Jump to content











Photo
- - - - -

Mini-WinFE

windows forensic environment winfe

  • This topic is locked This topic is locked
37 replies to this topic

#26 Blackbeauty

Blackbeauty

    Newbie

  • Members
  • 27 posts
  •  
    India

Posted 12 August 2015 - 05:50 AM

Hi,

I have created a winfe 8.1 bootable usb disk using Mini-WinFE.2014.07.03 release .

I used that disk to boot a DELL Vostro(3750) Laptop. Everything was going well until I tried to create a physical disk image of a USB 3 Pendrive(SanDisk) using FTK imager. The process exit with an error message saying "Your PC ran into a problem and needs to restart.... BUGCODE_USB3_DRIVER".

I thought the error was due to USB 3.0 driver so I installed those drivers(got from DELL Website) to the system by using the option 'add driver'. But it wont helped, the error keep coming . Please help 



#27 Haiphong

Haiphong

    Frequent Member

  • Advanced user
  • 237 posts

Posted 13 August 2015 - 12:40 PM

Hello Misty,

 

I have tried your Project. It"s very quick to boot from an USB Key. Can you add 2 Scripts and it's very fine !!!

 

1) For "Donet Framework"

2) For PStart to launch "Portable Programs"

 

Thanks !!!



#28 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 14 August 2015 - 07:04 AM

Hello Misty,

I have tried your Project. It"s very quick to boot from an USB Key. Can you add 2 Scripts and it's very fine !!!

1) For "Donet Framework"
2) For PStart to launch "Portable Programs"

Thanks !!!


@Haiphong
Thanks for the feedback. MistyPE/Mini-WinFE are lightweight versions of WinPE - .NET would add a lot of bloat. Also I do not know which file and registry entries would need to be added to support .NET - if you can provide this information then I should be able to script a way of adding it.

As a workaround why not use a build based on WinPE 4/5.* and use the Windows ADK - this includes a (minimal) .NET package. See here for using this with Mini-WinFE/MistyPE.

PStart should be easier to add - just stick the program and dependencies in a path specified in the Add Custom Folders\Files script. Or create your own script - see here.


Regards,

Misty

#29 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 14 August 2015 - 07:08 AM

Hi,
I have created a winfe 8.1 bootable usb disk using Mini-WinFE.2014.07.03 release .
I used that disk to boot a DELL Vostro(3750) Laptop. Everything was going well until I tried to create a physical disk image of a USB 3 Pendrive(SanDisk) using FTK imager. The process exit with an error message saying "Your PC ran into a problem and needs to restart.... BUGCODE_USB3_DRIVER".
I thought the error was due to USB 3.0 driver so I installed those drivers(got from DELL Website) to the system by using the option 'add driver'. But it wont helped, the error keep coming . Please help


@Blackbeauty
Not sure this is an issue with Mini-WinFE - try using a different imaging program and see if you have the same issue.

It's more likely an FTK Imager issue. Having said that I have no USB 3 hardware so it's not something I'd be in a position to try and troubleshoot anyway. Sorry.

Regards,

Misty
  • Blackbeauty likes this

#30 Haiphong

Haiphong

    Frequent Member

  • Advanced user
  • 237 posts

Posted 14 August 2015 - 08:24 AM

Hello Misty,

 

I want to build an "AutoRun" of "Pstart.exe" from "Pstart Folder". What have I to do ?

 

Thanks for a Reply.



#31 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 14 August 2015 - 04:42 PM

@Haiphong
I'm packing for a weeks holiday so you're stuck with the documentation for now.

Sorry!

#32 Haiphong

Haiphong

    Frequent Member

  • Advanced user
  • 237 posts

Posted 15 August 2015 - 05:14 AM

Hello Misty,

 

I wait for your availability.

 

Thanks for your quick reply.

 

Best Regards.



#33 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 15 August 2015 - 06:10 AM

I have no forensics exp whatsoever, but it's an area of interest I'd like to learn more about on a nonprofessional level, and this seems really interesting, and free. I can play around with it on a spare netbook, which has no important data on it. Or perhaps in a VM. The collection of tools seems nice and has things I'm already semi-familiar with, like Opera (best browser ever), BlackBox/bbLean (a desktop shell replacement I'm very fond of, and WinHex, a bit difficult to use but has features/tools out the wazoo to play with.



