WinFE Taught in Australia

Neat to see WinFE being taught everywhere, as in, everywhere by many.  Wish I could have been there for this presentation (mostly because I'd have to be in Australia to see it...).winfe

[slideshare id=37866964&doc=winfe-thealmostperfecttriagetool-140811062324-phpapp01]

 

Tags:
775 Hits

BlockHasher for XWF

Yet another cool XWF utility!

 

BlockHasher

 

 

http://d-forensik.de/download/

[caption id="attachment_630" align="aligncenter" width="700" class=" "]blockhash

 

 

BlockHasher helps you creating Block-HashSets for X-Ways Forensics

- Select Directory, directory-mode is atomatically activated
- Click 'with sub-folders' if you need recursive hashing
- Alternatively select some files, file-mode is atomatically activated
- you can switch everytime between both modes
- Choose your Entropy
- If you need to find a part of a single file use 'one input - one output' mode
- If you need to find a part of a bulk of files use 'all in one' mode
- Add 'MD5'-Header is necessary for X-Ways Forensics

Start hashing now. A Logfile ist automatically generated.

BlockHasher is Freeware.
If you need source send mail to This email address is being protected from spambots. You need JavaScript enabled to view it.

 

563 Hits

X-Ways MD5 Hash Manipulator

Another cool utility for X-Ways!

 

X-Ways MD5 Hash Manipulator

 

 

hash

 

 

 

 

 

A program to manipulate your Hash sets from X-Ways.
It will allow you to Add hashes, Remove hashes, Compare hashes and remove the duplicates, create hash set of excluded files, and be in the proper format to quickly import to X-Ways.

 

 

This will allow users to maintain their hash sets and create small diff files if needed to distribute when hashes are added/removed from database.
It works on the basis of add or removing records, indicating duplicates and also the '-' prefix implemented in X-ways. files with '-' prefix can be anywhere in set, not at the beginning.

 

 

 

 

 

Thanks to X-Tension author Steve Frawley (who is also the author of the C4All X-Tension) and thanks to beta tester Derek Frawley.

 

 

 

 

 

instructions

 

 

file

 

936 Hits

SEARCH High-Tech Crime Trainers to Debut WinFE as a new topic

Super cool.  From SEARCH.


"The team will debut a new course topic in Dallas: Introduction to Windows Forensic Environment (WinFE). In this lab and lecture, investigators will learn how to create a bootable forensic environment on a thumb drive. Using this thumb drive, investigators can then conduct previews of suspect computers in the field, looking for information that indicates whether the computer contains potential evidence in a case. The ability to conduct on-scene triage such as this is very important to investigators, as it gives immediate information about suspects and their devices."

 

Tags:
1623 Hits

Free WinFE course

WinFE course to be updatedwinfe


The WinFE online course will be updated sooner with a few neat things that are coming up with WinFE.  Until then, there have been over 2,000 registrations for the course and more every day.

I'm impressed that there are so many users interested in using WinFE, but then again, not really.   It's still a really neat tool to have in your toolbox alongside the Linux forensics boot OSs. If you haven't taken a look at WinFE, give it a try.  This course will remain online, free, and updated when there are updates to make.

I am checking out WTE and so far, WTE represents a great enhancement on making WinFE more user friendly in appearance and use.  I'll post my thoughts on WTE sometime in the future after I really take a look at WTE in more detail.

 

Advanced Internet Investigations Course with Google Hacks!


Speaking of online courses, if you regularly "google" people for investigations, backgrounds, pre-employment checks, internal investigations, or need to find someone as a witness (or suspect, or victim), take a look at my Advanced  Internet Investigations Course with Google Hacks.  If you register with this link (or this code: winfe50), you get 50% tuition.  The half off discount is for the first 50 people, then regular price of $195.  The course is a tad over 4.5 hours and covers enough information where you can practically find anyone online, and in the physical world.  Google operators, syntax, and hacks are covered including automated searching utilities (free software!).

[caption id="attachment_1262" align="alignleft" width="700"]AII Half price for the first 50 WinFE blog readers.

 

Tags:
684 Hits

Cool work at the Windows Triage Environment

Oh my.   This is very pretty and impressive.  Take a look at the Windows Triage Environment if you haven't done so yet.  It is nice to see work continually being done to improve upon WinFE.

