Brett's Blog

Just some ramblings.

WinFE online is done, except for a few little things

As with everyone, when you think you have time and make plans, a dozen interruptions will delay even the most determined.  But, the WinFE online course is practically done except for:

1) latest build of Mini-WinFE being tested first to incorporate into the course (with UEFI support and a few other goodies)

2) reviewing the entire program (a volunteer is waiting for me to send him the link, after the Mini-WinFE testing is done..)

Not to say I got a little wild with this weekend project, but yeah, I got a little wild.  A short YouTube video intention evolved into a lot more.  In fact, every piece of downloadable WinFE related wallpaper, script, program, and links to anything I cannot personally distribute is in the program.

Until I push the button to release the course, it's vaporware, just like the write protect tool was vaporware before it was completed.  But the course sequence that is completed already is listed below.  If there is anything not listed that you have wondered about, speak up now or I will not know what may be missing.

I covered every major build method with videos (and downloadable guides when appropriate).

Introduction to the Course


I. Forensic Booting of Evidence Computers

II. Forensic Boot Operating Systems

Intro to Forensic Boot Systems

Linux Forensic Operating Systems

Windows Forensic Environment (Windows FE, WinFE)

III. WinFE Basics

Creation and development of WinFE

WinFE Write Protection Tool

Disk Management & DiskPart

WinFE and Your Forensic Software

IV. WinFE Validation

V. Building the Windows Forensic Environment

Building the Basic WinFE

Building WinFE with WinBuilder

Building WinFE Lite

Building Mini-WinFE

Building the Windows Triage Environment

Building a MultiBoot WinFE

VI. Using WinFE

Forensic Data Collection (file copying, disk imaging)

Triage and Preview

Remote Booting and Collections

Onsite Forensic Analysis

Covert Collections/Sneak and Peeks

WinFE as an Electronic Discovery Tool

WinFE and Disk Encryption

WinFE as an Educational OS

VII. Wrapping Up with WinFE


WinFE Qualification Exam


424 Hits

WinFE Course

I'm about halfway through the WinFE online course and then I'm sending it to a reviewer.  The topics and order of the curriculum are listed below.

I've added a multitude of build methods that will be documented and demonstrated in the online class.  It'll be recorded, so not a webinar where you have to close your door and tell the boss to stay out of your office during lunch. You will be able to watch it when you can and as much as you need.

imageIf you don't see something on the list that you would like to have added, now is the time to make the suggestion before I finish and upload the course.  I'm also uploading all the swag in form of batch files, white papers, wallpapers, applications, and anything else I have on WinFE for downloading.  Basically, everything you need will be in one place.

There is a test at the end of the course and you can take it if you like or not.  That is up to you to decide.  Personally, I'd take it just to say that I took coursework in a forensic tool that included an exam to test my knowledge.  This isn't a long course, but it is 'all things WinFE' wrapped up in one training program that you can take at home or during the lunch hour, about a forensic tool that anyone, and I mean literally anyone, can build on their laptop in Starbucks.  You don't need to be a programmer or software developer.  If you are a forensic examiner, you can build and use this tool.

WinFE doesn't do everything and doesn't work for every situation.  But for when you need to use forensically sound bootable environment, WinFE is pretty cool.



Introduction to the Course
Why take this course?



Continue reading
499 Hits

Some Interesting WinFE Related Stuff I Found Online

[caption id="attachment_1206" align="alignright" width="300"]

One of the interesting things I have found online related to WinFE as I create a lesson plan for WinFE is  "WTE" or "Windows Triage Environment".  Before you get excited about this project, apparently, unless  you work in government, you can't have it.  Per the website,  "WTE is released as freeware only for Law Enforcement or Government Agencies uses."  Well darn it.  From what I can tell, it is WinFE with some software, including Colin Ramsden's write protection application,but no super-secret-LE-only programs.

