Just some ramblings.
Unfortunately there are so few updates nowadays to WinFE, that this blog is woefully neglected...on a positive note, since WinFE practically needs no updates, there is hardly a need to keep up on WinFE once you have mastered building it.
The best and most current source of all-things-WinFE is from a free online course at http://courses.dfironlinetraining.com/windows-forensic-environment so other than taking the course, this blog will not have additional information building WinFE.
The course includes downloads and links to downloads to build every publicly known version and build type of WinFE, from the basic WinFE, WinFE Lite, WTE WinFE, Mini-WinFE, and WinBuilder WinFE.
The WinFE wordpress blog will be used only for sporadic WinFE updates and related information since WinFE has practically reached the best it can be at current software standards (Windows 8). The only posts that may be original from here on out would be case examples, but that quickly grows old (I booted a machine to WinFE and imaged it...). A few instances are very neat, like imaging a Surface Pro, and for those interesting cases, I'll post them as I come across them or am sent information about them.
At its foundation, WinFE is a strong forensic OS platform, built on the latest Windows operating system, which can run most types of forensic software. That's about it. Simple, but amazingly effective at a forensic boot platform. Since it is so very simple, the updates to the WinFE blog become less and less. Therefore, the free webinar course covers everything you need to learn about WinFE along with every download needed, plus tips on building, using, and testifying to the use of WinFE.
After you view the course and build a few WinFEs, you'll see that WinFE is only a forensic boot OS. But you will also see that because it is a Windows boot OS, you can do so many things with it that you can not do with a Linux forensic OS or with a hardware writeblocker. That is the beauty of WinFE. Simple. Ingenious. Hard to improve upon (at this point...).
You have my permission to use the WinFE course and its materials in a manner that benefits WinFE at no cost. That means you can use information from the course to teach WinFE at conferences or any training session. WinFE is free (technically, you need a Windows OS license...but otherwise its free), and I've made the course free as well. When teaching or writing about WinFE related to the source and you choose to attribute to the source, that's nice of you, but not necessary if you don't want.
Take a run at the WinFE course. Watch all the videos or only the videos of interest. They are broken down by build types and how-to videos. The most important benefit you can get out of the course (other than learning how to build/use WInFE) is getting some formalized training in front of you about WinFE. It's one thing to spend hours (days?) figuring out something but quite another when you can get the meat-and-potatoes of what you need to know in the shortest period of time. I'd reckon that even if you attend a presentation on WinFE, you will get so much more out of the online course that you won't regret the time spent.
I've also said a few times, that once you build and use a WinFE, you will regret not having done so years earlier. Don't forget, WinFE has been around since 2008...it works even better now than back then.
Cool WInFE work done by Jeffrey A. Cunningham, Sr Digital Forensic Examiner, US Army (ChiefCham), on imaging a Surface Pro using a bootable UEFI WinFE. It is certainly neat to see this type of testing and research done on ANY forensic tool where the results can be shared with everyone.
Image a Surface Pro using bootable UEFI WINFE
The recent release of USB malware, in which any USB device is suspect of being infected after plugging into an unknown-if-clean machine, makes a problem for bootable USB devices in forensic collection. Some of the very scary claims to the USB malware are (http://news.discovery.com/tech/gear-and-gadgets/warning-usb-malware-code-unleashed-141006.htm):
That is bad stuff for a forensic bootable USB device. I've seen a few suggested solutions to the USB infection issue, but the fastest solution with WinFE is to burn to a CD/DVD instead of making a USB bootable. Problem solved.
Building a WinFE is still very very very very easy. Using the Mini-WinFE build, I just timed creating a WinFE DVD is less than 6 minutes. That was a few minutes with Winbuilder and a few minutes burning the ISO to DVD, while taking my time in the short process. If you haven't yet built a WinFE, the process is almost completely automated. Just point Winbuilder to your Windows 7/8 source and press go. Less than 5 minutes later, you have a forensically sound, bootable ISO/CD/DVD/or USB.
Granted, creating a WinFE CD/DVD in less than 10 minutes is not going to save you time compared to imaging a removed hard drive using a hardware imaging device. But...if you have LOTS of machines to image, booting the machines to be seized to WinFE most likely will be faster than removing hard drives and sharing hardware imaging devices. And for those pesky drives that won't come out, WinFE may be a good solution than fighting with an ultralight, can't-find-the-screws-to-remove-the-darn-hard-drive machines.
