WinFE Script Updated
Colin’s Write Protect Script (wp.script) is available, but still considered Beta (and as with any forensic utility, test – test – test). You can download today’s version here. wp.script. To make sure you get the most recent…
Read MoreColin’s Write Protect Application
Here it is, Colin Ramsden’s WinFE write protect application! Although long in waiting, it is finally here. Colin worked diligently on making this work without making Microsoft unhappy. Documentation is forthcoming on the use of his application,…
Read MoreBuilding your WinFE Update
For those that have been using WinFE and wanting to know about recent updates, I have only a little news to mention. WinFE is still just as good today as when Troy Larson first created it, so not much in the update area there. WinFE still boots the…
Read MoreAn update to a long awaited project
It’s been awhile, a long while, since there has been anything added to the WinFE project, and the bad news is that nothing is new other than Microsoft not quite accepting of Colin Ramsden’s write protect tool. As that is not good news, both…
Read MoreSharing the love with WinFE
There have been numerous presentations showing how to build and use a WinFE boot disc around the world. Most recently I see that IACIS has given a demo this year along with several HTCIA Chapters and a DOD conference as well. A write up of Imaging a…
Read MoreFriendly reminders are always nice
Always test your tools (this includes WinFE). Considering that NIST recently discovered that some Ubuntu based forensic boot discs could make modifications to a booted suspect drive (modifies the $logfile upon booting….), these sort of news…
Read MoreHow easy (or difficult) is it to build a WinFE with WinBuilder?
An easy quickstart guide to build your WinFE ISO… 1) Extract WinBuilder to the root of your C:/ drive 2) Run WinBuilder 3) Click 3 buttons and you are done. If you want more features, such as additional programs, network support, audio, more…
Read MoreTriage Notes and WinFE
One of the biggest benefits (besides imaging storage media) of WinFE is the ability to create a customized triage system at virtually no cost. Purchasing a pre-made system may not be an issue when only one or a few systems are needed, but when…
Read MoreOSForensics
Giving more usability to WinFE, OSForensics has several features that I can see being beneficial in triage of a system with OSForensics. OSForensics can be run on a live system (not the optimal decision in most cases), a mounted image, or in a…
Read MoreWinFE Demo Online
I’ll be giving a demo of WinFE to www.ctin.org on March 10 (online). I’ll be showing some neat developments in the work as well as discuss solving build problems. There are a few spots left and you have to be a CTIN member to view the…
Read More