Invisible Drives in WinFE?

If you boot up an evidence machine and don’t see the drives that you should be seeing, before you panic, it might be just a driver issue.

There might not be a need to shut down and rebuild your WinFE, or even try another (Linux) bootable OS.  Just use a different computer, search the Internet for the driver-specific to your unseen drive, download the driver, and add it to your running WinFE through the Write Protect Tool.

WinFE10

Start the Write Protect Tool, choose “Driver” and add the driver that you downloaded. This will solve 99% of the invisible drives that you might come across.

As far as a Linux distro having the missing driver, my guess is that you’ll have the same issue, but it is certainly worth the true of a Linux distro. But if the issue is the same, adding a driver through WinFE is a whole lot easier than a Linux boot OS (at least easier for the majority of examiners using forensic boot OSs).

One tip on drivers, it is also an idea to have a storage media packed with drivers that you may need one day, or may never need, but good to have.  With a flash drive of drivers, you might be able to avoid frantically searching for an Internet connection or driver to download from unverified websites! By stocking up on drivers when you have time, you will save time when you need one.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s