Neat to see WinFE being taught everywhere, as in, everywhere by many. Wish I could have been there for this presentation (mostly because I'd have to be in Australia to see it...).
"The team will debut a new course topic in Dallas: Introduction to Windows Forensic Environment (WinFE). In this lab and lecture, investigators will learn how to create a bootable forensic environment on a thumb drive. Using this thumb drive, investigators can then conduct previews of suspect computers in the field, looking for information that indicates whether the computer contains potential evidence in a case. The ability to conduct on-scene triage such as this is very important to investigators, as it gives immediate information about suspects and their devices."
The WinFE online course will be updated sooner with a few neat things that are coming up with WinFE. Until then, there have been over 2,000 registrations for the course and more every day.
I'm impressed that there are so many users interested in using WinFE, but then again, not really. It's still a really neat tool to have in your toolbox alongside the Linux forensics boot OSs. If you haven't taken a look at WinFE, give it a try. This course will remain online, free, and updated when there are updates to make.
I am checking out WTE and so far, WTE represents a great enhancement on making WinFE more user friendly in appearance and use. I'll post my thoughts on WTE sometime in the future after I really take a look at WTE in more detail.
Speaking of online courses, if you regularly "google" people for investigations, backgrounds, pre-employment checks, internal investigations, or need to find someone as a witness (or suspect, or victim), take a look at my Advanced Internet Investigations Course with Google Hacks. If you register with this link (or this code: winfe50), you get 50% tuition. The half off discount is for the first 50 people, then regular price of $195. The course is a tad over 4.5 hours and covers enough information where you can practically find anyone online, and in the physical world. Google operators, syntax, and hacks are covered including automated searching utilities (free software!).
[caption id="attachment_1262" align="alignleft" width="700"] Half price for the first 50 WinFE blog readers.
Ken Pryor wrote a kind review of the WinFE online course. Take a look at his blog for details.. http://digiforensics.blogspot.com/2014/07/windows-forensic-environment-training.html
Don't forget, the WinFE online course is just like WinFE...it's FREE!
Misty has updated Mini-WinFE. There are a few very neat updates, like UEFI support! Don't forget to sign up for free WinFE online training: http://courses.dfironlinetraining.com/windows-forensic-environment
Thanks to Misty!
2014.07.03 ========== * SysWOW64 support added when building from Windows 7/7(SP1)/8/8.1/8.1 Update 1 sources (should also work with some Windows Server 2008/2012 sources). The 5-Wow64 script was used as a base to identify file and registry dependencies. Credit therefore goes to everyone involved in the 5-Wow64.script (including JFX, Lancelot, 2aCD, ChrisR and "...to everybody on the BootLand forums for helping on the debuggind and improvement of this script."). Select 4] SysWOW64 in the main project script options to add SysWOW64. * UEFI support has been added. * CloneDisk script added * Virtual Keyboard (FreeVK) script added. * A number of changes have been made to the core script - wimlib-imagex now uses file lists when extracting dependencies from install.wim/boot.wim. This significantly improves build time, but has meant that any program scripts containing paths for file dependencies has required editing due to wimlib preserving directory structure (when extracting from file lists). * Fixed a bug when x64 local sources are used (in Create a cache from WinRE and the ADK scripts). Due to the way in which SysWOW64 redirects to the \Windows\SysWOW64 directory when running WinBuilder on a 64-bit system the file dependencies were being cached from \Windows\SysWOW64 instead of \Windows\System32 * Wimlib updated to 1.7.0. The amended update add command significantly reduces build time when the INJECT method is used. * Create ISO script updated. It now contains several options including Flat Boot and RAM Boot or multiboot RAM and Flat boot. It's also possible to create a BIOS or UEFI bootable ISO - or BIOS and UEFI bootable. * Create USB updated to include the option to RAM Boot or Flat Boot or multiboot RAM and Flat boot. UEFI support is also included. This script will not work if running WinBuilder on a Windows 2000/XP/2003 system. * Create USB (GPT UEFI) script added. This script will not work if running WinBuilder on a Windows 2000/XP/2003 system. Only fixed type disks are supported. * Added error check to the ADK For Win 8 (and 8.1) scripts - these cannot be executed if running WinBuilder on a Windows 2000/XP/2003 system. * Project.Settings.ini is added to the build listing all programs and project settings used in the current build. * Project documentation updated - minor updates throughout and two new sections