Brett's Ramblings
WinFE has some street cred with the Scientific Working Group on Digital Evidence
Cool. WinFE is mentioned in a Scientific Working Group on Digital Evidence document.
About the author
Comments 2
well, not exactly IMHO - it is only mentioned as a tool for "Booting from forensic distribution media (e.g., Raptor, Windows FE) [...]". But when it comes to a recommendation, the text only mentions Windows PE in section 5 ("Boot to a UEFI compatible boot environment, which MAY include: *Windows PE *Windows To Go"). While possibly just a mistyping it gives some dubious impression.
Yes, not detailed in the doc, but between emails about WinFE when the doc was being written, it's one of the boot methods recommended. The point mainly being to give credibility to a forensic tool as valid (along with the other tools mentioned in the paper as well). I mention the paper only because I still get emails arguing WinFE not being an effective and 'accepted' method (I'm not sure why I get asked since I didn't create WinFE...).
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
© 2023 Brett Shavers