"Misty" has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mistype.reboot.pro/documents/WinFE/winfe.htm. This is the kind of stuff you want to read in order to really know as much about WinFE as possible.  Another really good source of info on mistype is at http://mistype.reboot.pro/mistype.docs/readme.html.

Before I get any complaints about "WinFE is not perfect" or "WinFE can't do everything", let me that yes that is correct. It is not perfect and cannot do everything.  In the world of forensically booting evidence machines, some Linux bootable environments work very well too.  Some machines can't be booted forensically, that is true as well.  But for the marjority of systems that can be booted forensically, WinFE has its place.  For the average and above-average examiner needing to boot the evidence machine, there are few options available that make it super-easy to add drivers on the fly or use your Windows based apps from the office rather than Linux based you hardly (if ever) use.

If you haven't checked out WinFE, you should.  Everyone else is already on board :)

Some tidbits in the Mini-WinFE include:

• DMDE (included)


• Forensic Acquisition Utilities (downloaded automatically)


• FTK Imager (copied from local install)


• HWiNFO (included)


• LinuxReader (downloaded automatically)


• MW Snap (included)


• NT Password Edit (included)


• Opera (included)


• Sumatra PDF Reader (included)


• X-Ways Forensics (copied from local install)


• Write Protect Tool (included)


 

[caption id="attachment_1177" align="aligncenter" width="806"] You gotta download the new version and check it out. It's plain cool. http://reboot.pro/files/file/375-mini-winfe/


 

 

2014.04.26

==========



* Added a number of additional options in the core script - 

  these are all enabled by default. The new options will 

  remove a number of unsupported options from the right-click 

  context menu. Thanks to reboot.pro forum member farda for

  these suggestions.



* Added "Open with" workaround for WinPE 4.0/5.0. See -

  http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/



* WinFE settings are now separate to the Shell script - but are 

  still mandatory. They have been moved to a new script 

  \Programs.winfe.script



* Option to use either SANPolicy 3 or 4 (in new WinFE script) -

  SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as

  SANPolicy 4 is only supported in WinPE 4.0/5.0.



* File dependencies (to be extracted from install.wim or

  copied from the host Operating System) are handled in one

  (hidden) script -  Core\required.files.script. This will 

  make it simpler to implement any future file dependencies. 



* Added a script to copy files and folders from a local 

  directory - allowing the easy addition of third party files. 

  A menu entry will open the directory these files were copied 

  to. 



* Added Tools\Create USB script - it's now possible to 

  create a MistyPE bootable UFD during the build process.

  Use with caution - see documentation for more details. 

  Tested with Windows 7 (SP1) and Windows 8.1.



* Added ADK For Win 8 (and 8.1) scripts. Refer to documents.

  NOTE - this has only been tested using Windows 7 (SP1) 

  and Windows 8.1.



* Wallpaper support (.jpg) added for all builds - this 

  feature was not previously working with WinPE 4/5. See

  Programs\Wallpaper script.



* Wimlib-ImageX updated to version 1.6.2



* Added build 6.3.9600 (Windows 8.1 - Final) to the list  

  of tested/working sources.



* Added the following scripts -

	- WinHex

	- DMDE

	- Opera - 64-bit support added.

	- Keyboardlayouts



* Included FAU in the download. This is redistributed

  with the permission of the author (GMG Systems Inc) -

  refer to the project documentation.



* Program scripts now contain menu entries - this should

  make it easier to add new program scripts. Previously 

  all menu entries were contained in the shell script - 

  resulting in multiple script edits for any new programs 

  added.



* Various tweaks in core script 

	- "FileDelete,"%Cache%\temp\*.*" has been added to

	  to ensure that cached batch files and .ini files 

	  are deleted earlier in the build process. Without  

	  this fix there are errors in some very limited 

	  curcumstances.

	- Added verification check from registry files  

	  extracted from boot.wim - only used if the 

	  wimlib-imagex checks fail.



* Script structure has been changed for all Program scripts. 

  Hopefully results in better error checking for any missing 

  files.



* Browse for folder support is added by individual program 

  scripts even if this option is not selected in the Core 

  script. Resulting in a more modular approach (see 

  "http://reboot.pro/topic/19042-modular-apps-philosophy-for-winpe/"

  for the philosophy behind this approach).



* Documentation updated - added section on using the ADK 

  For Win 8.1. 

