This is the same as version 3.5.12.k except adds the function to create a CETS manifest XML needed for those using CETS.
Arnold will post information for CETS users regarding changes needed to properly use the X-Tension.
C4All X-Tension CETS compatible version 3.5.13.a
For use with CETS:
1. This will provide a generic "CETS Media Manifest.xml" file
2. This generic file will not include the digital signature InvestigationID, ManifestID, or CategorizationID. However, the CategorizationID can be added manually.
3. With the CETS Media Uploader you can "re-sign" the manifest file if you use "adminmode" of the CETS Media Uploader.
To enter into Admin Mode:
1. Right Click on "CETSMediaUploader.exe"
2. Select: Sent To, Desktop (create shortcut)
3. Locate the shortcut on your desktop
4. Right Click on the shortcut and select : Properties
5. In the Target Field append to the end of the line(after the closing "): -adminmode
6. Double click the edited Short Cut
When you launch the CETS Media Uploader in Admin Mode you will a new button to "Sign Manifest" file.
Clicking on the button will bring up a dialogue window to manually select a user and the related investigation.
Keep in mind, that you must manually cut and paste your Categorization settings into the XML file.
Canadian Police Centre for
Missing and Exploited Children.
Neat to see WinFE being taught everywhere, as in, everywhere by many. Wish I could have been there for this presentation (mostly because I'd have to be in Australia to see it...).
"The team will debut a new course topic in Dallas: Introduction to Windows Forensic Environment (WinFE). In this lab and lecture, investigators will learn how to create a bootable forensic environment on a thumb drive. Using this thumb drive, investigators can then conduct previews of suspect computers in the field, looking for information that indicates whether the computer contains potential evidence in a case. The ability to conduct on-scene triage such as this is very important to investigators, as it gives immediate information about suspects and their devices."
The WinFE online course will be updated sooner with a few neat things that are coming up with WinFE. Until then, there have been over 2,000 registrations for the course and more every day.
I'm impressed that there are so many users interested in using WinFE, but then again, not really. It's still a really neat tool to have in your toolbox alongside the Linux forensics boot OSs. If you haven't taken a look at WinFE, give it a try. This course will remain online, free, and updated when there are updates to make.
I am checking out WTE and so far, WTE represents a great enhancement on making WinFE more user friendly in appearance and use. I'll post my thoughts on WTE sometime in the future after I really take a look at WTE in more detail.
Speaking of online courses, if you regularly "google" people for investigations, backgrounds, pre-employment checks, internal investigations, or need to find someone as a witness (or suspect, or victim), take a look at my Advanced Internet Investigations Course with Google Hacks. If you register with this link (or this code: winfe50), you get 50% tuition. The half off discount is for the first 50 people, then regular price of $195. The course is a tad over 4.5 hours and covers enough information where you can practically find anyone online, and in the physical world. Google operators, syntax, and hacks are covered including automated searching utilities (free software!).
[caption id="attachment_1262" align="alignleft" width="700"] Half price for the first 50 WinFE blog readers.
Ken Pryor wrote a kind review of the WinFE online course. Take a look at his blog for details.. http://digiforensics.blogspot.com/2014/07/windows-forensic-environment-training.html
Don't forget, the WinFE online course is just like WinFE...it's FREE!
Misty has updated Mini-WinFE. There are a few very neat updates, like UEFI support! Don't forget to sign up for free WinFE online training: http://courses.dfironlinetraining.com/windows-forensic-environment
Thanks to Misty!
