Comments on: WinPE 3.0 & Forensics

By: WinPE v3.0 – Platinum Tools «

WinPE v3.0 – Platinum Tools « — Mon, 06 Feb 2012 00:50:26 +0000

[...] answer has come from a this site, to edit the registry hive from regedit itself. Here is how I have done it (thus [...]

By: AllAboutDataRec

AllAboutDataRec — Wed, 15 Dec 2010 12:00:16 +0000

Thanks. Definately going to try this.

By: ELDI

ELDI — Mon, 08 Nov 2010 20:31:51 +0000

I make this small program in java for use the Dism.exe present in Windows 7 with GUI or Visual Mode,

Download Link: GDism ELDI v2.2 Final: mediafire : ?uvxd4dk6kuv9ian (...fire.com/?uvx...) Commands you can use on GUI or Visual Mode: * Mount-Wim * Commit-Wim * Unmount-Wim * Get-WinInfo * Get-MountedWinInfo * CleanUp-Wim * Get-Packages * Add-Package * Remove-Package * Get-Drivers * Get-DriverInfo * Add-Driver * Remove-Driver * Make ISO You must need the JRE installed (Java Runtime Enviroment).

@ByELDI

v2.2 Progress Bar Time Counter

v2.1 Fixed iso making Menu translated Button Cancel Process

v2.0 Better Interface for results text Make iso image with oscdimg Support WAIK Support x64 Better Config File Size reduced

v1.4 Fixed Process on wait list Config File

v1.3 Translate English-Espanol Multiples Process Waiting

v1.2 Fixed Drivers Functions

http://www.mediafire.com/?uvxd4dk6kuv9ian

By: উইন্ডোজের পাসওয়ার্ড ভুললে করণীয় « Computer Tips & Tricks

উইন্ডোজের পাসওয়ার্ড ভুললে করণীয় « Computer Tips & Tricks — Sat, 04 Sep 2010 17:25:48 +0000

[...] WinPE 3.0 & Forensics (praetorianprefect.com) [...]

By: Brett Shavers

Brett Shavers — Tue, 13 Jul 2010 15:26:21 +0000

You definitely started something (your wish has been granted…).

By: Troy

Troy — Sat, 03 Jul 2010 03:06:16 +0000

Thanks.

I have held off on publishing Windows FE 3 instructions while I was researching some differences in volume mounting behavior between Vista and Windows 7. However, it was always my wish that the forensics community build on Windows FE--that is why I only put out the most basic instructions.

By: Brett Shavers

Brett Shavers — Sat, 29 May 2010 23:40:28 +0000

I’ve received enough requests about WinFe and a batch file to put it online at; http://winfe.tk/ Feel free to use the information and download the batch file and notes as needed. Most everyone that tried WinFE, says they won’t use anything else ;)

By: Brett Shavers

Brett Shavers — Thu, 20 May 2010 01:55:07 +0000

The tools only need to be copied to the folder. FTK Imager needs a dll file copied from your computer to the mounted wim image (instructions are on the writeup at: http://www.forensicfocus.com/downloads/WinFE.pdf

To make it easier for you, I can send you a shared folder link to download the batch file that does it all for you, from start to finish. Just let me know which email address you’d like the link (or anyone else that’d like the batch file, send me your email, I’ll send the link to you). The batch file in the write up isn’t as complete as the one I use now.

Brett bshavers@gmail.com

By: Tom

Tom — Mon, 17 May 2010 23:45:58 +0000

Brett,

One thing I am missing is the concept of how to add tools to the \Winfe folder. I would like to start with something simple like FTK Imager.

Can you help or provide some direction? I would really like to try this as proof as concept before jumping ship to WINE.

Thanks!

By: Brett Shavers

Brett Shavers — Sat, 01 May 2010 19:53:59 +0000

And my email… bshavers@gmail.com

By: Brett Shavers

Brett Shavers — Sat, 01 May 2010 19:53:32 +0000

A potential cause could be that the files were copied onto the other .wim file. I send you a batch file that automates the entire process (send me an email so I know where to share the file). I’ve not had any problems using the batch file I wrote, you are free to use it.

By: Howard Patterson

Howard Patterson — Wed, 28 Apr 2010 18:25:19 +0000

When I have attempted this, using both a Vista SP1 and Win7 machine, the resultant iso won’t boot properly and doesn’t contain the tools I copied to the mount directory. I have used both the imagex and dism methods, and both fail.

By: Week 15 in Review – 2010 | Infosec Events

Week 15 in Review – 2010 | Infosec Events — Tue, 20 Apr 2010 03:54:14 +0000

[...] WinPE 3.0 & Forensics – praetorianprefect.com You may find this analysis interesting if you are a Windows expert performing a forensics analysis. [...]

By: Simon Price

Simon Price — Fri, 16 Apr 2010 15:40:55 +0000

Thanks Brett, I updated the post to include the link to the PDF, very nice document.

By: Brett Shavers

Brett Shavers — Fri, 16 Apr 2010 14:40:10 +0000

Nice write up on WinFE. Regarding the comment of this being too hard, I have a similar paper on WinFE that details a sample batch file that automates nearly the entire process. http://www.forensicfocus.com/downloads/WinFE.pdf

And its good to see that Windows FE is finally getting the attention I believe it deserves as a tool in the forensic toolbox.