 

Do you teach cybercrime/forensics and use "Placing the Suspect Behind the Keyboard"?  Maybe you are considering using this book in your course?  How would you like to have ready-made PowerPoints for the chapters with additional student materials to go along with the book in your course? 

I have had a few people tell me that this book is being used in their classes, but can't recall all of the colleges.  If you have used this book in a class, send me the instructor's name or have the instructorThis email address is being protected from spambots. You need JavaScript enabled to view it. so I can pass along information on materials for the class.

I will be starting on the materials now and will give access to any instructors that want to lend a hand and get early drafts for use right away.  The materials will be freely available for instructors to use and modify in their coursework.  As someone that has taught forensics for a few years, it is very very helpful to have class materials available rather than reinventing the wheel every class...

I get a few stories of how WinFE saved the day and a few of these heroes let me retell their story. This is one of them. The ‘detective’ wishes to be unnamed, but for sake of argument, I know who he is…

------------------------------------------------------------------------------------------------------------------------

 A detective from a California law enforcement agency that had attended the SEARCH “Network Investigation and Digital Triage” course contacted the instructors with assistance in building a WinFE based on Windows 8.1. The detective was given guidance and links to the various resources needed to create the WinFE8.1SE. The detective was further given assistance in adding in the utilities he would need and finally validating the build to insure that it was forensically sound.

 In a follow up call, the detective indicated that the he had obtained the duplicate images he needed, with one minor modification. He found that one of the target drives was mounted through an add-in card and was not initially recognized by WinFE8.1SE. Noting that Colin Ramsden’s write protect utility allowed for adding drivers to the system, the detective located the add-in card drivers and added them to the system. WinFE8.1SE and Colin’s WP utility then recognized the additional drive and allowed mounting it read only. The detective then successfully obtained duplicate images of both target drives.

 

------------------------------------------------------------------------------------------------------------------------

 

 

As a side note, consider that WinFE started with Troy Larson typing out a 2-page Microsoft Word document on changing registry values in a winPe to get a winFe. That little idea is now taught at local, state, and federal agencies as well as public/private education and training courses. Basically, it’s is use by many.   This success story is neat because it shows how easy it is to add a driver on-the-fly. You don’t need much technical experience to use Colin’s app to add drivers or toggle hard drives. We beat it up pretty good to get it right; Colin is one of those extremely competent software writers and I am glad he helped out the WinFE project.

Got a success story? Send it to me and I’ll share the word.

 

I’ve been waiting until I received the hard copy of this book to write the review. I had the fortune of being the tech editor for this book and enjoyed every minute of it. Although I do not have an ongoing financial interest in this book, I do have a vested personal interest based on the reasons Harlan Carvey lays out in many chapters. I’ll get to my personal interest later in this review.  Also, Harlan has a post on updated book contents here: http://regripper.wordpress.com/2014/04/14/regripper-download-2/

Without reading any reviews, those analysts who buy Harlan’s books will keep buying his books with the full expectation of having a well-written (as in easy-to-read) book on Windows OS forensics. There is no need to read any further in this review if you fit in this category. This is Harlan’s new book. That is all you really need to know. But if you just want my opinion, read on…

The topics in the 4th Edition of WFA are all eye-catching. Volume shadow copies, file analysis, registry, malware, timelines, tracking user activity, and more.   Every topic detailed in all the chapters, is relevant to everyone that touches a Windows system to examine. The difference between Harlan’s books and others is the guidance given. For example, rather than reading a discourse on some technology, Harlan gives practical advice, suggestions, and real-life stories that relate to the points in the book. Since we have all made mistake (or will make mistakes, or have made mistakes but just don’t know it yet), having guidance that reduces mistakes in the way of stories and plain talk is well worthwhile to read.

The book has too much information to be covered in a review. There is more information on accessing volume shadow copies using several different methods than I want to review. The same can be said for file analysis, registry analysis, timelines, and every other topic. Harlan gives several options to accomplish the same task, using different software.   Although I wrote a book on one software (X-Ways Practitioners Guide), I obviously use more than just one software. Any forensic book, other than a manual or software guide, that does not give options with various types of software does not give the reader options to solve problems.