added (MultiBoot WinPE and UEFI, BIOS, GPT and MBR) A special thanks to alacran for requesting UEFI and SysWOW64 support in MistyPE and for beta testing and feedback to actually get them working. Due to the number of changes made in this build it is entirely possible that errors may have unintentionally crept in. Please report any issues (or positive feedback) on the support topic at reboot.pro - http://reboot.pro/topic/19036-mini-winfe/ 2014.04.26 ========== * Added a number of additional options in the core script - these are all enabled by default. The new options will remove a number of unsupported options from the right-click context menu. Thanks to reboot.pro forum member farda for these suggestions. * Added "Open with" workaround for WinPE 4.0/5.0. See - http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/ * WinFE settings are now seperate to the Shell script - but are still mandatory. They have been moved to a new script \Programs.winfe.script * Option to use either SANPolicy 3 or 4 (in new WinFE script) - SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as SANPolicy 4 is only supported in WinPE 4.0/5.0. * File dependencies (to be extracted from install.wim or copied from the host Operating System) are handled in one (hidden) script - Core\required.files.script. This will make it simpler to implement any future file dependencies. * Added a script to copy files and folders from a local directory - allowing the easy addition of third party files. A menu entry will open the directory these files were copied to. * Added Tools\Create USB script - it's now possible to create a MistyPE bootable UFD during the build process. Use with caution - see documentation for more details. Tested with Windows 7 (SP1) and Windows 8.1. * Added ADK For Win 8 (and 8.1) scripts. Refer to documents. NOTE - this has only been tested using Windows 7 (SP1) and Windows 8.1. * Wallpaper support (.jpg) added for all builds - this feature was not previously working with WinPE 4/5. See Programs\Wallpaper script. * Wimlib-ImageX updated to version 1.6.2 * Added build 6.3.9600 (Windows 8.1 - Final) to the list of tested/working sources. * Added the following scripts - - WinHex - DMDE - Opera - 64-bit support added. - Keyboardlayouts * Included FAU in the download. This is redistributed with the permission of the author (GMG Systems Inc) - refer to the project documentation. * Program scripts now contain menu entries - this should make it easier to add new program scripts. Previously all menu entries were contained in the shell script - resulting in multiple script edits for any new programs added. * Various tweaks in core script - "FileDelete,"%Cache%\temp\*.*" has been added to to ensure that cached batch files and .ini files are deleted earlier in the build process. Without this fix there are errors in some very limited curcumstances. - Added verification check from registry files extracted from boot.wim - only used if the wimlib-imagex checks fail. * Script structure has been changed for all Program scripts. Hopefully results in better error checking for any missing files. * Browse for folder support is added by individual program scripts even if this option is not selected in the Core script. Resulting in a more modular approach (see "http://reboot.pro/topic/19042-modular-apps-philosophy-for-winpe/" for the philosophy behind this approach). * Documentation updated - added section on using the ADK For Win 8.1.
Over 100 viewers of the WinFE online course in the first 24 hours. There have been a few improvements made based on suggestions from some viewers. All comments have been positive. The course will remain free, take your time to watch and don't forget, build your WinFE! (TIP: Build the Mini-WinFE. It is the easiest, quickest, and least operater-error prone build available).
The X-Ways course has been delayed for a day for technical problems with video hosting...but, it's coming. There is actually several X-Ways courses being posted online, from basic to advanced. I have found that there are several updates in XWF that have not been incorporated in the XWF manual that I am adding in the courses. Even my XWF book is slightly outdated by all the changes and updates....but that is a good thing.
[caption id="attachment_1246" align="aligncenter" width="700"] https://twitter.com/WindowsFE
The video provider corrected the course videos from being off-center this morning. Thanks to everyone letting me know about the problem. I'm not surprised at how many viewers there are for the course as it shows how much WinFE is being used or at least how much it is known in the DF community.
Here is the Intro video, but you can watch the entire course at the course page here: http://courses.dfironlinetraining.com/windows-forensic-environment
Ok, it took a while to get this done, mostly because of other projects. But it is done. I have videos of most build methods, tips and tricks, pro's and con's, and aspects of WinFE that you may find important. I also included every bit of downloadable swag in the course too (batch files, wallpaper, scripts, etc...).
