
Forensically boot evidence machines with a Windows Forensics Operating System! Now boots into ARM devices. #DFIR
Joined May 2013
- Tweets675
- Following0
- Followers5.1K
- Likes228
Replying to @scritches
Strange. I just checked it through Palo Alto; no problem.
urlfiltering.paloaltonetwork…
2
1
28
Take a look at this WinFE Builder: github.com/4n6Wizard/WinFEBu… by @4n6Wizard
S2 E6: Brett Shavers and the Investigative Mindset youtu.be/F1pc7SmI1s8?si=nHnL… via @YouTube
Creating a Fuji/WinFE external drive
malwaremaloney.blogspot.com/…
You did the tools. Now do the cases.
suspectbehindthekeyboard.com… #DFIR
WinFE update, training notes, etc...
**Follow the official WinFE blog that tens of thousands of WinFE users follow.**
winfe.wordpress.com/2025/12/…
9
757
Webinar starts in minutes! (11AM MT)
It's not what you know that hurts your DF/IR work. It's what you assume you know. I assumed a lot about court...
And you might win a book at the end. 📕
You can join via the Zoom app or your browser.
us02web.zoom.us/j/8260606375…
1
234
Less than 12 hours left. Unlimited spots.
Completely free. Free WinFE Powershell script to builds a WinFE for you. Free WinFE eBook ($29.99 on Amazon).
Get documented proof of WinFE training from one of the developers of WinFE.
Don't rely on a one-hour breakout session at a conference to justify your WinFE training.
winfe.wordpress.com/2025/05/… #windowsFE #WinFE
Tomorrow is the last day to sign up for FREE for the WinFE training courses. Includes WinFE Building Powershell script, ebook of the WinFE Guide, and certs of completion. winfe.wordpress.com/2025/05/…
6
1,032
Tomorrow is the last day to sign up for FREE for the WinFE training courses. Includes WinFE Building Powershell script, ebook of the WinFE Guide, and certs of completion. winfe.wordpress.com/2025/05/…
Tip: Register for the WinFE course by tomorrow. It's free until then.
You'll then have access to future WinFE courses too, especially when the next big update is released.
This is the same course I teach and have taught at universities, corporations, law enforcement, and intelligence agencies.
Free ends tomorrow.
winfe.wordpress.com/2025/05/… #winfe #dfir
Fyi:
--WinFE is taught at ICAC, FLETC, SEARCH, HTCIA, and IACIS (and so many conferences!).
--WinFE evidence has been admitted at every level of the court system.
--It has been cited countless times in books, peer-reviewed papers, and blog posts.
--This course is the only course that gives you a certificate of completion in a full formal course, covering more than just WinFE, but also forensically booting OSs.
Replying to @WindowsFE
435 peeps signed up for the free WinFE courses over the past 2 days. There is no limit on the registrations, but the free offer ends on May 14.
435 peeps signed up for the free WinFE courses over the past 2 days. There is no limit on the registrations, but the free offer ends on May 14.
More than 15K DF/IR practitioners have taken my WinFE trainings over the past 10 years. The first course at that time was short, and WinFE was just a babe in arms.
WinFE has since gotten its drivers license and is racing to some big improvements coming up!
1
3
241
🕷️ BLACK WIDOW NEVER WENT IN WITHOUT A PLAN.
You shouldn’t either.
🚨 FREE WinFE User + Train-the-Trainer
🎯 Learn to build and defend your forensic boot environment — the foundation of every solid case.
💥 $0 until May 14
🧠 Because in digital forensics, your acquisition is your attack plan.
👉 winfe.wordpress.com/2025/05/…
#DFIR #WinFE #DigitalForensics
Do you remember when you joined X? I do! #MyXAnniversary
192

















