More on WinFE and Autopsy

I was right.  This is cool.

Using Autopsy on WinFE Lite worked as expected; however, I wanted to test it with a WinBuilder build of WinFE to address limitations found on WinFE Lite (notably, the inability to view videos or inside zip files).

In short, the WinBuilder build allowed viewing of videos and accessing zip files with Autopsy.  There were a few other customizations that I made for appearance and ease of use that you may find helpful in presenting training on WinFE (if you do that) or in creating your own WinFE for onsite preview/triage.

Add Autopsy to the WinFE start menu.

Basically, with Autopsy, any first responder or parole supervisor can triage/preview an evidence machine, onsite, without cost of software or hardware.  You just need a CD, DVD, or USB with WinFE and Autopsy.  For the first responders who are not forensic examiners, a WinFE boot disc/USB can be made with Autopsy clearly presented on the desktop and start menu.  I would suggest that other forensic tools be included in the event they may be needed by a forensic analyst.  An example would be a first responder finding evidence on a machine during a triage/preview and the machine needs to be imaged.  Either the first responder can image the machine or preferably, a trained person should be called to image the machine.  Having the apps pre-installed eliminates the need to reboot the machine to another build of WinFE, or plugging in additional drives with programs, and so forth.

In order to get you in gear with the potential of a completely free WinFE and software (you need a license for Windows to build it…but otherwise, it’s all free), I’ve posted the steps below.  Before you ask for help with WinBuilder, go to www.reboot.pro and read the help forums.  There is as much documentation you need for directions on how to download and run WinBuilder along with as many scripts (added features) as you could ever need.

The steps:

1)      Download Autopsy and install to your workstation.

2)      Download Winbuilder

3)      Download the WinFE write protection script (place in the WinBuilder tweaks folder)

4)      Build your WinFE

It’s free!

Download and install Autopsy to your workstation. http://sleuthkit.org/autopsy/

It’s free!

Download and install WinBuilder (go to www.reboot.pro on how the program works)

Guess what? This is free too.

Download the WinFE write protect script.  http://winfe.wordpress.com

Place the write protect script (WP.script) in the Tweaks folder of WinBuilder

Without this one little thing (wp.script), you only making a “PE”, not a “FE” build.

Run WinBuilder.  Read my previous write up on how to do this to save time in trying to figure it out.  I’ve already spent more than a few hours which you don’t have to go through.  Be prepared, you will have errors and builds that don’t work.  But once you get it right and see how it works, you will have a tool which will provide invaluable use for years.  Trust me on this; you will not regret spending the time.  The only regret you will ever have is waiting to try it out.