WinFE - Revision history

Joachim Metz at 10:46, 28 July 2012

2012-07-28T10:46:07Z

2012-07-28T10:45:45Z

‎Windows Forensic Environment ("WinFE")

2012-07-28T10:45:30Z

‎Windows Forensic Environment ("WinFE")

2012-07-28T10:44:27Z

2012-07-28T10:44:16Z

2012-07-28T10:44:03Z

2012-07-17T17:02:57Z

‎Windows Forensic Environment ("WinFE")

2012-07-17T16:14:55Z

‎Windows Forensic Environment ("WinFE")

2012-07-17T16:14:03Z

‎Resources:

2012-07-17T16:13:22Z

‎Windows Forensic Environment ("WinFE")

← Older revision		Revision as of 10:46, 28 July 2012
Line 10:		Line 10:

	'''Windows Forensic Environment''' - a forensically sound bootable CD/USB to acquire electronic media or conduct forensic analysis.		'''Windows Forensic Environment''' - a forensically sound bootable CD/USB to acquire electronic media or conduct forensic analysis.
−

	== Windows Forensic Environment ("WinFE") ==		== Windows Forensic Environment ("WinFE") ==

@@ Line 19: / Line 19: @@
 WinFE can also be configured to boot from a USB device, should the evidence computer have the ability to boot to USB.
-WinFE can be customized to the examiner's needs through batch files using the Windows Automated Install Kit (WAIK) or through 3rd party utilities such as WinBuilder ([http://reboot.pro]).
+WinFE can be customized to the examiner's needs through batch files using the Windows Automated Install Kit (WAIK) or through 3rd party utilities such as WinBuilder [http://reboot.pro].
 Some examples of Windows based forensic utilities that can run in the Windows Forensic Environment include:

@@ Line 28: / Line 28: @@
 * RegRipper [http://www.RegRipper.wordpress.com].
-A write protection tool developed by Colin Ramsden was released in 2012 that provides a GUI for disk toggling ([http://www.ramsdens.org.uk/]).  Colin Ramsden's write protect tool effectively replaces the command line to toggle disks on/offline or readonly/readwrite.
+A write protection tool developed by Colin Ramsden was released in 2012 that provides a GUI for disk toggling [http://www.ramsdens.org.uk/].  Colin Ramsden's write protect tool effectively replaces the command line to toggle disks on/offline or readonly/readwrite.
 == Technical Background and Forensic Soundness ==

@@ Line 14: / Line 14: @@
 == Windows Forensic Environment ("WinFE") ==
-WinFE was developed and researched in 2008 by Troy Larson, Sr Forensic Examiner and Research at Microsoft([http://www.twine.com/item/113421dk0-g99/windows-fe].  WinFE is based off the Windows Pre-installation Environment of media being Read Only by default.
+WinFE was developed and researched in 2008 by Troy Larson, Sr Forensic Examiner and Research at Microsoft [http://www.twine.com/item/113421dk0-g99/windows-fe].  WinFE is based off the Windows Pre-installation Environment of media being Read Only by default.
 It works similar to Linux forensic CDs that are configured not to mount media upon booting.
 However, unlike Linux boot CDs, with Win FE one can use Windows based software. Thus it is possible to include various forensic software and general portable utilities.

@@ Line 2: / Line 2: @@
    name = Windows Forensic Environment |
    maintainer = [[Windows Forensic Environment Project]] |
-   os = {{Linux}} |
+   os = {{Windows}} |
    genre = {{Live CD}} |
    license = unknown |

← Older revision		Revision as of 10:44, 28 July 2012
Line 1:		Line 1:
		+	{{Infobox_Software \|
		+	name = Windows Forensic Environment \|
		+	maintainer = [[Windows Forensic Environment Project]] \|
		+	os = {{Linux}} \|
		+	genre = {{Live CD}} \|
		+	license = unknown \|
		+	website = http://winfe.wordpress.com \|
		+	}}
		+
		+
	'''Windows Forensic Environment''' - a forensically sound bootable CD/USB to acquire electronic media or conduct forensic analysis.		'''Windows Forensic Environment''' - a forensically sound bootable CD/USB to acquire electronic media or conduct forensic analysis.

@@ Line 16: / Line 16: @@
 * Guidance Software Encase [http://www.guidancesoftware.com],
 * ProDiscover [http://www.techpathways.net],
-* RegRipper [http://www.RegRipper.net].
+* RegRipper [http://www.RegRipper.wordpress.com].
 A write protection tool developed by Colin Ramsden was released in 2012 that provides a GUI for disk toggling ([http://www.ramsdens.org.uk/]).  Colin Ramsden's write protect tool effectively replaces the command line to toggle disks on/offline or readonly/readwrite.

← Older revision		Revision as of 16:14, 17 July 2012
Line 37:		Line 37:
	* WinPE Technical Reference: [http://technet.microsoft.com/en-us/library/dd744322(WS.10).aspx]		* WinPE Technical Reference: [http://technet.microsoft.com/en-us/library/dd744322(WS.10).aspx]
	* Windows Automated Installation Kit: [http://www.microsoft.com/downloads/details.aspx?familyid=696DD665-9F76-4177-A811-39C26D3B3B34&displaylang=en]		* Windows Automated Installation Kit: [http://www.microsoft.com/downloads/details.aspx?familyid=696DD665-9F76-4177-A811-39C26D3B3B34&displaylang=en]
		+	* WinFE Write Protect tool [http://www.ramsdens.org.uk/]

@@ Line 18: / Line 18: @@
 * RegRipper [http://www.RegRipper.net].
-A write protection tool developed by Colin Ramsden was released in 2012 that provides a GUI for disk toggling (http://www.ramsdens.org.uk/).  Colin Ramsden's write protect tool effectively replaces using the command line to toggle disks on/offline or readonly/readwrite.
+A write protection tool developed by Colin Ramsden was released in 2012 that provides a GUI for disk toggling ([http://www.ramsdens.org.uk/]).  Colin Ramsden's write protect tool effectively replaces using the command line to toggle disks on/offline or readonly/readwrite.
 == Technical Background and Forensic Soundness ==