“Misty” has updated Mini-WinFE, the quick and easy build of the Windows Forensic Environment. There are some pretty neat updates to the build (listed below). So far, the best documentation I have seen on WinFE, specifically Mini-WinFE is here: http://mistype.reboo...ocs/readme.html. This is the kind of stuff you want to read in order to really know as much about WinFE as possible.
Before I get any complaints about “WinFE is not perfect” or “WinFE can’t do everything”, let me that yes that is correct. It is not perfect and cannot do everything. In the world of forensically booting evidence machines, some Linux bootable environments work very well too. Some machines can’t be booted forensically, that is true as well. But for the marjority of systems that can be booted forensically, WinFE has its place. For the average and above-average examiner needing to boot the evidence machine, there are few options available that make it super-easy to add drivers on the fly or use your Windows based apps from the office rather than Linux based you hardly (if ever) use.
If you haven’t checked out WinFE, you should. Everyone else is already on board :)
Some tidbits in the Mini-WinFE include:
- DMDE (included)
- Forensic Acquisition Utilities (downloaded automatically)
- FTK Imager (copied from local install)
- HWiNFO (included)
- LinuxReader (downloaded automatically)
- MW Snap (included)
- NT Password Edit (included)
- Opera (included)
- Sumatra PDF Reader (included)
- X-Ways Forensics (copied from local install)
- Write Protect Tool (included)
You gotta download the new version and check it out. It’s plain cool. http://reboot.pro/fi...375-mini-winfe/
2014.04.24 ========== * Added a number of additional options in the core script - these are all enabled by default. The new options will remove a number of unsupported options from the right-click context menu. Thanks to reboot.pro forum member farda for these suggestions. * Added "Open with" workaround for WinPE 4.0/5.0. See - http://reboot.pro/topic/19732-help-with-open-with-in-winpe-4050/ * Added DMDE script 2014.04.14 ========== * Fixed problem with menu entries for Forensic applications - they were not being parsed in some circumstances. * KeyboardLayout batch file updated. 2014.04.12 ========== * File dependencies (to be extracted from install.wim or copied from the host Operating System) are handled in one (hidden) script - Corerequired.files.script. This will make it simpler to implement any future file dependencies. * Added a script to copy files and folders from a local directory - allowing the easy addition of third party files. A menu entry will open the directory these files were copied to. * Added ToolsCreate USB script - it's now possible to create a MistyPE bootable UFD during the build process. Use with caution - see documentation for more details. Tested with Windows 7 (SP1) and Windows 8.1. * Added ADK For Win 8 (and 8.1) scripts. Refer to documents. NOTE - this has only been tested using Windows 7 (SP1) and Windows 8.1. * Wallpaper support (.jpg) added for all builds - this feature was not previously working with WinPE 4/5. See ProgramsWallpaper script. * WinFEWinFE script now contains options to use different combinations of SANPolicy and NoAutoMount settings. * Wimlib-ImageX updated to version 1.6.2 * Documentation updated - added section on using the ADK For Win 8.1.
View the full article
