There are a few behind the scenes work on creating scripts to integrate forensic applications into WinFE. This is substantial work for WinFE users as it reduces your effort to add programs during the build process. Basically, a one button approach to add a forensic application.
But, before you wait for these scripts to be written, remember that you can add many programs without a script or additional work if the program is already portable (meaning, no need to install for it to run). The best example of a full-fledged forensic suite is X-Ways Forensics. Many small forensic applications are also portable and easily copied into a WinFE build. The difference is, X-Ways Forensics is an entire forensic suite, not just one app.
Some forensic apps being worked on now to be put into WinFE may not be full forensic suites, but have a single powerful function that make it worthwhile. I won't break the news yet and will let the vendors have first crack.
On another note, last week, I helped a LE forensics detective set up a review platform with WinFE for other detectives in his department using X-Ways Investigator.
The problem:
--Detectives assigned to cases with electronic evidence, particularly illicit images evidence, wanted to do light review work for their cases.
--Reviewing any type of illicit images on a work machine only leads to that machine getting dirtied up. Also, every detective had 'their own way' of setting up their computers.
--Detectives had no forensic training.
The solution:
--WinFE and X-Ways fixed both problems.
--Department purchased two licenses of X-Ways Investigator.
--A WinFE boot CD was made with X-Ways Investigator copied onto it.
--Detectives now boot their machine to WinFE, run X-Ways Investigator, and access the forensic images from an external drive. All work is saved onto the external drive and their workstation remains clean.
--This also prevented the IT staff from the city panicking over installing 'unauthorized' software
--And of course, a copy of the X-Ways Forensics Practitioner's Guide was ordered for the detectives to use :)
[caption id="attachment_1010" align="aligncenter" width="121"] X-Ways Forensics Practitioner's Guide
Cool solution. Are the detectives accessing the evidence drive locally? Or via network?
From external drives with a copy of an image. I personally don't like those kind of cases on a network for a local PD. The feds have better systems that I've seen to store those kinds of cases on the network.
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
© 2023 Brett Shavers