Think You Don’t Need WinFE? Wait Until You Do.
In 2008, Troy Larson gave me the build instructions for WinFE (Windows Forensic Environment). Troy figured out how to make a Windows winpe boot in a forensically sound manner with registry changes. At the time, the concept of a Windows-based forensic boot environment was groundbreaking—an alternative to Linux-based forensic boot disks that had dominated for years.
I used WinFE for two years and by 2010, I had started writing about WinFE. From then on, I haven’t stopped bugging Troy about WinFE, writing about it, teaching it, and advocating for such a useful DFIR tool.
I beat up WinFE as much as possible, testing different build methods and software that could run in it without becoming a full-fledged Windows OS (Windows To Go is that which WinFE is not).
Now, 17 years later, with technological advancements, secure boot limitations, and the rise of cloud-based forensic workflows, many might assume that WinFE has lost its relevance. But here’s the thing—it’s still a critical tool in certain investigative situations where nothing else works.
The Evolution (and Limitations) of Forensic Booting
When I first got into forensic booting, we used floppy disks (yes, floppy disks!) before moving to CD/DVDs and eventually USB-based forensic environments. WinFE gave us an incredible advantage—it was a Windows-based forensic boot disk, meaning investigators could work with the same OS environment they were analyzing without modifying the evidence drive.
However, as hardware security evolved, booting into any forensic OS (Windows or Linux) became increasingly difficult. Secure Boot, BitLocker, T2 and M-series chips, and other system-level protections have all made forensic booting more restrictive. Even Windows To Go is limited.
Yet, in some situations, WinFE is still the only way to access a system forensically. A big plus of WinFE is that you can boot ARM devices with WinFE ?.
The Future
A new WinFE is being improved by Colin Ramsden, which is my preferred and recommended build method. Colin has spent more time on improving WinFE than I can imagine. Then again, I totally can. I’ll get into Colin’s new build later this year after it is released.
Until then: Enter Arsenal Recon
Mark Spencer and his team at Arsenal Recon developed a useful tool, Arsenal Image Mounter (AIM). AIM allows you to launch virtual machines from disk images, which has some cool features you can check out on the AIM page. Some days, like right now, I feel old….I remember booting images the hard way….and by “hard,” I mean that it didn’t always work, always had some issues, and was a pain to do. Now it is “virtually” push button easy.
Here is what Mark and his team came up with:
- Boot the evidence computer to WinFE.
- Remotely connect to that WinFE-booted computer from your forensic workstation.
- From your workstation, boot the WinFE-booted computer to a virtual machine.
- Now you can not only access the WinFE-booted machine data, but can see the virtually booted OS on your workstation.
Now, you might not see this as that exciting, so I’ll give you a few minutes…
Arsenal Image Mounter (AIM) now allows investigators to boot a forensically sound machine into a virtualized OS remotely—essentially turning a deadbox into a virtual live system. This is super cool because it combines the strengths of WinFE with remote access flexibility like F-Response. In my opinion, your toolbox is more capable by having both F-Response and WinFE+AIM. You can access both live machines and deadboxes remotely.
Final Thoughts
Seventeen years ago, I didn’t expect to be still talking about WinFE today—but here we are. While its use cases have changed, it still fills an essential gap in forensic investigations. As technology continues to evolve, I suspect we haven’t seen the latest of WinFE’s contributions to forensic workflows. I know this for sure…since the version is coming soon…
After Colin’s next build is tested (I plan on beating it like a drum to help ensure it is solid), I’ll have an updated WinFE training course. Bonus: If you have ever taken a WinFE class from me, email me the cert, and I will waive you into the new class (wait until I get the class posted tho!).
What’s your experience with WinFE? Have you run into situations where it was the only tool that worked? Let’s talk.
Discover more from Brett's Ramblings
Subscribe to get the latest posts sent to your email.
Comments are closed.
Yes, please keep pushing WinFE, especially to law enforcement. It will allow more inadmissible evidence to be declared. You may talk about the benefits of WinFE in DFIR, but when law enforcement use it to claim USB booting to a read only environment, they neglect to outline that WinFE is a self build process, that can be customized to allow for the injection of artifacts prior to the read-only registry hack that WinFE eventually applies. I’ve assisted many matters where it was evident that law enforcement custom built WinFE to ‘plant’ evidence on a suspect, through pre-run scripts and date manipulation. And they all thought they were so clever, until we asked them to produce the WinFE USB key they created, many of which had been conveniently overwritten by the time they got to court. Anyone who had prior experience with WinPE and UBCD (ultimate boot CD) knows how to create fiendish background scripts. WinFE is a joke and should be challenged in all court matters. We are now assisting attorneys review cases where innocent people were convicted as a result of WinFE based triage and imaging.