WTE

 

 

WTE

Tags:
679 Hits

Thanks to Ken Pryor for his kind review of the WinFE online course

Ken Pryor wrote a kind review of the WinFE online course.  Take a look at his blog for details..  http://digiforensics.blogspot.com/2014/07/windows-forensic-environment-training.html

Don't forget, the WinFE online course is just like WinFE...it's FREE!

review

Tags:
1397 Hits

Mini-WinFE has been updated

Misty has updated Mini-WinFE.  There are a few very neat updates, like UEFI support!  Don't forget to sign up for free WinFE online training: http://courses.dfironlinetraining.com/windows-forensic-environment

Thanks to Misty!

 

miniwinfe

 

2014.07.03

==========



* SysWOW64 support added when building from Windows 7/7(SP1)/8/8.1/8.1 

  Update 1 sources (should also work with some Windows Server 2008/2012 

  sources). The 5-Wow64 script was used as a base to identify file and 

  registry dependencies. Credit therefore goes to everyone involved in 

  the 5-Wow64.script (including JFX, Lancelot, 2aCD, ChrisR and "...to 

  everybody on the BootLand forums for helping on the debuggind and 

  improvement of this script."). Select 4] SysWOW64 in the main project 

  script options to add SysWOW64. 



* UEFI support has been added.



* CloneDisk script added



* Virtual Keyboard (FreeVK) script added.



* A number of changes have been made to the core script - wimlib-imagex now 

  uses file lists when extracting dependencies from install.wim/boot.wim. 

  This significantly improves build time, but has meant that any program 

  scripts containing paths for file dependencies has required editing 

  due to wimlib preserving directory structure (when extracting from file 

  lists).   



* Fixed a bug when x64 local sources are used (in Create a cache from WinRE 

  and the ADK scripts). Due to the way in which SysWOW64 redirects to the 

  \Windows\SysWOW64 directory when running WinBuilder on a 64-bit system the 

  file dependencies were being cached from \Windows\SysWOW64 instead of 

  \Windows\System32



* Wimlib updated to 1.7.0. The amended update add command 

  significantly reduces build time when the INJECT method is used.



* Create ISO script updated. It now contains several options 

  including Flat Boot and RAM Boot or multiboot RAM and Flat boot. 

  It's also possible to create a BIOS or UEFI bootable ISO - or

  BIOS and UEFI bootable.



* Create USB updated to include the option to RAM Boot or Flat Boot

  or multiboot RAM and Flat boot. UEFI support is also included. This 

  script will not work if running WinBuilder on a Windows 2000/XP/2003

  system. 



* Create USB (GPT UEFI) script added. This script will not work if

  running WinBuilder on a Windows 2000/XP/2003 system. Only fixed type 

  disks are supported. 



* Added error check to the ADK For Win 8 (and 8.1) scripts - these 

  cannot be executed if running WinBuilder on a Windows 2000/XP/2003

  system. 



* Project.Settings.ini is added to the build listing all programs

  and project settings used in the current build. 



* Project documentation updated - minor updates throughout and two

  new sections added (MultiBoot WinPE and UEFI, BIOS, GPT and MBR)



A special thanks to alacran for requesting UEFI and SysWOW64 support 

in MistyPE and for beta testing and feedback to actually get them

working. 



Due to the number of changes made in this build it is entirely possible 

that errors may have unintentionally crept in. Please report any issues 

(or positive feedback) on the support topic at reboot.pro - 



	http://reboot.pro/topic/19036-mini-winfe/







2014.04.26

==========



* Added a number of additional options in the core script - 

  these are all enabled by default. The new options will 

  remove a number of unsupported options from the right-click 

  context menu. Thanks to reboot.pro forum member farda for

  these suggestions.



* Added "Open with" workaround for WinPE 4.0/5.0. See -

  http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/



* WinFE settings are now seperate to the Shell script - but are 

  still mandatory. They have been moved to a new script 

  \Programs.winfe.script



* Option to use either SANPolicy 3 or 4 (in new WinFE script) -

  SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as

  SANPolicy 4 is only supported in WinPE 4.0/5.0.



