Windows Forensic Environment (WinFE) (@WindowsFE) header
Windows Forensic Environment (WinFE) (@WindowsFE) profile picture

Windows Forensic Environment (WinFE)

@WindowsFE

Forensically boot evidence machines with a Windows Forensics Operating System! Now boots into ARM devices. #DFIR

winfe.wordpress.com
Joined May 2013
  • Tweets675
  • Following0
  • Followers5.1K
112Media
Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)Photo by Windows Forensic Environment (WinFE) (@WindowsFE)
Windows Forensic Environment (WinFE) retweeted
SalvationDATA Technology (@salvationdata) profile picture
SalvationDATA Technology@salvationdata20 Mar 2025
Forensic Tips💡 Investigator's Favorite Little Windows: WinFE WinFE is, at its core level, a modified version of the Windows Pre-installation Environment (PE) modified for forensics examiners. matthewplascencia.substack.c… #Forensics #DigitalForensics #investigators #DFIR #Tips #TechnologyNews
1
4
139
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalRecon9 Dec 2025
Our latest in-person training “Windows Arm-on-Arm (WoA) Virtualization for Digital Forensics Practitioners” debuted last week, covering why we launch VMs from disk images (& actual & remotely-connected disks), peculiarities w/ WoA vs. x64, WinFE, BitLocker, S Mode, & more. #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
8
745
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconSep 25
ARMWinFE & AIM Remote Agent in action!
Arsenal Recon (@ArsenalRecon) profile pictureArsenal Recon@ArsenalReconSep 25
Have you considered building WinFE on Arm (a/k/a ARMWinFE) or perhaps tried, but were unsuccessful? Check out the first draft of our guide "Using Windows x64 to Build ARMWinFE with AIM Remote Agent." ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
7
1,142
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconSep 25
Check out the first draft of our guide "Using Windows x64 to Build IntelWinFE with AIM Remote Agent" & please let us know if you have any suggestions! ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
9
1
17
1,153
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversSep 9
AI can generate 20,000 lines of code faster than you can misunderstand the first 200.
You suck at DFIR if you’re vibe-coding forensic apps.

You suck at DFIR if you’re vibe-coding forensic apps.

Article · @brettshavers
2
3
1
13
1,259
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconAug 5
Did you know that the latest Arsenal Image Mounter exposes BitLocker metadata in Free Mode that is unavailable from manage-bde & elsewhere? Check out these screenshots to see some examples made possible by our new BitLocker library. ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
6
533
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalReconAug 5
Arsenal Image Mounter v3.13.368 just released with even more powerful & unique BitLocker functionality (Free & Professional Modes!) thanks to a new BitLocker library developed by Joakim Schicht & many late nights from Olof Lagerkvist. ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
1
8
9
1,353
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jul 14
It's now on Kindle! amzn.to/4ymMjj5
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
10
877
Windows Forensic Environment (WinFE) retweeted
X-Ways Forensics Practitioners Guide/2E (@XWaysGuide) profile picture
X-Ways Forensics Practitioners Guide/2E@XWaysGuideJul 13
You have until Friday. And only a few will be able to get it. xwaysforensics.wordpress.com… #DFIR
The X-Ways Forensics Practitioner’s Course Is Retiring

The X-Ways Forensics Practitioner’s Course Is Retiring

Retiring the practitioner’s guide? More than a decade ago, I delivered the first version of the X-Ways Forensics Practitioner’s course for $148. Since then, the course has gone through multip…

xwaysforensics.wordpress.com
3
2
8
2,933
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 29
SCOTUS just ruled that grabbing your Location History via geofence is a Fourth Amendment search. supremecourt.gov/opinions/25…
5
1
6
552
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jun 24
In 3 hours. suspectbehindthekeyboard.com… #DFIR
🤖 Made with AI
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
6
494
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 15
Attribution is not just finding evidence. ↳ It is explaining what the evidence supports, what it does not support, and what alternative explanations remain. ↳ Live, online training: June 24, 1 PM MDT. $5 registration. suspectbehindthekeyboard.com… #DFIR
Image from Brett Shavers 🙄 (@brettshavers)
3
5
404
Windows Forensic Environment (WinFE) retweeted
DFIR Training (@DFIRTraining) profile picture
DFIR Training
@DFIRTrainingMay 22
Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain. Replay included. PDF Edition of DFIR Investigative Mindset also included. Registration closes tomorrow at start of workshop. suspectbehindthekeyboard.com… #DFIR
2
1
7
809
Windows Forensic Environment (WinFE) retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversMay 22
AI Found It. You Prove It. Forensics first. AI second. 90 minutes. 90-day replay. PDF edition of DFIR Investigative Mindset included. Registration closes tomorrow at the start of the workshop: May 22. 11AM Mountain time. AI can help find things. You still have to prove them. Register here: suspectbehindthekeyboard.com… #DFIR
Image from Brett Shavers 🙄 (@brettshavers)
4
5
484
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6May 21
Want the foundation in keeping your value against AI? With your registration, you get a PDF version of my book, DFIR Investigative Mindset. Registration ends at 11AM MDT, May 22. suspectbehindthekeyboard.com…
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
3
376
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6May 21
If AI can summarize your report, draft your timeline, and explain your artifacts faster than you, how much longer will you be paid to do DFIR? 90-minute live workshop tomorrow. AI Found It. You Prove It. 11am Mountain time 90 day replay. Registration closes tomorrow. Register: suspectbehindthekeyboard.com… #DFIR
1
5
6
446
Windows Forensic Environment (WinFE) retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jan 23
You keep taking DFIR tool classes and STILL not improving your CASEWORK? Spend a day with me and I'll help you break through the barrier to become the most effective DFIR practitioner. You have the talent. You have the software. You just need a system. suspectbehindthekeyboard.com… #DFIR
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
3
5
607
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalRecon1 Nov 2025
Check out our latest Insights article "Quick Tour Of New Features In Arsenal Image Mounter v3.12.331" to see highlights (lots of screenshots!) of the latest AIM functionality: arsenalrecon.com/insights/qu…. #DFIR
Image from Arsenal Recon (@ArsenalRecon)
4
10
2,504
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalRecon31 Oct 2025
Did you know that AIM Remote Agent can be run from @SUMURIForensics PALADIN? See Anastasia boot a Surface Pro 5 w/ two 512gb drives, connect both drives to AIM across a network (w/ automatic Storage Spaces reassembly), & launch a virtual machine. ArsenalRecon.com #DFIR
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
2
5
786
Windows Forensic Environment (WinFE) retweeted
Arsenal Recon (@ArsenalRecon) profile picture
Arsenal Recon@ArsenalRecon27 Oct 2025
Do you have a #DFIR workstation running Windows on Arm? If you don’t now, you may soon after checking out Arsenal Image Mounter’s new Arm on Arm virtualization. While waiting on the Snapdragon X2 Elite, we're using a Dell XPS 13 (X Elite) with 64gb RAM. ArsenalRecon.com
Image from Arsenal Recon (@ArsenalRecon)
Image from Arsenal Recon (@ArsenalRecon)
3
8
875
Load more