Brett's Blog

Just some ramblings.

X-Ways Forensics Online Training

I created an X-Ways Forensics online training course at http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide.  This course, X-Ways Forensics Practitioner's Guide Online I is introductory to using X-Ways Forensics, but it covers more than enough to cover most of the use of X-Ways in a case.

The XWF II course goes into great detail with more information on using XWF in different scenarios and some more highly specific functions.  Although the course is based on the book, it is not the book, nor is it the X-Ways Forensics classroom training.  It is however, the least expensive and fastest way to get up to speed on X-Ways Forensics :)

There is a 25% discount code you can use "xwf1" that is good until July 17.  Everyone that registers before July 17 receives a separate discount code of 100% for the XWF II online course that will be released as soon as this discount period ends.  Both courses are the same cost, but the discount is valid only until July 17.

If you can't attend the X-Ways AG classroom training due to cost or time, this online training fits both your pocketbook and daily schedule.

http://www.youtube.com/watch?v=EQ_wwSBD8gc

508 Hits
0 Comments

Keep up with WinFE on Twitter

Over 100 viewers of the WinFE online course in the first 24 hours.   There have been a few improvements made based on suggestions from some viewers.  All comments have been positive.   The course will remain free, take your time to watch and don't forget, build your WinFE!  (TIP:  Build the Mini-WinFE.  It is the easiest, quickest, and least operater-error prone build available).

The X-Ways course has been delayed for a day for technical problems with video hosting...but, it's coming.  There is actually several X-Ways courses being posted online, from basic to advanced.  I have found that there are several updates in XWF that have not been incorporated in the XWF manual that I am adding in the courses.   Even my XWF book is slightly outdated by all the changes and updates....but that is a good thing.

[caption id="attachment_1246" align="aligncenter" width="700"]twitter https://twitter.com/WindowsFE

Tags:
424 Hits
0 Comments

WinFE course snafu

The video provider corrected the course videos from being off-center this morning.  Thanks to  everyone letting me know about the problem.  I'm not surprised at how many viewers there are for the course as it shows how much WinFE is being used or at least how much it is known in the DF community.

Here is the Intro video, but you can watch the entire course at the course page  here: http://courses.dfironlinetraining.com/windows-forensic-environment

http://www.youtube.com/watch?v=npo-acVMU84

Tags:
418 Hits
0 Comments

Windows Forensic Environment - WinFE Online Course Now Available

Ok, it took a while to get this done, mostly because of other projects.  But it is done.  I have videos of most build methods, tips and tricks, pro's and con's, and aspects of WinFE that you may find important.  I also included every bit of downloadable swag in the course too (batch files, wallpaper, scripts, etc...).

All in all, this is probably the best source of WinFE you will find.  I encourage you to share it and use it, after all, this is a free tool.  If anyone has suggestions on making the course better, let me know and I can try to squeeze in some improvements.

[caption id="attachment_1231" align="aligncenter" width="700"]winfe http://courses.dfironlinetraining.com/windows-forensic-environment


 

On another note, I am also releasing the first of several X-Ways Forensics online courses on Monday, June 30, 2014.  

 

I'll send out a reminder on June 30 through twitter and the XWF blog.  The XWF online course is not free like the WinFE course, but it is also not expensive.  From Monday, the X-Ways course will be $195 but I will publish a discount code good for two weeks (through July 14) for 25% off.


The WinFE course was lots of work, but certainly worth the time to watch. The X-Ways course is something else entirely. The manner in which I made the X-Ways course is so that you can follow along with XWF in learning how to work a case with X-Ways Forensics.  The course describes the options and buttons in XWF, but also shows how to simply work a case.  There are literally so many features in X-Ways, that without training, you will be missing about 50% of what you should be doing.  I found that even the most current version of the X-Ways manual does not list features in XWF...lots of information to keep up with, tons of features to consider, easy to miss something that you should not miss for such a powerful forensic tool.

If you want to be notified of the coupon code, be sure to follow the X-Ways blog at http://xwaysforensics.wordpress.com/ or the twitter account at https://twitter.com/XWaysGuide.

 

Tags:
656 Hits
7 Comments

New X-Tension: Up to 30GB min speeds on SSD drives!

A new X-Tension, "C4All" is available for download (free) at http://www.x-ways.net/forensics/x-tensions/index.html.  C4All is used to categorize pictures and videos, processing skin tone and video stills.  Speeds up to 30GB min speeds on SSD drives have been observed.

free css template

If you are an X-Ways user, this is one of those cool "little" things that will make you excited.

391 Hits
0 Comments

Digital Forensics Book of the Year!

The X-Ways Forensics Practitioner's Guide won the Best Digital Forensics Book of the Year award at the DFIR Summit 2014 in Austin, Texas.  I'd like to thank everyone who voted for the XWF Guide and hope the book has helped you in your work.