All in all, this is probably the best source of WinFE you will find. I encourage you to share it and use it, after all, this is a free tool. If anyone has suggestions on making the course better, let me know and I can try to squeeze in some improvements.
[caption id="attachment_1231" align="aligncenter" width="700"] http://courses.dfironlinetraining.com/windows-forensic-environment
The WinFE course was lots of work, but certainly worth the time to watch. The X-Ways course is something else entirely. The manner in which I made the X-Ways course is so that you can follow along with XWF in learning how to work a case with X-Ways Forensics. The course describes the options and buttons in XWF, but also shows how to simply work a case. There are literally so many features in X-Ways, that without training, you will be missing about 50% of what you should be doing. I found that even the most current version of the X-Ways manual does not list features in XWF...lots of information to keep up with, tons of features to consider, easy to miss something that you should not miss for such a powerful forensic tool.
If you want to be notified of the coupon code, be sure to follow the X-Ways blog at http://xwaysforensics.wordpress.com/ or the twitter account at https://twitter.com/XWaysGuide.
As with everyone, when you think you have time and make plans, a dozen interruptions will delay even the most determined. But, the WinFE online course is practically done except for:
1) latest build of Mini-WinFE being tested first to incorporate into the course (with UEFI support and a few other goodies)
2) reviewing the entire program (a volunteer is waiting for me to send him the link, after the Mini-WinFE testing is done..)
Not to say I got a little wild with this weekend project, but yeah, I got a little wild. A short YouTube video intention evolved into a lot more. In fact, every piece of downloadable WinFE related wallpaper, script, program, and links to anything I cannot personally distribute is in the program.
Until I push the button to release the course, it's vaporware, just like the write protect tool was vaporware before it was completed. But the course sequence that is completed already is listed below. If there is anything not listed that you have wondered about, speak up now or I will not know what may be missing.
I covered every major build method with videos (and downloadable guides when appropriate).
Introduction to the Course
I. Forensic Booting of Evidence Computers
II. Forensic Boot Operating Systems
Intro to Forensic Boot Systems
Linux Forensic Operating Systems
Windows Forensic Environment (Windows FE, WinFE)
III. WinFE Basics
Creation and development of WinFE
WinFE Write Protection Tool
Disk Management & DiskPart
WinFE and Your Forensic Software
IV. WinFE Validation
V. Building the Windows Forensic Environment
Building the Basic WinFE
Building WinFE with WinBuilder
Building WinFE Lite
Building the Windows Triage Environment
Building a MultiBoot WinFE
VI. Using WinFE
Forensic Data Collection (file copying, disk imaging)
Triage and Preview
Remote Booting and Collections
Onsite Forensic Analysis
Covert Collections/Sneak and Peeks
WinFE as an Electronic Discovery Tool
WinFE and Disk Encryption
WinFE as an Educational OS
VII. Wrapping Up with WinFE
WinFE Qualification Exam
I'm about halfway through the WinFE online course and then I'm sending it to a reviewer. The topics and order of the curriculum are listed below.
I've added a multitude of build methods that will be documented and demonstrated in the online class. It'll be recorded, so not a webinar where you have to close your door and tell the boss to stay out of your office during lunch. You will be able to watch it when you can and as much as you need.
If you don't see something on the list that you would like to have added, now is the time to make the suggestion before I finish and upload the course. I'm also uploading all the swag in form of batch files, white papers, wallpapers, applications, and anything else I have on WinFE for downloading. Basically, everything you need will be in one place.
There is a test at the end of the course and you can take it if you like or not. That is up to you to decide. Personally, I'd take it just to say that I took coursework in a forensic tool that included an exam to test my knowledge. This isn't a long course, but it is 'all things WinFE' wrapped up in one training program that you can take at home or during the lunch hour, about a forensic tool that anyone, and I mean literally anyone, can build on their laptop in Starbucks. You don't need to be a programmer or software developer. If you are a forensic examiner, you can build and use this tool.
WinFE doesn't do everything and doesn't work for every situation. But for when you need to use forensically sound bootable environment, WinFE is pretty cool.
Introduction to the Course
Why take this course?
