My last live WinFE (train-the-trainer) class starts in less than 1 hour! Then no more until this time next year at the earliest. However, the OnDemand version will be up later this week. It will be the same content, much of it from the live class. Here are some quick notes:
Special offer:
For anyone who missed the first offer, you have a chance at the second (and last) offer of the year.
- The WinFE Certification will be open through Friday, July 28 for $145.
- The WinFE Train-the-Trainer will be open through Friday, July 28, for $125.
- The WinFE book will be available on Amazon for $29.99.
Get all three for only $299.99 $145 until Friday, July 28 with 6 months of access to both courses, plus free shipping of your free printed copy of the 200+ page WinFE book.
Register here: https://courses.dfir...offers/zF2Cgb4B
Why Training for WinFE?
You don’t need this training to build or use WinFE. There are plenty of YouTube videos and instructions that you can find online for that. I even gave away free training for thousands of WinFE users years ago on how to build WinFE. This current training is for those who want to know all that they need to know, not what they learned in a few minutes in a forensic course that mentions WinFE or watched someone build on YouTube. This training is for those who want documented proof of having been instructed in the ‘why’, ‘when’, and ‘how’ of WinFE so that they can testify and write about successfully completing formal training in a tool used for initial acquisition.
If you want to teach others to use WinFE, you don’t need the Train-the-Trainer course. This course is for those who teach professionally, those who give on-the-job training to new hires, and those who want documentation that they know what to teach to effectively build and use the WinFE.
Do not take this course if you do not want to build and test your WinFE.
Why WinFE?
You never need to know how to build or use a WinFE. There are commercial versions of Windows boot operating systems that are forensically sound that anyone can buy. For $500, you can have a pre-built, vendor-backed, dongle-protected, forensic Windows operating boot system. WinFE is for those who want complete control over their forensic boot system, for free, developed internally by Microsoft’s Troy Larson, that can be built in less than 10 minutes, without the restriction of use with a dongle, and can be modified and customized as desired, and is used by tens of thousands of examiners.
I understand that spending $500 on a pre-built, forensically sound, Windows operating bootable system can be a reasonable choice, even if you just need to use it once. But for everyone else, WinFE is for those who do not want to be tied to a dongle, or be tied to a license that gets closer to renewal fees by the day, or as a tool purchase expense that may be used so infrequently that it is painful to see sitting in the desk drawer gathering dust.
To be clear and transparent, WinFE is not the end-all-be-all forensic tool. It is actually so limited in use that you may not even remember that it exists. But I promise that one day you will encounter a device if you do this job long enough, where WinFE is probably the only solution or at least the least expensive and quickest solution to acquiring the data.
Why Train-the-Trainer?
I’ve seen too many people teach WinFE and only focus on ‘building’ WinFE, and even building it incorrectly where it is not booting forensically. I’ve heard first-hand of users getting grilled in depositions and trials on not knowing anything about WinFE other than it is ‘forensically sound’ but couldn’t explain anything else. The training in WinFE is sporadic and many times restricted to law enforcement only. Most other times, WinFE is mentioned as a side note in a forensic training course, but little beyond that. It is not a commercial tool, therefore, you are on your own to find real training on it.
The end result is that without training, you are flying by the seat of your pants, hoping to never get called out on a tool that you learned from YouTube and then used in a legal matter.
Me teaching WinFE by myself only goes so far. My initial goal was to push WinFE out as much as possible so that I could use it with confidence as a commonly used forensic tool in my cases when needed. I think I did that over the past decade and a half. But I also see the value in having more formally trained users who can teach WinFE to go out and teach it. The more users there are, then the more uses that someone may come up with. And the money that can be saved on one tool in your toolbox can be used toward buying a different-purpose forensic tool.
Why am I backing away from giving continual training with this last offer?
Here are the numbers that I can show about WinFE users and training, based solely on me.
- Over 7,000 trained WinFE users from 2014 – 2023 in online/ondemand training
- Over 300 trained WinFE users from 2014 classroom training
- Over 15,000 downloads of WinFE online guides that I have written
- Over 2,000 downloads of the current WinFE guide in PDF that I gave away for free
- Over a dozen workshops showing how to build/use WinFE (conferences, high-tech group meetings, etc..)
I use the word “over” since the numbers are still increasing, except for classroom training and workshops. My hope is that with this Train-the-Trainer course, and a complete WinFE Certification course, and a comprehensive book on WinFE there will be some, or maybe many, that will be able to take WinFE forward beyond what has been done.
Register here: https://courses.dfir...offers/zF2Cgb4B
View the full article
