Brett's Ramblings
5 Cool Things You Can Do with the Windows Forensic Environment (WinFE)
I’m a fan of WinFE. I’ve used it, written about it, helped develop it, taught it, and assisted others to teach it. The way that I talk about it, you’d think that WinFE is the best thing that ever came along, does everything you need in forensics, and nothing can out do what it does. Actually, WinFE doesn’t do much at all. But that for what it does, it does ingeniously. 
The top 5 cool things
#5 Forensically boot a Windows, Mac, Linux machine to a Windows Forensic Environment
#4 Forensically Boot a Surface Pro to a Windows Forensic Environment
#3 Image storage drives (full, sparse, or targeted) with Windows tools
#2 Perform a triage or preview with Windows tools
#1 Do a complete exam with Windows tools on the evidence machine
There are even more things you can do as well that makes WinFE cool, but this is a good start. Being a free tool makes it cool too.
What’s the big deal?
WinFE forensically boots to Windows. That means you can use Windows-based forensic tools!
The numbers
3,447 * Years ago, I threw together a quick WinFE online class for free. Over 3,000 took the course before I eventually took it offline since WinFE has had several updates since the course was developed.
5,592 * I recently put on a longer Forensic Operating System course (that focused on WinFE more than other live CDs) and as of today, more than 5,500 have taken that course.
15,000 * That’s the number where I stopped counting the downloads of the WinFE script and various WinFE builders from over the years. That doesn’t mean 15,000 WinFE users, just that it is a lot of downloads of past and current WinFE build projects. That also does not include WinFE basic builds where Microsoft downloads are required (and not a WinFE project).
The point is that WinFE is a valid tool used by many, and since there is no marketing department for it, I'm marketing it because I use it and prefer that it remain relevant in the community...so I can keep using it :)
The latest WinFE course
I had been asked for a new course just on WinFE and not any of the other live CDs, so here it is. I included the multiple types of WinFE builds including Windows To Go in order to cover everything about a Windows-based, forensically sound, bootable operating system. This course is only for those who did not take the Forensic Operating System course, since the WinFE information is the same in both courses.
Of course there is a promotion 😊
For any course I publish, you probably noticed that for a few days, I have a promotional discount. This course is no different. I ask that you share the promotion because invariably I get emails asking to extend the promotion (no extensions….sorry).
The new Windows Forensic Environment online course is open! Use promo code "miniwinfe" for 50% off through April 10 for the first 100 registrations.https://t.co/urGlmsKHLH #dfir #infosec pic.twitter.com/duU3fEYnHU
The Windows Forensic Environment social group
Since WinFE isn’t a commercial tool, with no developers or support staff, it has been pretty much living on its own, being pushed about by its community of users. Searching for WinFE gets you about a dozen websites, most of which is outdated information, without any sole collection point. Therefore, there is now a group for it.
I will be putting everything in the social group as it comes up in terms of updates to WinFE building, usage, powerpoints for training, and curriculum if you want to have a turn-key model to add it in a forensic course that you teach. Only those who have registered for either this new WinFE or Forensic Operating System course are invited. The social group is a repository for community support, related downloads, and updates to the WinFE projects; it is not a beginner’s class in what WinFE is.
The time to self-learn WinFE can take days. There is no help desk, tech support, help line, or single point of reference information for WinFE. If you don’t have patience to self-learn how to build it, you will give up. Even tho the Internet is full of instructional guidelines, the good is intermingled with the outdated. This course is the most current and up-to-date WinFE building and the WinFE social group will have all future updates for you to get it right the first time.
ps: Pass the quiz at the end of the course and receive a certificate of course completion (3 hours) in the instruction of building and using WinFE.
)
About the author
Comments
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
Posts List
Tag Cloud
Search Blog
Most popular posts
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
More posts
-
COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.
The meat and potatoesA bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical…
Saturday April 25
14489 hits / 0 comments
-
Mini-WinFE 10 and WinFE 10 Updated
The short story on the newest Mini-WinFE 10 (aka, the download link):Mini-WinFE has been updated and upgraded. I update WinFE developments (including the downloads for…
Sunday April 05
8971 hits / 2 comments
-
Eat your broccoli first
Something good and something not-so-good on learning DFIRThe good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and…
Saturday January 18
30154 hits / 0 comments
-
The Second Decade of the 2000s is almost over!
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…
Thursday December 26
9816 hits / 0 comments
-
Public Records
I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I…
Thursday December 12
4689 hits / 0 comments
-
The Five Stages of the DFIR Career Grief Cycle
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…
Tuesday September 10
34886 hits / 0 comments
-
Our World is Going to Turn Upside Down with DeepFakes
The short storyAny person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any…
Sunday September 01
3037 hits / 0 comments
-
If you are comfortable in DFIR, you might be doing it wrong
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…
Thursday August 29
3991 hits / 0 comments
-
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits. In fact, you can probably enjoy the…
Saturday August 17
4932 hits / 0 comments
-
Personality of a computer
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…
Wednesday July 31
3936 hits / 0 comments
-
Add a Dab of Balance in your DFIR World
Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her…
Monday June 24
14605 hits / 0 comments
-
The Easy Way to Learn DFIR
SummaryThere is no easy way to learn DFIR. You can stop reading from here if you want.Longer versionOk. Since you are still reading, you probably…
Saturday June 08
13904 hits / 0 comments
-
Game of Thrones, DFIR Style
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little…
Thursday April 25
31807 hits / 0 comments
-
Puking in DFIR
Admittedly, the title of this post is intentionally gross, because I am going to heave a few things at you, mainly about puking. As in,…
Wednesday April 17
5765 hits / 0 comments
-
The #1 Reason that DFIR practitioners don’t post opinions
Lesley Carhart tweeted today that a journalist used one of her tweets in an article that would have been rephrased in a less playful manner…
Tuesday April 09
5858 hits / 0 comments
-
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was…
Monday April 08
2305 hits / 0 comments
-
Working in DFIR is glamorous, but mostly only to those not working in DFIR...
Here is something about the DFIR career field: it is one of the most exciting, eventful, and jam-packed jobs that anyone can have. Running and…
Friday April 05
3844 hits / 0 comments
-
Overcommitted in DFIR
I have seen people be overcommitted, realize that they are overcommitted, yet continue forward in the most serious of situations. By overcommitted, I do not…
Friday March 22
19018 hits / 0 comments
-
'You're guilty unless you can prove it'
Swift on Security tweeted a great article. The article is not great as a well-written piece or containing earth shattering news piece, but more that…
Saturday March 09
21289 hits / 0 comments
-
“I've answered questions, responded to emails, and been on phone calls...when asked.” – Harlan Carvey
I feel obligated to respond to one of Harlan Carvey’s points in his recent blog post, Book Writing Misconceptions (https://windowsir.blogspot.com/2019/03/book-writing-misconceptions.html). I agree with everything he…
Tuesday March 05
3456 hits / 0 comments
© 2020 Brett Shavers