Menu
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • Brett's Blog
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | Ramblings

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password

winfe

Subscribe to this list via RSS
MAY
15
4

WinFE Course

Posted by Brett Shavers
in  Digital Forensics

I'm about halfway through the WinFE online course and then I'm sending it to a reviewer.  The topics and order of the curriculum are listed below.

I've added a multitude of build methods that will be documented and demonstrated in the online class.  It'll be recorded, so not a webinar where you have to close your door and tell the boss to stay out of your office during lunch. You will be able to watch it when you can and as much as you need.

imageIf you don't see something on the list that you would like to have added, now is the time to make the suggestion before I finish and upload the course.  I'm also uploading all the swag in form of batch files, white papers, wallpapers, applications, and anything else I have on WinFE for downloading.  Basically, everything you need will be in one place.

There is a test at the end of the course and you can take it if you like or not.  That is up to you to decide.  Personally, I'd take it just to say that I took coursework in a forensic tool that included an exam to test my knowledge.  This isn't a long course, but it is 'all things WinFE' wrapped up in one training program that you can take at home or during the lunch hour, about a forensic tool that anyone, and I mean literally anyone, can build on their laptop in Starbucks.  You don't need to be a programmer or software developer.  If you are a forensic examiner, you can build and use this tool.

WinFE doesn't do everything and doesn't work for every situation.  But for when you need to use forensically sound bootable environment, WinFE is pretty cool.

Curriculum

 

Introduction to the Course
Why take this course?
WARNINGS!

 

 

I. Forensic Booting of Evidence Computers
When, Why, How

 

 

II. Forensic Boot Operating Systems
Linux Forensic Operating Systems
Windows Forensic Environment (Windows FE, WinFE)

 

 

III. WinFE Basics
Creation and development of WinFE
WinFE Write Protection Tool
Disk Management & DiskPart
WinFE and Your Forensic Software


IV. Building the Windows Forensic Environment
Building the Basic WinFE
Building WinFE with WinBuilder
Building WinFE Lite
Building Mini-WinFE with Winbuilder
Building the Windows Triage Environment

 

 

V. Using WinFE
Forensic Data Collection (file copying, disk imaging)
Triage and Preview
Remote Booting and Collections
Onsite Forensic Analysis
Covert Collections/Sneak and Peeks
WinFE as a "Live" Tool
WinFE as an Electronic Discovery Tool
WinFE and Disk Encryption
Adding Drivers on the Fly

 

 

VI. Wrapping Up with WinFE
Summary

 

 

Exam
WinFE Qualification Exam

 

0
  3687 Hits
Tags:
winfe
Tweet
Share on Pinterest
Recent Comments
Guest — peet
great idea - tnx in advance
Thursday, 15 May 2014 15:01
Guest — ChiefCham
I have been messing around with WINFE since 2009. This has been a great resource for my learning. And as a Digital Forensic Examin... Read More
Tuesday, 27 May 2014 01:06
Guest — Sean
Hi ChiefCham, did you manage to create a forensically sound image of a Surface Pro with WINFE? Could you provide an overview of th... Read More
Monday, 22 September 2014 02:36
3687 Hits
MAY
11
0

Some Interesting WinFE Related Stuff I Found Online

Posted by Brett Shavers
in  Digital Forensics

[caption id="attachment_1206" align="alignright" width="300"]
wte http://pedrogilberto.net/wte/Factsheet.htm


One of the interesting things I have found online related to WinFE as I create a lesson plan for WinFE is  "WTE" or "Windows Triage Environment".  Before you get excited about this project, apparently, unless  you work in government, you can't have it.  Per the website,  "WTE is released as freeware only for Law Enforcement or Government Agencies uses."  Well darn it.  From what I can tell, it is WinFE with some software, including Colin Ramsden's write protection application,but no super-secret-LE-only programs.

The good news is that in the upcoming tutorial on All Things WinFE, you will be able to make your own WinFE or whatever you want to call it, for free, whether you are a government employee or not.

Another interesting thing I found was that the commercial version of WinFE from ForensicSoft.com is no longer available.  From the website, " Due to recent licensing changes by Microsoft, SAFE is no longer commercially available" and  "No longer commercially available, SAFE (System Acquisition Forensic Environment) was the first and only forensically sound Windows boot disk."
I don't know when ForensicSoft stopped selling their WinFE (or "SAFE"), but  it is no longer. However, I respectfully disagree on SAFE being the first and only forensically sound Windows boot disk....

Stand-by for the WinFE  class.  It's getting close to being done  I do have a trusty tech-editor to review it prior to release :)

 

0
  3064 Hits
Tags:
winfe
Tweet
Share on Pinterest
3064 Hits
MAY
10
4

Coming Soon, Online WinFE Training Program

Posted by Brett Shavers
in  Digital Forensics

I'm making a detailed tutorial on WinFE that I hope to finish in the upcoming week.  Virtually everything you need to know about WinFE will be in the tutorial, with demonstrations and instructions on everything you need to know.  I'm covering the basics to the advanced, different building methods, commercial and free/open source software to add to WinFE, how to use it in different situations, and how to prevent errors.  This means using it in forensic acquisitions, covert acquisitions, electronic discovery, triage, and preview.  You name it, I'm covering it.

The length will be about an hour (maybe a little more, maybe a little less) and will include a real test to take if you choose to go the entire route.  The purpose is to give you, the professional examiner, a complete training program in WinFE with a test to validate your knowledge.  For those that already see the intention of the test and online training, let me explain to others that might be missing the point.

Although I'm not going to proctor your test, look over your shoulder, or have you scan your fingerprint to make sure it was you that took the test, I am providing the test for your benefit.  As you know, training and experience is everything.  It's everything on your resume.  It's everything when you testify.  It's everything when you are doing your job.  With that, I will give you a solid training in WinFE that you can take to the bank (in a manner of speaking...).

So, if you want formal training in WinFE, as much as an online class can be, stand by, it's coming pretty darn soon.  Pass the info along.  We can all benefit when more examiners use WinFE.  Plus, I'd rather be the expert that had training in WinFE when going against someone that didn't have any training with it...

winfe2

0
  3113 Hits
Tags:
winfe
Tweet
Share on Pinterest
Recent Comments
Guest — Mark Hallman
Brett, This great. Thanks for sharing your knowledge. Can you point us toward a tutorial for adding app to the WinFE?
Saturday, 10 May 2014 13:56
Guest — Brett Shavers
I'll have that in the online tutorial. One of the reasons I am going to make this is to make it so anyone can do it without spend... Read More
Saturday, 10 May 2014 14:11
Guest — Emory Mullis
Brett Thanks and I look forward to it. Do you know when it will be released? Thanks again as I truly enjoy learning new things.... Read More
Wednesday, 16 July 2014 10:22
3113 Hits
    Previous     Next
2 3 4 5 6 7 8 9 10 11

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Brett's blog

© 2023 Brett Shavers