“Misty” has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment. There are some pretty neat updates to the build (listed below). So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mistype.reboot.pro/documents/WinFE/winfe.htm. This is the kind of stuff you want to read in order to really know as much about WinFE as possible. Another really good source of info on mistype is at http://mistype.reboot.pro/mistype.docs/readme.html.
Before I get any complaints about “WinFE is not perfect” or “WinFE can’t do everything”, let me that yes that is correct. It is not perfect and cannot do everything. In the world of forensically booting evidence machines, some Linux bootable environments work very well too. Some machines can’t be booted forensically, that is true as well. But for the marjority of systems that can be booted forensically, WinFE has its place. For the average and above-average examiner needing to boot the evidence machine, there are few options available that make it super-easy to add drivers on the fly or use your Windows based apps from the office rather than Linux based you hardly (if ever) use.
If you haven’t checked out WinFE, you should. Everyone else is already on board 🙂
Some tidbits in the Mini-WinFE include:
- DMDE (included)
- Forensic Acquisition Utilities (downloaded automatically)
- FTK Imager (copied from local install)
- HWiNFO (included)
- LinuxReader (downloaded automatically)
- MW Snap (included)
- NT Password Edit (included)
- Opera (included)
- Sumatra PDF Reader (included)
- X-Ways Forensics (copied from local install)
- Write Protect Tool (included)
2014.04.26 ========== * Added a number of additional options in the core script - these are all enabled by default. The new options will remove a number of unsupported options from the right-click context menu. Thanks to reboot.pro forum member farda for these suggestions. * Added "Open with" workaround for WinPE 4.0/5.0. See - http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/ * WinFE settings are now separate to the Shell script - but are still mandatory. They have been moved to a new script \Programs.winfe.script * Option to use either SANPolicy 3 or 4 (in new WinFE script) - SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as SANPolicy 4 is only supported in WinPE 4.0/5.0. * File dependencies (to be extracted from install.wim or copied from the host Operating System) are handled in one (hidden) script - Core\required.files.script. This will make it simpler to implement any future file dependencies. * Added a script to copy files and folders from a local directory - allowing the easy addition of third party files. A menu entry will open the directory these files were copied to. * Added Tools\Create USB script - it's now possible to create a MistyPE bootable UFD during the build process. Use with caution - see documentation for more details. Tested with Windows 7 (SP1) and Windows 8.1. * Added ADK For Win 8 (and 8.1) scripts. Refer to documents. NOTE - this has only been tested using Windows 7 (SP1) and Windows 8.1. * Wallpaper support (.jpg) added for all builds - this feature was not previously working with WinPE 4/5. See Programs\Wallpaper script. * Wimlib-ImageX updated to version 1.6.2 * Added build 6.3.9600 (Windows 8.1 - Final) to the list of tested/working sources. * Added the following scripts - - WinHex - DMDE - Opera - 64-bit support added. - Keyboardlayouts * Included FAU in the download. This is redistributed with the permission of the author (GMG Systems Inc) - refer to the project documentation. * Program scripts now contain menu entries - this should make it easier to add new program scripts. Previously all menu entries were contained in the shell script - resulting in multiple script edits for any new programs added. * Various tweaks in core script - "FileDelete,"%Cache%\temp\*.*" has been added to to ensure that cached batch files and .ini files are deleted earlier in the build process. Without this fix there are errors in some very limited curcumstances. - Added verification check from registry files extracted from boot.wim - only used if the wimlib-imagex checks fail. * Script structure has been changed for all Program scripts. Hopefully results in better error checking for any missing files. * Browse for folder support is added by individual program scripts even if this option is not selected in the Core script. Resulting in a more modular approach (see "http://reboot.pro/topic/19042-modular-apps-philosophy-for-winpe/" for the philosophy behind this approach). * Documentation updated - added section on using the ADK For Win 8.1.