Another facet of Harlan’s book is his never-ending harping of asking everyone to ‘share information’. That sentence may sound negative, but truthfully, I don’t know how Harlan has the energy to push the sharing of information for so long. The book is sprinkled with this tone and I echo the importance of sharing information. I did my best to keep up with Harlan’s book as I tech edited it, working his suggestions. Some of the methods he wrote were new to me, which I would not have found on my own without happening upon the method in a blog..maybe.

Those examiners who conduct investigations, not just an analysis of a machine, will enjoy the guidance on tracking user activity, writing reports, drawing conclusions, correlating data, and making inferences.  Those topics are my personal favorites.

Harlan writes in this book that sharing helps us to know what is possible. That makes sense, because how can you know what you don’t know.

I can say unequivocally that writing a digital forensics book is primarily, if not solely, to share information. Few (no one?) gets rich writing a computer technical book in the niche of digital forensics. The market for a digital forensic book is probably a fraction of a fraction of a fraction when compared to a Tom Clancy or JK Rowling book. With that, consider that when Harlan says he writes to share, he really means that he writes to share, just like all other forensic book writers.

The personal risk to sharing, which everyone knows, is that you could be totally wrong, slightly inaccurate, poorly written, disproved later, or maybe you “discovered” something that everyone else already knew. This risk of sharing keeps the majority of examiners quiet and makes it seem that there are only a few examiners that share information. That is why we see the same names popping up online and conferences through the years. But in the audiences listening to these same names, there are smarter people, better examiners, and great investigators. They just don’t speak up or share information.  (nudge..nudge...feel free to share...no one will bite you).

That is one of Harlan’s premises to keep going and he reiterates it in the book and his blog and when he speaks. We all get ‘smarter’ when we share. None of us move forward when we don’t share.   To share is to take a risk of being wrong and embarrassed. Worse still is the fear to be wrong and get attacked online. However, for all those that share, either by asking questions, giving suggestions, or describing methods you have created or use, my hat goes off to you. It takes guts to put yourself out there, knowing that the sharks are circling and sniffing for blood.

Back to my personal interest in this book. When I have found a method or tool that I like, I want everyone to use it. I don’t hold it close to my chest or hide it. I share it. I become an evangelist to that tool or method to get the word out. The reason? The more examiners in the field that use it, the more chance the method/tool becomes an industry standard. Then it gets improved upon, further developed, “court accepted” in that the results obtained by that tool/method are accepted into a court, and I get to use the tool/method more.

The best personal example I can give to prove this point is with WinFE (http://winfe.wordpress.com). From a two-page Word document typed by Troy Larson of Microsoft, I marketed that little ingenious tool as if I was making a million bucks off it. It’s now in use by every country that does forensics and in just about every agency or company in those countries. It’s even taught in forensic training programs in both the public and private sector. So now, anyone can create and use WinFE without worry of using a non-industry accepted tool. This happened only because those that used WinFE, shared the knowledge of how to use and when to use it. Imagine if we did that with every “new” effective method or tool.

The key point in the prior two paragraphs is that Harlan’s book has lots of those types of ideas that he has shared. He gives credit to ideas created by others along with sharing his own ideas.

My only negative words on WFA/4 is…maybe X-Ways Forensics could have been put in it...but that's what we have the XWF Guide for..

My suggestion on WFA/4…buy the book. You will not regret it.  My other favorite books are here http://winfe.wordpress.com/books/.

 

 

Don’t forget to vote for the XWF Guide at http://forensic4cast.com/2014/04/2014-forensic-4cast-awards-meet-the-nominees/.  But of course, only vote if you liked it :)

And if you didn’t like it (which means you don’t have XWF…), vote for my other book, Placing the Suspect Behind the Keyboard.  But again, only vote if you liked it :)

And if you didn’t like that book either…give me your phone number.  We need to talk…

Don’t forget to vote for the XWF Guide at http://forensic4cast.com/2014/04/2014-forensic-4cast-awards-meet-the-nominees/.  But of course, only vote if you liked it :)

And if you didn’t like it (which means you don’t have XWF…), vote for my other book, Placing the Suspect Behind the Keyboard.  But again, only vote if you liked it :)

And if you didn’t like that book either…give me your phone number.  We need to talk…

[caption id="568" align="alignleft" width="150"] Forensic 4cast Awards


I just saw that the book of the year nominees at the Forensic 4cast Awards include both the X-Ways Practitioner's Guide and Placing the Suspect Behind the Keyboard.  For those that made the nominations, that was very kind.  For those that vote for either book, I thank you in advance.