The good news is that in the upcoming tutorial on All Things WinFE, you will be able to make your own WinFE or whatever you want to call it, for free, whether you are a government employee or not.

Another interesting thing I found was that the commercial version of WinFE from is no longer available.  From the website, " Due to recent licensing changes by Microsoft, SAFE is no longer commercially available" and  "No longer commercially available, SAFE (System Acquisition Forensic Environment) was the first and only forensically sound Windows boot disk."
I don't know when ForensicSoft stopped selling their WinFE (or "SAFE"), but  it is no longer. However, I respectfully disagree on SAFE being the first and only forensically sound Windows boot disk....

Stand-by for the WinFE  class.  It's getting close to being done  I do have a trusty tech-editor to review it prior to release :)


514 Hits

A Quicker Way to the Shadow Volumes and Dealing with Win 8 VHDXs

Arsenal Image Mounter (AIM) is a new image-mounting tool from Arsenal Recon.  Not only is it free, but the folks at Arsenal have been gracious in lending support.  AIM employs a special SCSI driver that lets us mount image files of various types so that Windows Disk Manager can see our mounted image (a pseudo disk, as I like to call it) as an actual disk. This innovation allows us to access shadow volumes in a completely new way and avoid converting images to, for example, VHD files.  AIM also can mount our image as write protected or as writable.  I won’t go into more depth on AIM’s features, as you can visit the web site to learn more and acquire a copy.

Heretofore, Windows would not enumerate shadow volumes on images mounted with the most popular tools, e.g., FTK Imager, Mount Image Pro, etc.  A notable exception is a Windows virtual disk file (VHD), which is not used to an appreciable extent, if at all, as the target of a disk image file in computer forensics.  I’ve explained before how to work with these virtual disks with respect to the Window 7 variety (VHD).  Windows 8 brings a new format, which is the VHDX file, which I’ll mention again later.  For now, suffice it to say that there no longer is a need to convert a dd image to a VHD if your goal is access shadow volumes on your host system.  As I’ve demonstrated in my VHD post, the conversion required the addition of data to the end of your dd image.  While that made an easily reversible change to an original image file, some folks were not comfortable doing so and chose to create a spare dd file.

Let’s take a closer look at AIM and how it can help us get to shadow volumes very handily.  I’m going to work with a dd image of a Windows 7 system, though there is no difference with an E01.  In the following screenshot, I’ve opened AIM and navigated to my image file (001).


Next, we’ll see the window that AIM presents after I select the image.  I’m going to maintain the default options, which the screenshot depicts.  Typically, we don’t have to ask AIM to fake (cache) a disk signature, which AIM allows because Windows won’t mount a disk if it does not have a signature.  I’ve seen only one case in which a disk signature was absent, and it concerned a VHD file created by Windows 7’s system image feature.  Note than AIM handles 4KB (and other) sectors.

Continue reading
90 Hits

Coming Soon, Online WinFE Training Program

I'm making a detailed tutorial on WinFE that I hope to finish in the upcoming week.  Virtually everything you need to know about WinFE will be in the tutorial, with demonstrations and instructions on everything you need to know.  I'm covering the basics to the advanced, different building methods, commercial and free/open source software to add to WinFE, how to use it in different situations, and how to prevent errors.  This means using it in forensic acquisitions, covert acquisitions, electronic discovery, triage, and preview.  You name it, I'm covering it.

The length will be about an hour (maybe a little more, maybe a little less) and will include a real test to take if you choose to go the entire route.  The purpose is to give you, the professional examiner, a complete training program in WinFE with a test to validate your knowledge.  For those that already see the intention of the test and online training, let me explain to others that might be missing the point.

Although I'm not going to proctor your test, look over your shoulder, or have you scan your fingerprint to make sure it was you that took the test, I am providing the test for your benefit.  As you know, training and experience is everything.  It's everything on your resume.  It's everything when you testify.  It's everything when you are doing your job.  With that, I will give you a solid training in WinFE that you can take to the bank (in a manner of speaking...).

