Windows Forensic Environment (WinFE)

Forensically boot evidence machines with a Windows Forensics Operating System! Now boots into ARM devices. #DFIR

[Brett Shavers 🙄 @brettshavers]

AI can generate 20,000 lines of code faster than you can misunderstand the first 200. https://t.co/gopMAarG4K

[Arsenal Recon @ArsenalRecon]

Did you know that the latest Arsenal Image Mounter exposes BitLocker metadata in Free Mode that is unavailable from manage-bde & elsewhere? Check out these screenshots to see some examples made possible by our new BitLocker library. https://t.co/w8v2JqX7rn #DFIR

[Arsenal Recon @ArsenalRecon]

Arsenal Image Mounter v3.13.368 just released with even more powerful & unique BitLocker functionality (Free & Professional Modes!) thanks to a new BitLocker library developed by Joakim Schicht & many late nights from Olof Lagerkvist. https://t.co/w8v2JqX7rn #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

Take a look at this WinFE Builder: https://t.co/qwUg20pw84 by @4n6Wizard

[Windows Forensic Environment (WinFE) @WindowsFE]

S2 E6: Brett Shavers and the Investigative Mindset https://t.co/yLMPFl3dip via @YouTube

[Windows Forensic Environment (WinFE) @WindowsFE]

Creating a Fuji/WinFE external drive
https://t.co/axHQxfATwS

[Placing the Suspect Behind the Keyboard @PSBK4n6]

It's now on Kindle!
https://t.co/P54d2iyFI0

[X-Ways Forensics Practitioners Guide/2E @XWaysGuide]

You have until Friday. And only a few will be able to get it.
https://t.co/koA7ypDU0M #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

Boot carefully. Collect carefully. Think harder. https://t.co/iuIbYvE27F

[Brett Shavers 🙄 @brettshavers]

SCOTUS just ruled that grabbing your Location History via geofence is a Fourth Amendment search.
https://t.co/3PpQgaqdLq

[Placing the Suspect Behind the Keyboard @PSBK4n6]

In 3 hours.
https://t.co/QKtgQ0J711 #DFIR

[Brett Shavers 🙄 @brettshavers]

Attribution is not just finding evidence.

↳ It is explaining what the evidence supports, what it does not support, and what alternative explanations remain.

↳ Live, online training: June 24, 1 PM MDT. $5 registration. https://t.co/hb7XuAr7lw #DFIR

[DFIR Training @DFIRTraining]

Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain.
Replay included. PDF Edition of DFIR Investigative Mindset also included.
Registration closes tomorrow at start of workshop.
https://t.co/MIFB9GFa98 #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

In 3 hours!

[DFIR Training @DFIRTraining]

Practical DFIR + AI workshop tomorrow (May 22) at 11AM Mountain.
Replay included. PDF Edition of DFIR Investigative Mindset also included.
Registration closes tomorrow at start of workshop.
https://t.co/MIFB9GFa98 #DFIR

[Brett Shavers 🙄 @brettshavers]

AI Found It. You Prove It.
Forensics first. AI second.
90 minutes. 90-day replay. PDF edition of DFIR Investigative Mindset included.

Registration closes tomorrow at the start of the workshop: May 22. 11AM Mountain time.

AI can help find things. You still have to prove them.

Register here:
https://t.co/hj9UK4XC5R #DFIR

[Placing the Suspect Behind the Keyboard @PSBK4n6]

Want the foundation in keeping your value against AI? With your registration, you get a PDF version of my book, DFIR Investigative Mindset.

Registration ends at 11AM MDT, May 22.
https://t.co/5FyzxYOS0i

[Placing the Suspect Behind the Keyboard @PSBK4n6]

If AI can summarize your report, draft your timeline, and explain your artifacts faster than you, how much longer will you be paid to do DFIR?

90-minute live workshop tomorrow.
AI Found It. You Prove It.
11am Mountain time
90 day replay. Registration closes tomorrow.

Register: https://t.co/fktRZ2aGbv #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

Dell Machines and WinFE
https://t.co/Iy0LDPRz3Q via @MrEerie #DFIR

[Windows Forensic Environment (WinFE) @WindowsFE]

Pure awesomeness.

[Arsenal Recon @ArsenalRecon]

Here’s something you don’t see every day in #DFIR - launching a virtual machine from a Linux laptop (safely booted with WinFE) connected to Arsenal Image Mounter across a network via AIM Remote Agent! https://t.co/w8v2JqX7rn

[Windows Forensic Environment (WinFE) @WindowsFE]

WinFE Gets You In.
It Doesn’t Get You Home.
PSBK CASEWORK will, tho. https://t.co/20goA8XL7d #dfir