comment
Guest
Guest - Brett Shavers on Saturday, 26 April 2014 03:55

Oh yes. Windows To Go is a better way to go for sure. But that darn enterprise license keeps Windows To Go at bay for many...I'll take a look at the latest winpe too, sounds neat.

0 Cancel Reply
Oh yes. Windows To Go is a better way to go for sure. But that darn enterprise license keeps Windows To Go at bay for many...I'll take a look at the latest winpe too, sounds neat.
Cancel Update Comment
Guest
Guest - Leonid Gutnik on Saturday, 26 April 2014 18:21

Big thanks. I'm equal to zero in Forensic. Very interesting.

Sat, 26 Apr 2014 15:55:36 +0000 от "WordPress.com" : >Brett Shavers posted: ""Misty" has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mi " >

0 Cancel Reply
Big thanks. I'm equal to zero in Forensic. Very interesting. Sat, 26 Apr 2014 15:55:36 +0000 от "WordPress.com" : >Brett Shavers posted: ""Misty" has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mi " >
Cancel Update Comment
Guest
Tuesday, 07 February 2023

Captcha Image

By accepting you will be accessing a service provided by a third-party external to https://brettshavers.com/

direct link

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

© 2023 Brett Shavers