2014.07.03 ========== * SysWOW64 support added when building from Windows 7/7(SP1)/8/8.1/8.1 Update 1 sources (should also work with some Windows Server 2008/2012 sources). The 5-Wow64 script was used as a base to identify file and registry dependencies. Credit therefore goes to everyone involved in the 5-Wow64.script (including JFX, Lancelot, 2aCD, ChrisR and "...to everybody on the BootLand forums for helping on the debuggind and improvement of this script."). Select 4] SysWOW64 in the main project script options to add SysWOW64. * UEFI support has been added. * CloneDisk script added * Virtual Keyboard (FreeVK) script added. * A number of changes have been made to the core script - wimlib-imagex now uses file lists when extracting dependencies from install.wim/boot.wim. This significantly improves build time, but has meant that any program scripts containing paths for file dependencies has required editing due to wimlib preserving directory structure (when extracting from file lists). * Fixed a bug when x64 local sources are used (in Create a cache from WinRE and the ADK scripts). Due to the way in which SysWOW64 redirects to the \Windows\SysWOW64 directory when running WinBuilder on a 64-bit system the file dependencies were being cached from \Windows\SysWOW64 instead of \Windows\System32 * Wimlib updated to 1.7.0. The amended update add command significantly reduces build time when the INJECT method is used. * Create ISO script updated. It now contains several options including Flat Boot and RAM Boot or multiboot RAM and Flat boot. It's also possible to create a BIOS or UEFI bootable ISO - or BIOS and UEFI bootable. * Create USB updated to include the option to RAM Boot or Flat Boot or multiboot RAM and Flat boot. UEFI support is also included. This script will not work if running WinBuilder on a Windows 2000/XP/2003 system. * Create USB (GPT UEFI) script added. This script will not work if running WinBuilder on a Windows 2000/XP/2003 system. Only fixed type disks are supported. * Added error check to the ADK For Win 8 (and 8.1) scripts - these cannot be executed if running WinBuilder on a Windows 2000/XP/2003 system. * Project.Settings.ini is added to the build listing all programs and project settings used in the current build. * Project documentation updated - minor updates throughout and two new sections added (MultiBoot WinPE and UEFI, BIOS, GPT and MBR) A special thanks to alacran for requesting UEFI and SysWOW64 support in MistyPE and for beta testing and feedback to actually get them working. Due to the number of changes made in this build it is entirely possible that errors may have unintentionally crept in. Please report any issues (or positive feedback) on the support topic at reboot.pro - http://reboot.pro/topic/19036-mini-winfe/ 2014.04.26 ========== * Added a number of additional options in the core script - these are all enabled by default. The new options will remove a number of unsupported options from the right-click context menu. Thanks to reboot.pro forum member farda for these suggestions. * Added "Open with" workaround for WinPE 4.0/5.0. See - http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/ * WinFE settings are now seperate to the Shell script - but are still mandatory. They have been moved to a new script \Programs.winfe.script * Option to use either SANPolicy 3 or 4 (in new WinFE script) - SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as SANPolicy 4 is only supported in WinPE 4.0/5.0. * File dependencies (to be extracted from install.wim or copied from the host Operating System) are handled in one (hidden) script - Core\required.files.script. This will make it simpler to implement any future file dependencies. * Added a script to copy files and folders from a local directory - allowing the easy addition of third party files. A menu entry will open the directory these files were copied to. * Added Tools\Create USB script - it's now possible to create a MistyPE bootable UFD during the build process. Use with caution - see documentation for more details. Tested with Windows 7 (SP1) and Windows 8.1. * Added ADK For Win 8 (and 8.1) scripts. Refer to documents. NOTE - this has only been tested using Windows 7 (SP1) and Windows 8.1. * Wallpaper support (.jpg) added for all builds - this feature was not previously working with WinPE 4/5. See Programs\Wallpaper script. * Wimlib-ImageX updated to version 1.6.2 * Added build 6.3.9600 (Windows 8.1 - Final) to the list of tested/working sources. * Added the following scripts - - WinHex - DMDE - Opera - 64-bit support added. - Keyboardlayouts * Included FAU in the download. This is redistributed with the permission of the author (GMG Systems Inc) - refer to the project documentation. * Program scripts now contain menu entries - this should make it easier to add new program scripts. Previously all menu entries were contained in the shell script - resulting in multiple script edits for any new programs added. * Various tweaks in core script - "FileDelete,"%Cache%\temp\*.*" has been added to to ensure that cached batch files and .ini files are deleted earlier in the build process. Without this fix there are errors in some very limited curcumstances. - Added verification check from registry files extracted from boot.wim - only used if the wimlib-imagex checks fail. * Script structure has been changed for all Program scripts. Hopefully results in better error checking for any missing files. * Browse for folder support is added by individual program scripts even if this option is not selected in the Core script. Resulting in a more modular approach (see "http://reboot.pro/topic/19042-modular-apps-philosophy-for-winpe/" for the philosophy behind this approach). * Documentation updated - added section on using the ADK For Win 8.1.