Both books are pretty good.  Each gives plenty of tips and information to save you hours of frustration, and more importantly, close some cases.  There is a sample chapter of Placing the Suspect Behind the Keyboard here: http://searchsecurity.techtarget.com/feature/Placing-the-Suspect-Behind-the-Keyboard  There are reviews at Amazon for both books that may be helpful if you were thinking of getting either book.

If you use X-Ways.....you need the X-Ways Guide, no matter how long you have been using X-Ways.  When I asked Eric to help me write this book, he ran with it and did a super job of helping create an easy to read guide to using a very powerful forensic tool.  I have more than a ton of emails of how the book converted Encase/FTK primary users into XWF primary users.

As for the Placing the Suspect Behind the Keyboard, that has also helped more than a few examiners close a case with a simple (yet elusive) tip, trick, method, or process that saves hours, if not days, of work.  Again, even if you have been doing forensics for a long time, nothing says you can't learn or relearn something you may not know or have forgotten.

Thanks again to everyone.

Brett

 

Cool.  Looks like there is a new discount on my book, "Placing the Suspect Behind the Keyboard".  Plus, it also looks like an entire chapter is available for download.

[caption id="1142" align="alignleft" width="266"] Cool. A discount. Get it while you can!


I'm also giving a presentation on this book at NOLACON (New Orleans, Louisiana).

http://amzn.to/O38eWh


I previously posted that a book on FTK is sure to come along, since we have the best book of X-Ways and the other book on Encase.  Now comes a book on FTK.  Just like the XWF Guide or the upcoming Encase guide, I wouldn't see any reason for a FTK user to not have a book on FTK.

It makes sense to have "the" book on X-Ways, "the" book on Encase, and "the" book on FTK.  By having books on your major forensic suites, it is easier to compare what suite "A" does compared to tools "B" and "C" as well as how to get from point A to B using each tool.

So....how about that book on ProDiscover?  Anyone?  Grab the opportunity before someone else does.  I promise to buy it, as I have already ordered the FTK and Encase books.

I have brief reviews on my favorite DF books at http://winfe.wordpress.com/books/

--------------------------------------------------------------------------







 

[caption id="attachment_547" align="aligncenter" width="170"] http://amzn.to/O38eWh

[caption id="attachment_549" align="aligncenter" width="169"] http://amzn.to/P9XxCl

[caption id="attachment_347" align="aligncenter" width="173"] http://amzn.to/1gfx0t5

Computer Forensics and Digital Investigation with EnCase Forensic

http://amzn.to/1eY02wn


 

I know, this has nothing to do with X-Ways Forensics.  But hey, the X-Ways Practitioner's Guide was first...

Practically, this seems like a good book for Encase users to park on the shelf (while the X-Ways Practitioner's Guide sits on your desk next to your keyboard).

So, when is that book on "FTK" coming out....and who is going to write it?...And if you do want to write it, give Syngress a shout.

Taking WinFE to even another level on a multiboot thumbdrive.  Very cool, but I spread this word to you because there are few things in life neater than a forensically bootable CD/USB with X-Ways Forensics.

From Hacking Exposed: Adding the WinFE Image to the Multiboot Thumbdrive Image (Video)

http://www.youtube.com/watch?v=Ce9eQ0OG2jA

http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html

Taking WinFE to even another level on a multiboot thumbdrive.  Very cool.

http://www.youtube.com/watch?v=Ce9eQ0OG2jA

http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html

The X-Ways Users Conference is here in a few weeks.  My kind of conference: Australia and fellow X-Ways users! 

 

Maybe next year for me...but it sure would make for a good vacation, I mean, training trip.

 

 

 

 

 

Not that many years ago, you would not find a requirement of having experience with X-Ways to apply for a DFIR job.   But now, some jobs recommend it and yet some others require it.  This is not to say the other big players (Encase, Accessdata, etc..) are not needed or useful, just that XWF has made it to the same level at a price point that will probably not be beat with capabilities that still outpace other tools.

So......it makes sense to know a little about the tool that might put you over the edge for that next job.  Of course, you need to be competent too, but like I've said before, "beware the examiners that use X-Ways Forensics because they probably know what they are doing."



For the future XWF users, check out www.x-ways.net for some details, download and read a quick guide, and when you move forward with XWF, buy the book :)