#34 hangingmoon2904

hangingmoon2904
  • Members
  • 1 posts
  •  
    United Kingdom

Posted 05 February 2016 - 07:52 AM

Hi Misty,

 

I am completely new to Winbuilder and I am having trouble making a Windows 8.1 x64 version of Mini WinFE that will work with secure boot systems as well as legacy BIOS systems. My main problem is that when I use my Windows 8.1 ISO it is saying that the files required to build it are not there. It seems to work fine with my Windows 8.1 x86 ISO. Any ideas?

 

Many Thanks

 



#35 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 12 December 2016 - 07:54 AM

Download links repaired - I've been locked out of reboot.pro for a while and the password reset function was not working - at least not for me!

#36 seanpowell

seanpowell

    Newbie

  • Members
  • 19 posts
  •  
    Australia

Posted 17 May 2018 - 02:28 AM

Having finally been motivated to redo my old win7 boot disk to a win10 x64 build, I've got encase8 working off my mini winfe based build.  Couple of minor issues but it is fully functional.  Very nice.



#37 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 26 May 2022 - 06:50 PM

Mini-WinFE development stalled some time ago. This was initially due to a combination of work/life commitments and the limited free time I had having been spent working on the PEBakery ChrisPE project. And then Covid hit!

Time constraints remain an issue. Rather than abandoning the project I have decided to use the ChrisPE fileset as a base for updating Mini-WinFE.

WinBuilder is not supported in the new project - PEBakery is required. PEBakery 0.9.5.1 beta5 build is included in the project download. The project has been tested with more recent PEBakery builds including PEBakery 1.0.0, however tests were limited to running on a Windows 10 host operating system. Build 1.0.0 failed to run during a brief test on Windows 8.1.

NOTE - .Net Framework 4.7.1 and Windows 7 or newer is required to run PEBakery 0.9.5.1 beta. It should run ok on Windows 10.

The Mini-WinFE reboot is available via GitHub. There are two branches -
  • main - forensic focus. A number of applications and settings that could potentially perform disk writes have been removed.
  • WinPE - includes more applications and options - use with caution as it is possible to use settings that will not write protect disks.
I anticipate that main will be a Mini-WinFE replacement, and WinPE will act as a MistyPE replacement.

Support for Windows 10 up to and including build 10.0.19044 (21H2 - November 2021 Update) has been added. This includes SysWOW64 support. Testing has been limited. More details of supported builds is available @ http://winfe.mistypr...files/winpe.htm

Windows 11 (buiild 10.0.22000) also appears to be working.

DMDE and HWiNFO have been updated.

BOOTICE, Swiftsearch and nirsoft's Product Key Scanner have been added.

The Disk Management Console (DiskMgmt.mmmc) is not working in Windows 10 1903 or newer builds.

Whilst I would ideally like to port the changes to WinBuilder, this is not currently realistic. A number of commands have been added to PEBakery that make development a lot easier - these commands are not supported in Winbuilder.

Some of the previous features of Mini-WinFE are missing, however the build process should be more straightforward due to reduced options.Feedback welcome.

:cheers:

Misty

#38 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 18 June 2022 - 09:35 AM

WinBuilder support has been added for the GitHub project I mentioned in my previous post (#37)

cheers.gif

Misty
  • alacran likes this

#39 misty

misty

    Gold Member

  • Developer
  • 1066 posts
  •  
    United Kingdom

Posted 11 February 2023 - 07:43 AM

Mini-WinFE has been superceeded and migrated to GitHub - please refer to the following topic for more information -
https://reboot.pro/i...showtopic=22717

GitHub page -
  • main - forensic focus. A number of applications and settings that could potentially perform disk writes have been removed.
  • WinPE - intended as a MistyPE replacement. Includes more applications and options (than the 'main' branch) - use with caution as it is possible to use settings that will not write protect disks.
This topic is now locked.

cheers.gif

Misty





Also tagged with one or more of these keywords: windows forensic environment, winfe

3 user(s) are reading this topic

0 members, 3 guests, 0 anonymous users