Windows Forensic Environment (WinFE) (@WindowsFE) header
Windows Forensic Environment (WinFE) (@WindowsFE) profile picture

Windows Forensic Environment (WinFE)

@WindowsFE

Forensically boot evidence machines with a Windows Forensics Operating System! Now boots into ARM devices. #DFIR

winfe.wordpress.com
Joined May 2013
  • Tweets675
  • Following0
  • Followers5.1K
112Media
Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)
My last writing on #WinFE. Probably. brettshavers.com/my-last-wri… #dfir
My last writing on WinFE. Probably.

My last writing on WinFE. Probably.

WinFE, AI, and the End of the Difficult Build For years, one of the biggest obstacles to using the Windows Forensic Environment (WinFE) was building it. Using WinFE is easy to use but difficult to …

brettshavers.com
1
6
34
1,760
Windows Forensic Environment (WinFE) retweeted
SalvationDATA Technology (@salvationdata) profile picture
SalvationDATA Technology@salvationdata20 Mar 2025
Forensic Tips💡 Investigator's Favorite Little Windows: WinFE WinFE is, at its core level, a modified version of the Windows Pre-installation Environment (PE) modified for forensics examiners. matthewplascencia.substack.c… #Forensics #DigitalForensics #investigators #DFIR #Tips #TechnologyNews
1
4
139
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalRecon9 Dec 2025
Our latest in-person training “Windows Arm-on-Arm (WoA) Virtualization for Digital Forensics Practitioners” debuted last week, covering why we launch VMs from disk images (& actual & remotely-connected disks), peculiarities w/ WoA vs. x64, WinFE, BitLocker, S Mode, & more. #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
8
745
Someone recently emailed me that "WinFE was the new 'planting tool' that LE uses to plant evidence in acquisitions. This person claims cases where innocent people have been convicted because of WinFE misuse. Yet, for all these claimed cases, won't name a single one for me...
1
5
458
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconSep 25
ARMWinFE & AIM Remote Agent in action!
Arsenal Recon (@ArsenalRecon) profile pictureArsenal Recon@ArsenalReconSep 25
Have you considered building WinFE on Arm (a/k/a ARMWinFE) or perhaps tried, but were unsuccessful? Check out the first draft of our guide "Using Windows x64 to Build ARMWinFE with AIM Remote Agent." ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
7
1,142
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconSep 25
Check out the first draft of our guide "Using Windows x64 to Build IntelWinFE with AIM Remote Agent" & please let us know if you have any suggestions! ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
9
1
17
1,153
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversSep 9
AI can generate 20,000 lines of code faster than you can misunderstand the first 200.
You suck at DFIR if you’re vibe-coding forensic apps.

You suck at DFIR if you’re vibe-coding forensic apps.

Article · @brettshavers
2
3
1
13
1,259
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconAug 5
Did you know that the latest Arsenal Image Mounter exposes BitLocker metadata in Free Mode that is unavailable from manage-bde & elsewhere? Check out these screenshots to see some examples made possible by our new BitLocker library. ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
6
533
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconAug 5
Arsenal Image Mounter v3.13.368 just released with even more powerful & unique BitLocker functionality (Free & Professional Modes!) thanks to a new BitLocker library developed by Joakim Schicht & many late nights from Olof Lagerkvist. ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
1
8
9
1,353
Take a look at this WinFE Builder: github.com/4n6Wizard/WinFEBu… by @4n6Wizard
Image from Windows Forensic Environment (WinFE) (@WindowsFE)
4
18
2,129
S2 E6: Brett Shavers and the Investigative Mindset youtu.be/F1pc7SmI1s8?si=nHnL… via @YouTube
S2 E6: Brett Shavers and the Investigative Mindset

S2 E6: Brett Shavers and the Investigative Mindset

This episode with Brett Shavers explores why the most important ski...

youtube.com
1
6
721
Creating a Fuji/WinFE external drive malwaremaloney.blogspot.com/…
Image from Windows Forensic Environment (WinFE) (@WindowsFE)
1
5
23
1,181
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jul 14
It's now on Kindle! amzn.to/4ymMjj5
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
10
877
Windows Forensic Environment (WinFE) retweeted
X-Ways Forensics Practitioners Guide/2E (@XWaysGuide) profile picture
X-Ways Forensics Practitioners Guide/2E@XWaysGuideJul 13
You have until Friday. And only a few will be able to get it. xwaysforensics.wordpress.com… #DFIR
The X-Ways Forensics Practitioner’s Course Is Retiring

The X-Ways Forensics Practitioner’s Course Is Retiring

Retiring the practitioner’s guide? More than a decade ago, I delivered the first version of the X-Ways Forensics Practitioner’s course for $148. Since then, the course has gone through multip…

xwaysforensics.wordpress.com
3
2
8
2,933
Boot carefully. Collect carefully. Think harder. linkedin.com/pulse/ai-have-p…
AI Will Have to Pry Judgment from my Cold, Dead Hands

AI Will Have to Pry Judgment from my Cold, Dead Hands

AI is not waiting outside your front door for permission. It is already inside your kitchen and eating your lunch.

linkedin.com
5
630
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 29
SCOTUS just ruled that grabbing your Location History via geofence is a Fourth Amendment search. supremecourt.gov/opinions/25…
5
1
6
552
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jun 24
In 3 hours. suspectbehindthekeyboard.com… #DFIR
🤖 Made with AI
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
6
494
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 15
Attribution is not just finding evidence. ↳ It is explaining what the evidence supports, what it does not support, and what alternative explanations remain. ↳ Live, online training: June 24, 1 PM MDT. $5 registration. suspectbehindthekeyboard.com… #DFIR
Image from Brett Shavers 🙄 (@brettshavers)
3
5
404
Windows Forensic Environment (WinFE) retweeted
DFIR Training (@DFIRTraining) profile picture
DFIR Training
@DFIRTrainingMay 22
Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain. Replay included. PDF Edition of DFIR Investigative Mindset also included. Registration closes tomorrow at start of workshop. suspectbehindthekeyboard.com… #DFIR
2
1
7
809
In 3 hours!
DFIR Training (@DFIRTraining) profile pictureDFIR Training
@DFIRTrainingMay 22
Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain. Replay included. PDF Edition of DFIR Investigative Mindset also included. Registration closes tomorrow at start of workshop. suspectbehindthekeyboard.com… #DFIR
3
338
Load more