  Xways-Cover




[caption id="attachment_587" align="alignleft" width="620"]award https://forensic4cast.com/forensic-4cast-awards/2014-results/
399 Hits
1 Comment

WinFE online is done, except for a few little things

As with everyone, when you think you have time and make plans, a dozen interruptions will delay even the most determined.  But, the WinFE online course is practically done except for:

1) latest build of Mini-WinFE being tested first to incorporate into the course (with UEFI support and a few other goodies)

2) reviewing the entire program (a volunteer is waiting for me to send him the link, after the Mini-WinFE testing is done..)

Not to say I got a little wild with this weekend project, but yeah, I got a little wild.  A short YouTube video intention evolved into a lot more.  In fact, every piece of downloadable WinFE related wallpaper, script, program, and links to anything I cannot personally distribute is in the program.

Until I push the button to release the course, it's vaporware, just like the write protect tool was vaporware before it was completed.  But the course sequence that is completed already is listed below.  If there is anything not listed that you have wondered about, speak up now or I will not know what may be missing.

I covered every major build method with videos (and downloadable guides when appropriate).

Introduction to the Course

WARNINGS!

I. Forensic Booting of Evidence Computers

II. Forensic Boot Operating Systems

Intro to Forensic Boot Systems

Linux Forensic Operating Systems

Windows Forensic Environment (Windows FE, WinFE)

III. WinFE Basics

Creation and development of WinFE

WinFE Write Protection Tool

Disk Management & DiskPart

WinFE and Your Forensic Software

IV. WinFE Validation

V. Building the Windows Forensic Environment

Building the Basic WinFE

Building WinFE with WinBuilder

Building WinFE Lite

Building Mini-WinFE

Building the Windows Triage Environment

Building a MultiBoot WinFE

VI. Using WinFE

Forensic Data Collection (file copying, disk imaging)

Triage and Preview

Remote Booting and Collections

Onsite Forensic Analysis

Covert Collections/Sneak and Peeks

WinFE as an Electronic Discovery Tool

WinFE and Disk Encryption

WinFE as an Educational OS

VII. Wrapping Up with WinFE

Summary

WinFE Qualification Exam

 

Tags:
453 Hits
2 Comments

Don't blame me...

[caption id="attachment_579" align="alignleft" width="700"]dontdoit "Of course you can trust PDF downloads." - UglyGorilla and KandyGoo


I have been given about a dozen or so URLs from friends with the X-Ways Practitioner's Guide as downloads.  Mostly, I am given the URLs so I can let  the publisher  know and they can take the pirated files down (good luck with that....).

If you ever considered downloading these sort of of things, just a thought, don't do it!  I'd hate for bad things to happen to your computer because of a file with my name on it that was manipulated by Unit 61398 or some other hacking organization.
381 Hits
0 Comments

WinFE Course

I'm about halfway through the WinFE online course and then I'm sending it to a reviewer.  The topics and order of the curriculum are listed below.

I've added a multitude of build methods that will be documented and demonstrated in the online class.  It'll be recorded, so not a webinar where you have to close your door and tell the boss to stay out of your office during lunch. You will be able to watch it when you can and as much as you need.

imageIf you don't see something on the list that you would like to have added, now is the time to make the suggestion before I finish and upload the course.  I'm also uploading all the swag in form of batch files, white papers, wallpapers, applications, and anything else I have on WinFE for downloading.  Basically, everything you need will be in one place.

There is a test at the end of the course and you can take it if you like or not.  That is up to you to decide.  Personally, I'd take it just to say that I took coursework in a forensic tool that included an exam to test my knowledge.  This isn't a long course, but it is 'all things WinFE' wrapped up in one training program that you can take at home or during the lunch hour, about a forensic tool that anyone, and I mean literally anyone, can build on their laptop in Starbucks.  You don't need to be a programmer or software developer.  If you are a forensic examiner, you can build and use this tool.

WinFE doesn't do everything and doesn't work for every situation.  But for when you need to use forensically sound bootable environment, WinFE is pretty cool.

Curriculum

 

Introduction to the Course
Why take this course?
WARNINGS!

 

 

...
Tags:
Continue reading
542 Hits
4 Comments

Vote for the best book right away!

The deadline for the Forensic 4:cast Digital Forensics Book of the Year has been changed.

https://forensic4cast.com/forensic-4cast-awards/

 

[caption id="attachment_1218" align="aligncenter" width="708"] My personal favorite....Placing the Suspect Behind the Keyboard...it's the first and only writing on the subject manner incorporating investigative methods in and out of the (computer) box.


 
 

Xways-Cover http://amzn.to/1g5sfSX

 

]Placing the Suspect Behind the Keyboard http://amzn.to/1owuRmr


 

349 Hits
0 Comments