The Comprehensive WinFE Guide: Done
The WinFE Certification Course: Done
The WinFE Train-the-Trainer Course: Done
Here is the good news:
- The PDF version of the WinFE guide is included in both the Certification and the Train-The-Trainer Course.
- Completing the Train-the-Trainer Course gives you a copy of the entire training program to teach WinFE (you get the slide deck for you to modify as you see fit to fit your needs)
- Completing the Train-the-Trainer Course also gives you permission to distribute the PDF version of the WinFE guide to those who you teach. You have to pass the Cert course to be eligible for the Train-the-Trainer course.
- The hard copy of the WinFE guide is on Amazon (it may take a day or two before Amazon changes from ‘out of print’ to ‘in print’).
Here is the other news:
There are enough people that signed up for the Train-the-Trainer course that this should create many avenues for everyone to find WinFE training in their organization or elsewhere from those completing the Train-the-Trainer course. With that, both this WinFE Cert and the Train-the-Trainer course will have restricted access for 6 months for those who have signed up currently. Within the next few weeks, I will close at a certain point in August 2023, and no more registrations until an updated course is created.
After that, I might have an updated version of both courses in 2024 or 2025, depending on if any changes to WinFE would support an updated course. I don’t see any changes that could be made as WinFE boots forensically, it has an awesome write-protect application, and it is super easy to build. What more can be improved or changed?
If you want to take WinFE training from me, be sure to sign up before all registrations are closed for both courses. Otherwise, I hope to see more WinFE training being given everywhere from those who complete the WinFE Train-The-Trainer course.
WinFE job skill
One measure of whether (1) WinFE is community-accepted, (2) is a valid forensic tool, and (3) is a desirable skill to have is to check DFIR job listings. This one (https://www.linkedin...iew/3677288952/) seen today lists WinFE in the job description. Very cool!
A course review
Ken Pryor wrote a very kind review of the Cert course that you can find here: https://digiforensic...eview.html?lr=1
“As you can tell, I was very pleased with this class. The instruction from Brett was top-notch. He provided the information based on his own developing and usage experience. He does an outstanding job covering each topic. I didn’t come away from any of the lessons feeling like he left anything out. If you have the interest, I highly encourage you to take this course.” – Ken Pryor
WinFE’s Next Steps
From Troy Larson’s baby to desirable traits in getting hired, WinFE has come a long way. I have used WinFE in more cases than I can remember to collect first-evidence, as have many many others. Although the usage has declined due to technology changes (some systems can’t be booted to external media), those that still can be accessed with bootable media can only be accessed with something “like” WinFE, especially the ARM devices.
Of so many open-source, free, and commercial tools, WinFE is one of the free tools that has been around for over 15 years, at no cost, employed in the private sector, public sector, military, and intel agencies, and still in active use. It has been beaten for years in trying to break it to prove forensic soundness for years by many. Finally, there is formal training in using it and teaching it.
This is very very cool. And now my job is done* 
*but not really…I’m not going anywhere!
View the full article
