Ok, it took a while to get this done, mostly because of other projects. But it is done. I have videos of most build methods, tips and tricks, pro's and con's, and aspects of WinFE that you may find important. I also included every bit of downloadable swag in the course too (batch files, wallpaper, scripts, etc...).
All in all, this is probably the best source of WinFE you will find. I encourage you to share it and use it, after all, this is a free tool. If anyone has suggestions on making the course better, let me know and I can try to squeeze in some improvements.
[caption id="attachment_1231" align="aligncenter" width="700"] http://courses.dfironlinetraining.com/windows-forensic-environment
The WinFE course was lots of work, but certainly worth the time to watch. The X-Ways course is something else entirely. The manner in which I made the X-Ways course is so that you can follow along with XWF in learning how to work a case with X-Ways Forensics. The course describes the options and buttons in XWF, but also shows how to simply work a case. There are literally so many features in X-Ways, that without training, you will be missing about 50% of what you should be doing. I found that even the most current version of the X-Ways manual does not list features in XWF...lots of information to keep up with, tons of features to consider, easy to miss something that you should not miss for such a powerful forensic tool.
If you want to be notified of the coupon code, be sure to follow the X-Ways blog at http://xwaysforensics.wordpress.com/ or the twitter account at https://twitter.com/XWaysGuide.
Check out the reboot.pro forum. There are several threads (one is http://reboot.pro/topic/15924-how-to-update-to-net-framework-40/) where there are scripts being written or have been written. Download and save the script to the winbuilder project folders and you'll have the option to add it when you build. Don't build a 64bit, it probably won't work with dotnet.
You could try Mini-WinFE - use one of the ADK pre processing scripts in the Tools folder and select the relevant .NET framework support - e.g. WinPE-NetFX.
.NET support in WinPE is limited - see http://technet.microsoft.com/en-gb/library/hh824926.aspx. The ADK scripts will handle the dependencies (WinPE-WMI)
The short answer is that it's not easy.
The longer answer is that dotnet adds a whole of data to the build and is not so easy to inject it. There are a few vendors working on a simple solution with help from some great folks (like Misty...). If a solution is developed that is simple (one button selection for building), then the world opens up for running virtually everything in WinFE/PE.
I have just completed this course and it was worth my day to do it. Thank you for putting this together.
By accepting you will be accessing a service provided by a third-party external to https://brettshavers.com/
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
© 2023 Brett Shavers