WinFE: Windows Bootable Forensic CD

I've been using the Helix incident response and forensics LiveCD since it was first created. It has been an invaluable tool, but sometimes it falls short on hardware support for various SATA/SAS and RAID controllers. In those situations, creating a forensic image came down to a "best effort" exercise during which I did my best to prevent modification to the original evidence while still getting an image I could analyze later. WinFE is here to help.WinFE, or Windows Forensic Environment, is a Windows PE- (Preinstallation Environment) based tool that is essentially a Windows-based bootable CD with two small Registry changes that prevent hard drives from being mounted during boot time. Once booted, the included "diskpart" command is used to mount hard drives read-only for imaging. Additionally, forensic tools, such as Encase, WinHex Forensics, and FTK Imager, can be run from the CD.

Sounds great, right? You're probably asking why you haven't heard about this before. According to an entry on the blog "Forensics from the sausage factory," instructions for creating WinFE were available only from the Microsoft Law Enforcement Portal. It turns out the instructions have been publicly available online since April 2008 and have gone largely unnoticed. Through a series of links forwarded by a friend, I ended up on this page that included a link to a Word document providing a step-by-step guide on how to build your own WinFE disk.

How easy is it, you ask? It took me less time to build the CD than it took to download the necessary tools to built it (i.e., Automated Installation Kit for Windows Vista SP1 and Windows Server 2008). In about 10 minutes max, I had a working WinFE ISO that I booted in VMware Fusion and was able to image the virtual disks using FTK Imager. The hardest part of the build process for shops will be to find and include the proper hardware driver for the SAS, SATA, or RAID controller.

WinFE is definitely a tool I'll be testing more in the future and will probably add to my arsenal of incident response and forensic tools. I think it's going to help open options to Windows-based IT shops that have been reluctant to use the Linux-based Helix CD.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.