I get a few stories of how WinFE saved the day and a few of these heroes let me retell their story. This is one of them. The ‘detective’ wishes to be unnamed, but for sake of argument, I know who he is…
————————————————————————————————————————
A detective from a California law enforcement agency that had attended the SEARCH “Network Investigation and Digital Triage” course contacted the instructors with assistance in building a WinFE based on Windows 8.1. The detective was given guidance and links to the various resources needed to create the WinFE8.1SE. The detective was further given assistance in adding in the utilities he would need and finally validating the build to insure that it was forensically sound.
In a follow up call, the detective indicated that the he had obtained the duplicate images he needed, with one minor modification. He found that one of the target drives was mounted through an add-in card and was not initially recognized by WinFE8.1SE. Noting that Colin Ramsden’s write protect utility allowed for adding drivers to the system, the detective located the add-in card drivers and added them to the system. WinFE8.1SE and Colin’s WP utility then recognized the additional drive and allowed mounting it read only. The detective then successfully obtained duplicate images of both target drives.
————————————————————————————————————————
As a side note, consider that WinFE started with Troy Larson typing out a 2-page Microsoft Word document on changing registry values in a winPe to get a winFe. That little idea is now taught at local, state, and federal agencies as well as public/private education and training courses. Basically, it’s is use by many. This success story is neat because it shows how easy it is to add a driver on-the-fly. You don’t need much technical experience to use Colin’s app to add drivers or toggle hard drives. We beat it up pretty good to get it right; Colin is one of those extremely competent software writers and I am glad he helped out the WinFE project.
Got a success story? Send it to me and I’ll share the word.
View the full article