[caption id="attachment_1206" align="alignright" width="300"]
One of the interesting things I have found online related to WinFE as I create a lesson plan for WinFE is "WTE" or "Windows Triage Environment". Before you get excited about this project, apparently, unless you work in government, you can't have it. Per the website, "WTE is released as freeware only for Law Enforcement or Government Agencies uses." Well darn it. From what I can tell, it is WinFE with some software, including Colin Ramsden's write protection application,but no super-secret-LE-only programs.
The good news is that in the upcoming tutorial on All Things WinFE, you will be able to make your own WinFE or whatever you want to call it, for free, whether you are a government employee or not.
Another interesting thing I found was that the commercial version of WinFE from ForensicSoft.com is no longer available. From the website, " Due to recent licensing changes by Microsoft, SAFE is no longer commercially available" and "No longer commercially available, SAFE (System Acquisition Forensic Environment) was the first and only forensically sound Windows boot disk."
I don't know when ForensicSoft stopped selling their WinFE (or "SAFE"), but it is no longer. However, I respectfully disagree on SAFE being the first and only forensically sound Windows boot disk....
Stand-by for the WinFE class. It's getting close to being done I do have a trusty tech-editor to review it prior to release :)
I'm making a detailed tutorial on WinFE that I hope to finish in the upcoming week. Virtually everything you need to know about WinFE will be in the tutorial, with demonstrations and instructions on everything you need to know. I'm covering the basics to the advanced, different building methods, commercial and free/open source software to add to WinFE, how to use it in different situations, and how to prevent errors. This means using it in forensic acquisitions, covert acquisitions, electronic discovery, triage, and preview. You name it, I'm covering it.
The length will be about an hour (maybe a little more, maybe a little less) and will include a real test to take if you choose to go the entire route. The purpose is to give you, the professional examiner, a complete training program in WinFE with a test to validate your knowledge. For those that already see the intention of the test and online training, let me explain to others that might be missing the point.
Although I'm not going to proctor your test, look over your shoulder, or have you scan your fingerprint to make sure it was you that took the test, I am providing the test for your benefit. As you know, training and experience is everything. It's everything on your resume. It's everything when you testify. It's everything when you are doing your job. With that, I will give you a solid training in WinFE that you can take to the bank (in a manner of speaking...).
So, if you want formal training in WinFE, as much as an online class can be, stand by, it's coming pretty darn soon. Pass the info along. We can all benefit when more examiners use WinFE. Plus, I'd rather be the expert that had training in WinFE when going against someone that didn't have any training with it...
Take a gander at Misty's latest tests of WinFE/PE regarding RAM requirements and imaging speed...very nicely done with some impressive numbers.
On a different topic, some discussion on distribution licenses of WinFE has been going on at forensicfocus.com. One of the takeaway points of the discussion is that you shouldn't be giving away or selling WinFE (or PE) ISO files....that will violate the Microsoft EULA. Since WinFE is most typically used in legal cases, using a tool that you violated the EULA could cause serious issues with the evidence you collected. So if you didn't build it, don't use it. That is the very bad news.
The very good news is that you can make your own WinFE, free, in just a few minutes, without violating the EULA.
I assume that one of the reasons Microsoft has such a restrictive EULA prohibiting distribution is so that the core files of WinPE (and FE) remain solid. Downloading or using any 3rd party tool or something "a friend" sends you could contain anything hidden inside, like malware. By using Microsoft's files, the odds are much lower that this will happen, meaning that when you build a WinFE, it is most malware free that can be expected.
After that discussion on forensicfocus slowed down, I had emails about WinFE regarding how to build it. Not that I created the thing...but I will make a fairly detailed and easy to follow video on building a WinFE and everything you should know about it. After all, if ever asked about your data collection tool, it's better to look like you know what you doing rather than say, "I downloaded this ISO file, booted the system and imaged with it, and don't really know much else about it." Perhaps better to say, "I personally built and tested the imaging environment using industry best practices. I used core files from the Microsoft company as allowed by its licensing agreement."
When the tutorial video is finished, I'll post the link.
An imaging tool (CloneDisk) development project for WinFE...very cool...keep up with the thread and give your suggestions at http://reboot.pro/topic/19765-suggestions-for-a-winfe-imaging-tool-based-on-clonedisk/