The Comprehensive WinFE Guide: Done The WinFE Certification Course: Done The WinFE Train-the-Trainer Course: Done Here is the good news: Here is the other news: There are enough people that signed up for the Train-the-Trainer course that this should create many avenues for everyone to find WinFE training in their organization or elsewhere from those…
The WinFE Book The PDF version (FREE!) is here: WinFE – Windows Forensic Environment PDF or here WinFE – Windows Forensic Environment (same PDF, different cloud service in case one is overloaded). The print version is here: https://amzn.to/3tjN9QP Training Windows Forensic Environment (WinFE) Certificationhttp://courses.dfironlinetraining.com/windows-forensic-environment-winfe Windows Forensic Environment (WinFE) Train-the-Trainer/Instructor Certificationhttp://courses.dfironlinetraining.com/windows-forensic-environment-winfe-trainer SEARCH (LE only)https://www.search.org/new-training-course-puts-much-needed-digital-field-triage-tool-in-the-hands-of-law-enforcement/
My last live WinFE (train-the-trainer) class starts in less than 1 hour! Then no more until this time next year at the earliest. However, the OnDemand version will be up later this week. It will be the same content, much of it from the live class. Here are some quick notes: Special offer: For anyone…
The first-ever, WinFE Train-the-Trainer (WinFE Instructor) starts on Monday, July 24. This is a live, online course with an on-demand version available shortly thereafter. The live course is full. BUT!! On Monday, I will have a special package offer for the WinFE training courses. Stay tuned here and on @WindowsFE Twitter to catch the announcement…
Short story: Do you want a formal course in WinFE with written documentation that you were trained in all things WinFE with the same content that law enforcement, military, intelligence agencies, and universities have received? If so, sign up here: Longer story: Free forensic tools are great, but when it comes to “learning” how to…
For the 2,000+ downloads of the WinFE guide, this is most likely the last iteration of the guide. I’ll leave the hard copy on Amazon for anyone wanting to buy a copy. At most, I will be making a few corrections in the guide with grammar that I surely missed…but the information on WinFE most…
Next week, the WinFE course will start, first with a live course (which is full), followed up by an ondemand version of the live course. At first, this training was meant to be a refresher and a brief introduction to WinFE, but with a ton of emails, turned into a full-fledged-everything-you-need-to-know about WinFE course. For…
Quick stats on the WinFE Certification course: The first 20 seats to the live course filled up in less than 20 minutes. The first 200 seats for the 80% discount offer (including the above 20 people) went in about an hour or so. I added 200 more seats for the 80% discount offer and those…
TLDR: WinFE is still relevant in 2023. In some instances, most relevant of any data collection tool because some devices can only be accessed with a bootable OS (even some of these can only be accessed by WinFE!). The WinFE guide has been updated, at least as much as can be as WinFE hasn’t really…
If you boot up an evidence machine and don’t see the drives that you should be seeing, before you panic, it might be just a driver issue. There might not be a need to shut down and rebuild your WinFE, or even try another (Linux) bootable OS. Just use a different computer, search the Internet…
Everything WinFE will be permalinked here: https://winfe.wordpress.com/winfe-quick-download-links/ I’ll add links as they come up, wallpaper as submitted by users, and keep the page updated as a credible source for building WinFE.
The short story on the newest Mini-WinFE 10 (aka, the download link): Mini-WinFE has been updated and upgraded. I update WinFE developments (including the downloads for Mini-WinFE) at https://www.patreon.com/posts/34814255. The Mini-WinFE builder is a free download. Mini-WinFE 10 Are forensic bootable OSs still useful today? Depending on who you ask, forensic bootable OSs are either…
Download Mini-WinFE here: http://reboot.pro/files/file/375-mini-winfe/ 1) Unzip the project with 7 zip or WinRAR (you’ll run into build problems using other methods) 2) Choose your source 3) Choose if you want to have the program in or out of the wim file 4) Add FTK Imager (must be on your hard drive) 5) Add X-Ways Forensics…
There is a new write up on WinFE in a free issue of eForensics Magazine. Check it out, it’s free 🙂
Very cool of Alex to share his work. Thanks Alex! Alex van Ginkel Final Thesis MSc_27nov
A new user to WinFE can be a new forensic analyst or a forensic analyst new to WinFE. Either way, this short post will be helpful to everyone who has not yet taken the time to try WinFE. To save you frustration, time, and questions, try this natural progression to start using WinFE: 1) Start…
Do you teach cybercrime/forensics and use “Placing the Suspect Behind the Keyboard“? Maybe you are considering using this book in your course? How would you like to have ready-made PowerPoints for the chapters with additional student materials to go along with the book in your course? I have had a few people tell me that…
I’ve been waiting until I received the hard copy of this book to write the review. I had the fortune of being the tech editor for this book and enjoyed every minute of it. Although I do not have an ongoing financial interest in this book, I do have a vested personal interest based on…
Taking WinFE to even another level on a multiboot thumbdrive. Very cool. http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-248-adding-winfe-image-to.html
Network Investigation & Digital Triage Very cool. SEARCH.org teaches WinFE in its Network Investigation & Digital Triage course.
Cool. Looks like there is a new discount on my book, “Placing the Suspect Behind the Keyboard”. Plus, it also looks like an entire chapter is available for download. I’m also giving a presentation on this book at NOLACON (New Orleans, Louisiana).
Windows Forensic Environment 