For the 2,000+ downloads of the WinFE guide, this is most likely the last iteration of the guide. I’ll leave the hard copy on Amazon for anyone wanting to buy a copy. At most, I will be making a few corrections in the guide with grammar that I surely missed…but the information on WinFE most likely will not change.
The WinFE Certification course starts July 10 as a live course to a select few (only 20!) and then everyone else who signed up has access to the OnDemand version afterward.
The purpose of WinFE training goes beyond a YouTube video
If you only want to learn how to build a WinFE, simply Google it. You’ll find plenty of blog posts and YouTube videos showing how to build WinFE. Some may even give demos of using a specific software or two in WinFE. But if you are hanging your reputation in using WinFE only on that amount of ‘training’, you are taking an unnecessary professional risk. This WinFE course goes beyond just building a WinFE because you may need to testify about it, or at least explain to a client or boss why you used something that you learned from YouTube in a legal matter. It will also help you not screw up your case.
With that, the purpose of this WinFE course is to give you all that you need to defend your use of WinFE, and most of the course also applies to any forensic boot operating system.
Going a step further
If you pass the WinFE course, there is an option of taking an Instructor-Trainer course in teaching WinFE. Of the hundreds currently signed up for the WinFE course, all are eligible to continue into the Instructor-Trainer course. This gives the community hundreds of sources of learning about WinFE. My goal is not to hoard WinFE (never has been), but to support a tool used by thousands at a software cost of zero.
If you pass the Instructor-Trainer course, I encourage you to train others! You have full permission to use the training materials from the WinFE course to train others (the downloads of all materials for you to teach, with my notes, are in the course!). I would imagine it’s a good thing to have a training session in your organization to teach a tool that everyone can benefit to use. Be the WinFE expert in your organization!
Last chance for my WinFE training?
Not to sound like I will drop WinFE, but this is most certainly the last course that I create for WinFE and the first and last course for WinFE Instructor-Trainer that I offer. This has nothing to do with me using or not using WinFE.
The reason that I am making an Instructor-Trainer course is so that many more are able to teach WinFE formally than just a few or through YouTube videos, or by untrained users. I took a count of the number of users in just my online WinFE courses over the years since 2014 combined with this updated course, and I found that there are over 7,000 that signed up for all WinFE training (not all completed the course in the past). I have also taught WinFE in person to more than 200 additional users in 3 countries through conferences, workshops, and once to a small unit in their building with no windows (if you know what I mean).
For a free boot OS, I think these numbers are amazing, and this is only those that I personally touched, not counting others who have taught WinFE (from SEARCH, FLETC, IACIS, etc…).
Future of WinFE
I will still be one of those behind pushing WinFE’s use and development for as long as I need to use it (selfish? maybe…beneficial to the community at large?…absolutely!). I believe in Troy Larson’s ingenious creation enough to advocate for its use well past my service in the field of DFIR. For as long as WinFE is the only solution for certain devices, WinFE will remain relevant. For as long as WinFE is a reasonable option in data acquisition and/or analysis, WinFE will remain relevant.
Next opening for signing up for the WinFE Cert course
After the live course is finished, I will open up both the WinFE Certification course and Instructor-Trainer course again for a limited time before closing it to a subscription service.
View the full article
