WinFE as a Student Training Aid
And yet another use for WinFE. This year, at the University of Washington’s Digital Forensics Certificate Program, I am having each student create their own Windows Forensic Environment with as many forensic applications as we can fit on a USB…
Read MoreWinBuilder-What a neat way to make a WinFE CD
I came across WinBuilder today (http://www.boot-land.net/), which provides downloads to a GUI based, Windows Live CD builder. I’m willing to try anything, so I gave it a whirl and was happy I did. With WinBuilder, many of the functions of…
Read MoreFollow up: Windows FE and Live Forensic Triage
For anyone that missed this WinFE webinar-“https://www2.gotomeeting.com/register/892321554“…I did view it today. The WinFE discussion started about 30 minutes into the webinar, and only lasted for about 10 minutes. …
Read MoreWinFE Wish List
Troy Larson and Colin Ramsden are working on making some changes and adding features of interest to Windows FE. If you have any ideas as to what you’d like to see, please post them in the forum. Some of the features of interest are Bitlocker…
Read MoreCreate your own WinFE ISO, for free, in just a few minutes
The below video shows how simply and quickly you can create a WinFE ISO. As you’ll see in the video, all you need to do is… 1) Install Windows AIK 2) Download the WinFE batch files 3) Run “createfolders.bat” 4) Copy your forensic…
Read MoreGargoyle and Windows Forensic Environment
It is great to see that the Windows Forensic Environment is being used as an accepted forensic platform by software manufactures, such as F-Response (blogged about running F-Response on WinFE) and WetStone. WetStone has a version of their…
Read MoreWinFE Teaser Screenshots
Colin Ramsden has been working feverishly on some modifications to WinFE that will appeal to everyone. For some teaser screenshots, take a look here. Bitlocker support, installing drivers while already booted to WinFE, clean…
Read MoreNew Site and Updates
As you can see, the WinFE site has been migrated to WordPress. This format allows me a little more freedom than Blogger as well as less time maintaining a website. This site and work is free…be patient ;) You can now find the batch…
Read MoreMore Windows FE and triage notes (WindowsRipper?)
Matt Churchhill (http://mattchurchill.net/2010/06/windowsripper/) has been doing some work to supercharge RegRipper. Take a look at his video and while watching, consider how this can affect your method to triage a computer when booted to…
Read MoreWindows FE and Triage webinar
This should be a neat webinar on Windows FE and Triage. https://www2.gotomeeting.com/register/892321554 Check the “Using WinFE” page for tips on using WinFE for not only triage/preview, but other ways to use the tool. Until I hear…
Read More