* File dependencies (to be extracted from install.wim or

  copied from the host Operating System) are handled in one

  (hidden) script -  Core\required.files.script. This will 

  make it simpler to implement any future file dependencies. 



* Added a script to copy files and folders from a local 

  directory - allowing the easy addition of third party files. 

  A menu entry will open the directory these files were copied 

  to. 



* Added Tools\Create USB script - it's now possible to 

  create a MistyPE bootable UFD during the build process.

  Use with caution - see documentation for more details. 

  Tested with Windows 7 (SP1) and Windows 8.1.



* Added ADK For Win 8 (and 8.1) scripts. Refer to documents.

  NOTE - this has only been tested using Windows 7 (SP1) 

  and Windows 8.1.



* Wallpaper support (.jpg) added for all builds - this 

  feature was not previously working with WinPE 4/5. See

  Programs\Wallpaper script.



* Wimlib-ImageX updated to version 1.6.2



* Added build 6.3.9600 (Windows 8.1 - Final) to the list  

  of tested/working sources.



* Added the following scripts -

	- WinHex

	- DMDE

	- Opera - 64-bit support added.

	- Keyboardlayouts



* Included FAU in the download. This is redistributed

  with the permission of the author (GMG Systems Inc) -

  refer to the project documentation.



* Program scripts now contain menu entries - this should

  make it easier to add new program scripts. Previously 

  all menu entries were contained in the shell script - 

  resulting in multiple script edits for any new programs 

  added.



* Various tweaks in core script 

	- "FileDelete,"%Cache%\temp\*.*" has been added to

	  to ensure that cached batch files and .ini files 

	  are deleted earlier in the build process. Without  

	  this fix there are errors in some very limited 

	  curcumstances.

	- Added verification check from registry files  

	  extracted from boot.wim - only used if the 

	  wimlib-imagex checks fail.



* Script structure has been changed for all Program scripts. 

  Hopefully results in better error checking for any missing 

  files.



* Browse for folder support is added by individual program 

  scripts even if this option is not selected in the Core 

  script. Resulting in a more modular approach (see 

  "http://reboot.pro/topic/19042-modular-apps-philosophy-for-winpe/"

  for the philosophy behind this approach).



* Documentation updated - added section on using the ADK 

  For Win 8.1. 



Tags:
1244 Hits

X-Ways Forensics Online Training

I created an X-Ways Forensics online training course at http://courses.dfironlinetraining.com/x-ways-forensics-practitioners-guide.  This course, X-Ways Forensics Practitioner's Guide Online I is introductory to using X-Ways Forensics, but it covers more than enough to cover most of the use of X-Ways in a case.

The XWF II course goes into great detail with more information on using XWF in different scenarios and some more highly specific functions.  Although the course is based on the book, it is not the book, nor is it the X-Ways Forensics classroom training.  It is however, the least expensive and fastest way to get up to speed on X-Ways Forensics :)

There is a 25% discount code you can use "xwf1" that is good until July 17.  Everyone that registers before July 17 receives a separate discount code of 100% for the XWF II online course that will be released as soon as this discount period ends.  Both courses are the same cost, but the discount is valid only until July 17.

If you can't attend the X-Ways AG classroom training due to cost or time, this online training fits both your pocketbook and daily schedule.

http://www.youtube.com/watch?v=EQ_wwSBD8gc

630 Hits

Keep up with WinFE on Twitter

Over 100 viewers of the WinFE online course in the first 24 hours.   There have been a few improvements made based on suggestions from some viewers.  All comments have been positive.   The course will remain free, take your time to watch and don't forget, build your WinFE!  (TIP:  Build the Mini-WinFE.  It is the easiest, quickest, and least operater-error prone build available).

The X-Ways course has been delayed for a day for technical problems with video hosting...but, it's coming.  There is actually several X-Ways courses being posted online, from basic to advanced.  I have found that there are several updates in XWF that have not been incorporated in the XWF manual that I am adding in the courses.   Even my XWF book is slightly outdated by all the changes and updates....but that is a good thing.

[caption id="attachment_1246" align="aligncenter" width="700"]twitter https://twitter.com/WindowsFE

Tags:
545 Hits