WinFE, like any forensic tool, needs to be properly tested, validated, and documented. And all evidence, not just digital evidence, is open to challenge in legal cases. No disagreement there.
But there’s a substantial difference between a tool being capable of manipulating evidence and claiming that law enforcement deliberately used it to plant evidence. Those are serious allegations that require supporting evidence.
Can you point me to the cases where innocent people were convicted as a result of WinFE based triage and imaging? I’d be interested in reviewing them.
You may be aware that I personally can’t release court evidence and findings. They must be requested through the court process, and even then they are subject to privacy laws. As I was there and was the investigator for the defence, I know how many times these things have occurred. As my duty is to the court, and not to any individual, I provide in depth analysis of these matters with my expertise in many fields.
You make two (2) separate points in your reply, “But there’s a substantial difference between a tool being capable of manipulating evidence and claiming that law enforcement deliberately used it to plant evidence. Those are serious allegations that require supporting evidence.”
Firstly, is the tool, WinFE in this instance, capable of manipulating evidence? Absolutely, and to ignore this fact is simply irresponsible. WinFE, like WinPE and UBCD back in the day, can do anything you want it to, and the fact that WinFE doesn’t inject the read-only registry key into the system until very late in the execution, allows for very simple manipulation of artefacts on connected drives. The fact you often have to load third party drivers to even see some drives, confirms that point. So put simply, WinFE can be customised for bad intentions, and in the case of law enforcement documenting their build process, testing and validation processes – yeah – what land of the fairies are you living in? Look at Cellebrite acquisitions of mobile devices by law enforcement. All of a sudden local beat cops can pull out a common laptop and perform a forensic acquisition with a simple statement of “I passed the internally run Cellebrite basics course”. As in many cases I have been involved with, the acquisition of a mobile device is of course completed after they have manually searched and manipulated artefacts on the device. But again, we are meant to accept that law enforcement wouldn’t do such a thing.
To that point, you state, “Misconduct involving digital evidence should be exposed”. Yes it should. Acknowledging that it can be done with Forensics Tools like WinFE is the first step. Yet if we tell the public how to use forensics tools in such a way, we open the door to potential misuse by people outside the DFIR community, hence, we are told to hush and bloggers who want to promote the tool don’t disclose the potential misuse of the tool.
So your interest to review the matters that I have assisted in, and will continue to assist with, to bring this type of corruption to the forefront is disingenuous, because your own blogs and teachings don’t highlight how the tool can be misused. In turn, there is no training for people on what to look for and what to ask in court, therefore we just assume law enforcement wouldn’t do such a thing, so why look for it. Good DFIR professionals, who have experience beyond the generic training, know how to dig, and they often have such an incredible thirst for analytics, they find these anomalies and at least highlight them as potential concerns.
But let’s be realistic, the ownness is on the accused to prove that the evidence, and process of collecting that evidence, is in question. The accused/ defence team has to engage a DFIR expert to investigate such claims, which on top of the costs of the legal team, is often out of reach. That’s the fact here – cost to defend yourself. Law enforcement know that the cost of a DFIR expert is beyond the reach of the common person, and they further know that most DFIR experts only examine the evidence/ artefacts in question, not the process. As I previously noted, ask law enforcement to produce the WINFE device that they created and the documented process, and in every case, they note that the device has now been erased and reused for other matters. How convenient. It then sits with the judge to determine if the evidence is admissible. Our company offers its services pro bono in many matter, and then take the stand and demonstrate the potential for the manipulation of evidence using WinFE or other such tools. Judges take great interest in our presentation and when prosecutions are asked to respond, they attempt to attack our ability, instead of challenging our findings. That says it all.
So ultimately, I didn’t ask for your support in bringing attention to the matters where innocent people lives have been deeply affected by law enforcement using Forensics Tools to manipulate evidence. I don’t need a blogger to stand with me in supporting justice. I stand in court as an expert, with real victims, and show corruption at the cold face. I leave it to the judges to determine the outcome, but I remain there for the innocent people who have lost everything after they get the justice that was not afforded to them in the first place.
The technical distinction remains: WinFE’s core registry-based write protections can be configured offline during the build, rather than being applied late in execution. Like any customizable boot environment or forensic tool, WinFE can potentially be misused.
However, the claims of repeated, deliberate evidence planting by law enforcement using WinFE, resulting in wrongful convictions, have not been supported by identifiable cases or independently verifiable findings. Without that evidence, these are only allegations, not established facts.
The personal attacks do nothing to advance a technical or evidentiary discussion. With that, I don’t see a productive path forward in continuing this exchange, so I’ll leave it there.