X-Ways Forensics runs in the new WinFE 10


Here is the WinFE website with build instructions: www.winfe.net .

Brief overview of some details that may be helpful to know

Developed by Troy Larson of Microsoft in 2008, further developed into a GUI build (WinBuilder) by a number of developers in 2009, with a great write protect tool written by Colin Ramsden in 2012, noted in digital forensic books such as Computer Forensics InfoSec Pro Guide and Computer Forensics and Investigations , taught by FLETC , SEARCH , IACIS , and DFIR Training , documented in dozens of blogs and magazines, WinFE has become a widely accepted and commonly used digital forensics tool. And now you can boot an ARM device and image it with WinFE 10.

Windows Forensic Environment Training available

Typically, WinFE has mostly been law enforcement or association-membership only. Actually, there are no training courses outside of government training. Government training courses have been provided by IACIS, SEARCH, ICAC, NW3C, and FLETC.

The only non-government course is the Windows Forensic Environment online course created in 2014 and updated today with WinFE 10. I’m not counting YouTube videos as formal, documented training…neither should you (please do not put, “I learnt forensics on YouTube” on your court CV…). This course was created by one who has been involved in WinFE development from shortly after it’s initial inception (that’s me!).

Side note : I have a short promo of 60% off the Windows Forensic Environment course for the first 100 people.   Completing the entire course gets you 6 hours of formal, documented training, which is way better to put on your training records than watching a YouTube ‘training’ video. So, if you use WinFE, and want documented proof of training from one of the original developers, here you go!

Registration: $125

Promo code:  WINFE10 (60% off for $50)

Website: http://courses.dfironlinetraining.com/windows-forensic-environment-winfe

Promo Expires:January 31, 2020 or at the 100 th registration , whichever is first.

Hours: 6

Access: 1 month. 24/7 on demand


WinFE Cheats Guide

In a few days, you will see an updated WinFE Cheats Guide available on Amazon.com. Currently, the guide available doesn’t have the WinFE 10 information, but when you see the new cover “Includes WinFE 10” , that will be the updated guide should you wish to purchase the only book in print that focuses only on WinFE. https://www.amazon.com/Ultimate-Cheats-Windows-Forensic-Environment/dp/1790322782


Author: Brett Shavers

http://www.amazon.com/author/brettshavers https://www.brettshavers.com https://www.dfir.training

2 thoughts on “X-Ways Forensics runs in the new WinFE 10”

  1. Hi Brett,

    I am always a sucker for discounted training and I like supporting your efforts! I noticed that after I purchase the course, I realized already taken the WinFE course back in 2014. I presume all this material is revamped, updated and newish? At least it appears that way to me. Another silly request: If I need an extension till mid March to complete the course is this possible? I can bore you with details and reasons why, but I figure I would ask first.

    Two other items to run by you: 1. Forensic Operating Systems training: Please let me know when this becomes available (not as Patreon) but as in purchase and access for a period of time.

    2. XWF Book Part 2: If you need a technical reviewer for the book please let me know. Specifically something to consider for the new book is how to effectively use Simultaneous Searching for keyword searches for specific word content or part of text content that for example an investigator observes in a letter or message. I will send a more detailed explanation of this in another email.

    Kind regards, Shafik Punja

    On Mon, 13 Jan 2020 at 16:01, X-Ways Forensics Practitioner’s Guide wrote:

    > Brett Shavers posted: “TL:DR Here is the WinFE website with build > instructions: http://www.winfe.net . Brief overview of some details that may be > helpful to know Developed by Troy Larson of Microsoft in 2008, further > developed into a GUI build (WinBuilder) by a number of develope” >

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: