Windows Forensic Environment (WinFE)

Forensically boot evidence machines with a Windows Forensics Operating System! Now boots into ARM devices. #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

@DFS_JasonJ Surprisingly, he really works in the legal side of DFIR doing forensics.

[Windows Forensic Environment (WinFE) @WindowsFE]

Someone recently emailed me that "WinFE was the new 'planting tool' that LE uses to plant evidence in acquisitions.

This person claims cases where innocent people have been convicted because of WinFE misuse.

Yet, for all these claimed cases, won't name a single one for me...

[Arsenal Recon @ArsenalRecon]

ARMWinFE & AIM Remote Agent in action!

[Arsenal Recon @ArsenalRecon]

Check out the first draft of our guide "Using Windows x64 to Build IntelWinFE with AIM Remote Agent" & please let us know if you have any suggestions! https://t.co/w8v2JqX7rn #DFIR

[Brett Shavers 🙄 @brettshavers]

AI can generate 20,000 lines of code faster than you can misunderstand the first 200. https://t.co/gopMAarG4K

[Arsenal Recon @ArsenalRecon]

Did you know that the latest Arsenal Image Mounter exposes BitLocker metadata in Free Mode that is unavailable from manage-bde & elsewhere? Check out these screenshots to see some examples made possible by our new BitLocker library. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Arsenal Image Mounter v3.13.368 just released with even more powerful & unique BitLocker functionality (Free & Professional Modes!) thanks to a new BitLocker library developed by Joakim Schicht & many late nights from Olof Lagerkvist. https://t.co/w8v2JqX7rn #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

Take a look at this WinFE Builder: https://t.co/qwUg20pw84 by @4n6Wizard

[Windows Forensic Environment (WinFE) @WindowsFE]

S2 E6: Brett Shavers and the Investigative Mindset https://t.co/yLMPFl3dip via @YouTube

[Windows Forensic Environment (WinFE) @WindowsFE]

Creating a Fuji/WinFE external drive
https://t.co/axHQxfATwS

[Placing the Suspect Behind the Keyboard @PSBK4n6]

It's now on Kindle!
https://t.co/P54d2iyFI0

[X-Ways Forensics Practitioners Guide/2E @XWaysGuide]

You have until Friday. And only a few will be able to get it.
https://t.co/koA7ypDU0M #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

Boot carefully. Collect carefully. Think harder. https://t.co/iuIbYvE27F

[Brett Shavers 🙄 @brettshavers]

SCOTUS just ruled that grabbing your Location History via geofence is a Fourth Amendment search.
https://t.co/3PpQgaqdLq

[Placing the Suspect Behind the Keyboard @PSBK4n6]

In 3 hours.
https://t.co/QKtgQ0J711 #DFIR

[Brett Shavers 🙄 @brettshavers]

Attribution is not just finding evidence.

↳ It is explaining what the evidence supports, what it does not support, and what alternative explanations remain.

↳ Live, online training: June 24, 1 PM MDT. $5 registration. https://t.co/hb7XuAr7lw #DFIR

[DFIR Training @DFIRTraining]

Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain.
Replay included. PDF Edition of DFIR Investigative Mindset also included.
Registration closes tomorrow at start of workshop.
https://t.co/MIFB9GFa98 #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

In 3 hours!

[DFIR Training @DFIRTraining]

Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain.
Replay included. PDF Edition of DFIR Investigative Mindset also included.
Registration closes tomorrow at start of workshop.
https://t.co/MIFB9GFa98 #DFIR

[Brett Shavers 🙄 @brettshavers]

AI Found It. You Prove It.
Forensics first. AI second.
90 minutes. 90-day replay. PDF edition of DFIR Investigative Mindset included.

Registration closes tomorrow at the start of the workshop: May 22. 11AM Mountain time.

AI can help find things. You still have to prove them.

Register here:
https://t.co/hj9UK4XC5R #DFIR

[Placing the Suspect Behind the Keyboard @PSBK4n6]

Want the foundation in keeping your value against AI? With your registration, you get a PDF version of my book, DFIR Investigative Mindset.

Registration ends at 11AM MDT, May 22.
https://t.co/5FyzxYOS0i