Mini-WinFE Updated

“Misty” has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: This is the kind of stuff you want to read in order to really know as much about WinFE as possible.  Another really good source of info on mistype is at

Before I get any complaints about “WinFE is not perfect” or “WinFE can’t do everything”, let me that yes that is correct. It is not perfect and cannot do everything.  In the world of forensically booting evidence machines, some Linux bootable environments work very well too.  Some machines can’t be booted forensically, that is true as well.  But for the marjority of systems that can be booted forensically, WinFE has its place.  For the average and above-average examiner needing to boot the evidence machine, there are few options available that make it super-easy to add drivers on the fly or use your Windows based apps from the office rather than Linux based you hardly (if ever) use.

If you haven’t checked out WinFE, you should.  Everyone else is already on board 🙂

Some tidbits in the Mini-WinFE include:

  • DMDE (included)
  • Forensic Acquisition Utilities (downloaded automatically)
  • FTK Imager (copied from local install)
  • HWiNFO (included)
  • LinuxReader (downloaded automatically)
  • MW Snap (included)
  • NT Password Edit (included)
  • Opera (included)
  • Sumatra PDF Reader (included)
  • X-Ways Forensics (copied from local install)
  • Write Protect Tool (included)

You gotta download the new version and check it out. It’s plain cool.



* Added a number of additional options in the core script - 
  these are all enabled by default. The new options will 
  remove a number of unsupported options from the right-click 
  context menu. Thanks to forum member farda for
  these suggestions.

* Added "Open with" workaround for WinPE 4.0/5.0. See -

* WinFE settings are now separate to the Shell script - but are 
  still mandatory. They have been moved to a new script 

* Option to use either SANPolicy 3 or 4 (in new WinFE script) -
  SANPolicy 3 is automatically used with WinPE 2.*/3.* sources as
  SANPolicy 4 is only supported in WinPE 4.0/5.0.

* File dependencies (to be extracted from install.wim or
  copied from the host Operating System) are handled in one
  (hidden) script -  Core\required.files.script. This will 
  make it simpler to implement any future file dependencies. 

* Added a script to copy files and folders from a local 
  directory - allowing the easy addition of third party files. 
  A menu entry will open the directory these files were copied 

* Added Tools\Create USB script - it's now possible to 
  create a MistyPE bootable UFD during the build process.
  Use with caution - see documentation for more details. 
  Tested with Windows 7 (SP1) and Windows 8.1.

* Added ADK For Win 8 (and 8.1) scripts. Refer to documents.
  NOTE - this has only been tested using Windows 7 (SP1) 
  and Windows 8.1.

* Wallpaper support (.jpg) added for all builds - this 
  feature was not previously working with WinPE 4/5. See
  Programs\Wallpaper script.

* Wimlib-ImageX updated to version 1.6.2

* Added build 6.3.9600 (Windows 8.1 - Final) to the list  
  of tested/working sources.

* Added the following scripts -
	- WinHex
	- Opera - 64-bit support added.
	- Keyboardlayouts

* Included FAU in the download. This is redistributed
  with the permission of the author (GMG Systems Inc) -
  refer to the project documentation.

* Program scripts now contain menu entries - this should
  make it easier to add new program scripts. Previously 
  all menu entries were contained in the shell script - 
  resulting in multiple script edits for any new programs 

* Various tweaks in core script 
	- "FileDelete,"%Cache%\temp\*.*" has been added to
	  to ensure that cached batch files and .ini files 
	  are deleted earlier in the build process. Without  
	  this fix there are errors in some very limited 
	- Added verification check from registry files  
	  extracted from boot.wim - only used if the 
	  wimlib-imagex checks fail.

* Script structure has been changed for all Program scripts. 
  Hopefully results in better error checking for any missing 

* Browse for folder support is added by individual program 
  scripts even if this option is not selected in the Core 
  script. Resulting in a more modular approach (see 
  for the philosophy behind this approach).

* Documentation updated - added section on using the ADK 
  For Win 8.1. 

3 thoughts on “Mini-WinFE Updated

  1. Thank you again.

    Anyone who complains that Windows FE is not perfect is either raising or battling a Straw man. ( It’s a tool.

    If you work in an environment that has an enterprise license, I would suggest you look into Windows To Go, which can have all the functionality of Windows FE, plus networking and RDP. Imaging a data center server is so much more pleasant when you can do it from any place other than in the cage in the data center.

    The latest version of Windows PE (WinPE 5.1, offers Windows Image File Boot (WimBoot) to reduce the Windows PE foot print. I haven’t had a chance to work with it yet, but it looks like it might be a useful feature for Windows FE. See,

    • Oh yes. Windows To Go is a better way to go for sure. But that darn enterprise license keeps Windows To Go at bay for many…I’ll take a look at the latest winpe too, sounds neat.

  2. Big thanks. I’m equal to zero in Forensic. Very interesting.

    Sat, 26 Apr 2014 15:55:36 +0000 от “” : >Brett Shavers posted: “”Misty” has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment.  There are some pretty neat updates to the build (listed below).  So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mi ” >

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s