Windows Forensic Environmnent - based on WinPE. This project has been developed to create a simplified method for building a Windows Forensic Environmnet (WinFE) for digital forensic acquisitions. Full documentation is included in the project download and on the following website - http://winfe.mistyprojects.co.uk/.
Download the project by selecting the required branch > click on the 'Code' button > select 'Download ZIP'. Alternatively, download from the following location(s) -
- main branch - http://winfe.mistyprojects.co.uk/Mini-WinFE-main.zip
- WinPE branch - http://winfe.mistyprojects.co.uk/Mini-WinFE-WinPE.zip
All you require to create a WinFE in a matter of minutes is the Mini-WinFE download, a Windows Source DVD (or mounted disc image) and any of the third party applications you want to include in the build - the WAIK or ADK is not required.
Supported applications include -
- DMDE (included)
- Forensic Acquisition Utilities (included)
- FTK Imager (copy from local installation)
- HWiNFO (included)
- NT Password Edit (included)
- Opera (included)
- Sumatra PDF Reader (included)
- WinHex (copy from local installation)
- X-Ways Forensics (copy from local installation)
- Write Protect Tool (included)
Any of the following 32-bit and 64-bit Windows sources can be used -
- Windows 7
- Windows 7 (SP1)
- Windows Server 2008 R2 SP1
- Windows 8
- Windows 8.1
- Windows 8.1 Update
- Windows 10
- Windows 11
Mini-WinFE is based on Windows Preinstallation Environment, with a digital forensic focus. SysWOW64 is supported in 64-bit builds, allowing the use of some 32-bit Windows applications.
WinBuilder and PEBakery version 0.9.5.1 beta5 are included in the download - please note that this version of PEBakery has a .NET 4.7.1 dependency.
The Mini-WinFE project has also been tested using PEBakery version 1.0.0 (Standalone (x64): PEBakery-v1.0.0-sc_x64.7z).
WinXShell
LaunchBar Shell
BBLean Shell
