Taking WinFE to even another level on a multiboot thumbdrive. Very cool, but I spread this word to you because there are few things in life neater than a forensically bootable CD/USB with X-Ways Forensics.
Not that many years ago, you would not find a requirement of having experience with X-Ways to apply for a DFIR job. But now, some jobs recommend it and yet some others require it. This is not to say the other big players (Encase, Accessdata, etc..) are not needed or useful, just that XWF has made it to the same level at a price point that will probably not be beat with capabilities that still outpace other tools.
So......it makes sense to know a little about the tool that might put you over the edge for that next job. Of course, you need to be competent too, but like I've said before, "beware the examiners that use X-Ways Forensics because they probably know what they are doing."
I may have said that WinFE is nearly the perfect forensic boot system before, but actually, when WinFE is on a multiboot media, I would have to change it to the multiboot thumbdrive with WinFE being the perfect forensic boot system. Very very cool.
I also think this is one of those books that if not pre-ordered, will have you waiting until it is reprinted due to being over-ordered. The X-Ways Practitioner's Guide was one of those books too, where late-comers had to wait weeks for the second printing. This book is no different, because just about all of the neat things in the book show just how much Harlan has discovered in some very neat areas of Windows 8.
One thing I learned about ordering books from Amazon, is that Amazon will pretty much match the lowest price found elsewhere. I also learned that with a pre-ordered book, you can cancel before the book is printed if you find a lower price somewhere else. The point is, pre-order the book or you may be waiting a month after everyone else gets their copy...it comes out in April '14 and I'd expect the second printing to be needed in April '14...
There is quite of bit of information and tips regarding WinFE, all of which is helpful to anyone who uses WinFE. And not to give the impression that WinFE is the only solution, I still advocate having at least one each of the "other" forensic booting systems, such as DEFT, CAINE, RAPTOR, etc...
Anyone who boots systems to a forensic OS knows that a single bootable forensic OS doesn't work on every system, nor work every time, nor is appropriate for every situation. Plus, it doesn't look to professional when the client sees you staring at the screen when something doesn't work and you don't have a backup plan...
A new user to WinFE can be a new forensic analyst or a forensic analyst new to WinFE. Either way, this short post will be helpful to everyone who has not yet taken the time to try WinFE. To save you frustration, time, and questions, try this natural progression to start using WinFE:
* Mini-WinFE only needs about 10 minutes, start to finish and needs zero knowledge of coding. You get a fully operational, forensically bootable Windows operating system. It's fairly minimal, but pretty. It is also fast and easy to build and use with the lowest chance of having any build errors. You actually should have zero errors when the app builds WinFE for you.
* The bigger (full blown WinBuilder) builds take more time and effort. You will also experience build errors no matter how much effort you put into it. It just happens and you have to start over each time. The build process also takes longer. Basically, these build methods (not so much with WinFE Lite) take longer as you have more options to choose and have the ability to customize just about everything with the build to personalize it, add programs, and add features/options. You will try this eventually just because it is so cool and practical to have in your Go-bag.
I promise that after building and using Mini-WinFE, you will eventually make a bigger build that can run more forensic apps.