Sounds great, right? You're probably asking why you haven't heard about this before. According to an entry on the blog "Forensics from the sausage factory," instructions for creating WinFE were available only from the Microsoft Law Enforcement Portal. It turns out the instructions have been publicly available online since April 2008 and have gone largely unnoticed. Through a series of links forwarded by a friend, I ended up on this page that included a link to a Word document providing a step-by-step guide on how to build your own WinFE disk.
How easy is it, you ask? It took me less time to build the CD than it took to download the necessary tools to built it (i.e., Automated Installation Kit for Windows Vista SP1 and Windows Server 2008). In about 10 minutes max, I had a working WinFE ISO that I booted in VMware Fusion and was able to image the virtual disks using FTK Imager. The hardest part of the build process for shops will be to find and include the proper hardware driver for the SAS, SATA, or RAID controller.
WinFE is definitely a tool I'll be testing more in the future and will probably add to my arsenal of incident response and forensic tools. I think it's going to help open options to Windows-based IT shops that have been reluctant to use the Linux-based Helix CD.
John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.