So, if you want formal training in WinFE, as much as an online class can be, stand by, it's coming pretty darn soon.  Pass the info along.  We can all benefit when more examiners use WinFE.  Plus, I'd rather be the expert that had training in WinFE when going against someone that didn't have any training with it...


490 Hits

"Based upon the test results it is possible to run all versions of WinPE on a system with only 128 MB of system RAM"

winpeTake a gander at Misty's latest tests of WinFE/PE regarding RAM requirements and imaging speed...very nicely done with some impressive numbers.

On a different topic, some discussion on distribution licenses of WinFE has been going on at  One of the takeaway points of the discussion is that you shouldn't be giving away or selling WinFE (or PE) ISO files....that will violate the Microsoft EULA.  Since WinFE is most typically used in legal cases, using a tool that you violated the EULA could cause serious issues with the evidence you collected.  So if you didn't build it, don't use it.  That is the very bad news.

The very good news is that you can make your own WinFE, free, in just a few minutes, without violating the EULA.

I assume that one of the reasons Microsoft has such a restrictive EULA prohibiting distribution is so that the core files of WinPE (and FE) remain solid.  Downloading or using any 3rd party tool or something "a friend" sends you could contain anything hidden inside, like malware.  By using Microsoft's files, the odds are much lower that this will happen, meaning that when you build a WinFE, it is most malware free that can be expected.

After that discussion on forensicfocus slowed down, I had emails about WinFE regarding how to build it.  Not that I created the thing...but I will make a fairly detailed and easy to follow video on building a WinFE and everything you should know about it.  After all, if ever asked about your data collection tool, it's better to look like you know what you doing rather than say, "I downloaded this ISO file, booted the system and imaged with it, and don't really know much else about it."  Perhaps better to say, "I personally built and tested the imaging environment using industry best practices.  I used core files from the Microsoft company as allowed by its licensing agreement."

When the tutorial video is finished, I'll post the link.




608 Hits

Suggestions for a WinFE Imaging Tool Based on Clonedisk?

An imaging tool (CloneDisk) development project for WinFE...very cool...keep up with the thread and give your suggestions at


421 Hits
0 Comments discussion | DMDE - Basic Disk Imaging Test (and results)

If you are interested in some behind-the-scenes efforts of developing WinFE, take a look at the forum threads.  And if you want to give input on what you would like WinFE to do...the forum would be a good place to submit a suggestion or lend a hand in development.

If for nothing but curiosity, you can follow along in watching the developers of the WinFE discuss how they are working toward making the lightest, fastest, full-featured, minimal builds, multi-boot, easy-to-use,  and cool forensic tool around.

I'll continue to post the latest links and download information on this blog, because I know that time is usually non-existent, deadlines are always minutes away, your laptop (while at the airport or onsite) has eight programs running while you are replying to ten emails, and you just need to know where to download that latest WinFE building information.  So, that will be here.  But for when you have time at the side of the pool, browse to watch these guys improve WinFE as it happens.

360 Hits

Mini-WinFE Updated

"Misty" has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: This is the kind of stuff you want to read in order to really know as much about WinFE as possible.  Another really good source of info on mistype is at

Before I get any complaints about "WinFE is not perfect" or "WinFE can't do everything", let me that yes that is correct. It is not perfect and cannot do everything.  In the world of forensically booting evidence machines, some Linux bootable environments work very well too.  Some machines can't be booted forensically, that is true as well.  But for the marjority of systems that can be booted forensically, WinFE has its place.  For the average and above-average examiner needing to boot the evidence machine, there are few options available that make it super-easy to add drivers on the fly or use your Windows based apps from the office rather than Linux based you hardly (if ever) use.

If you haven't checked out WinFE, you should.  Everyone else is already on board :)

Some tidbits in the Mini-WinFE include:

  • DMDE (included)

  • Forensic Acquisition Utilities (downloaded automatically)

  • FTK Imager (copied from local install)

  • HWiNFO (included)

  • LinuxReader (downloaded automatically)

  • MW Snap (included)

  • NT Password Edit (included)

  • Opera (included)

  • Sumatra PDF Reader (included)

  • X-Ways Forensics (copied from local install)

  • Write Protect Tool (included)


[caption id="attachment_1177" align="aligncenter" width="806"]WINFE You gotta download the new version and check it out. It's plain cool.





* Added a number of additional options in the core script - 

  these are all enabled by default. The new options will 

  remove a number of unsupported options from the right-click 

  context menu. Thanks to forum member farda for

  these suggestions.

* Added "Open with" workaround for WinPE 4.0/5.0. See -

* WinFE settings are now separate to the Shell script - but are 

  still mandatory. They have been moved to a new script 


* Option to use either SANPolicy 3 or 4 (in new WinFE script) -

  SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as

  SANPolicy 4 is only supported in WinPE 4.0/5.0.

* File dependencies (to be extracted from install.wim or

  copied from the host Operating System) are handled in one

  (hidden) script -  Core\required.files.script. This will 

  make it simpler to implement any future file dependencies. 

* Added a script to copy files and folders from a local 

  directory - allowing the easy addition of third party files. 

  A menu entry will open the directory these files were copied 


* Added Tools\Create USB script - it's now possible to 

  create a MistyPE bootable UFD during the build process.

  Use with caution - see documentation for more details. 

  Tested with Windows 7 (SP1) and Windows 8.1.

* Added ADK For Win 8 (and 8.1) scripts. Refer to documents.

  NOTE - this has only been tested using Windows 7 (SP1) 

  and Windows 8.1.

* Wallpaper support (.jpg) added for all builds - this 

  feature was not previously working with WinPE 4/5. See

  Programs\Wallpaper script.

* Wimlib-ImageX updated to version 1.6.2

* Added build 6.3.9600 (Windows 8.1 - Final) to the list  

  of tested/working sources.

* Added the following scripts -

	- WinHex


	- Opera - 64-bit support added.

	- Keyboardlayouts

* Included FAU in the download. This is redistributed

  with the permission of the author (GMG Systems Inc) -

  refer to the project documentation.

* Program scripts now contain menu entries - this should

  make it easier to add new program scripts. Previously 

  all menu entries were contained in the shell script - 

  resulting in multiple script edits for any new programs 


* Various tweaks in core script 

	- "FileDelete,"%Cache%\temp\*.*" has been added to

	  to ensure that cached batch files and .ini files 

	  are deleted earlier in the build process. Without  

	  this fix there are errors in some very limited 


	- Added verification check from registry files  

	  extracted from boot.wim - only used if the 

	  wimlib-imagex checks fail.

* Script structure has been changed for all Program scripts. 

  Hopefully results in better error checking for any missing 


* Browse for folder support is added by individual program 

  scripts even if this option is not selected in the Core 

  script. Resulting in a more modular approach (see 


  for the philosophy behind this approach).

* Documentation updated - added section on using the ADK 

  For Win 8.1. 


649 Hits

Free Course Materials - Placing the Suspect Behind the Keyboard

Do you teach cybercrime/forensics and use "Placing the Suspect Behind the Keyboard"?  Maybe you are considering using this book in your course?  How would you like to have ready-made PowerPoints for the chapters with additional student materials to go along with the book in your course?  PSBK

I have had a few people tell me that this book is being used in their classes, but can't recall all of the colleges.  If you have used this book in a class, send me the instructor's name or have the instructorThis email address is being protected from spambots. You need JavaScript enabled to view it. so I can pass along information on materials for the class.

I will be starting on the materials now and will give access to any instructors that want to lend a hand and get early drafts for use right away.  The materials will be freely available for instructors to use and modify in their coursework.  As someone that has taught forensics for a few years, it is very very helpful to have class materials available rather than reinventing the wheel every class...

344 Hits