Description

"The “Windows Forensic Environment” (aka WinFE or Windows FE) is the creation of Troy Larson (Microsoft), further developed by a few others in the forensic community.  It is an operating system environment based on the Microsoft PE (Preinstalled Environment), modified for forensic use..."

"The “Windows Forensic Environment” (aka WinFE or Windows FE) is the creation of Troy Larson (Microsoft), further developed by a few others in the forensic community.  It is an operating system environment based on the Microsoft PE (Preinstalled Environment), modified for forensic use.

WinFE forensically boots computers much like the various Linux forensics disks, however, WinFE is “Windows”, not Linux, thereby allowing the examiner to use Windows based forensic applications to image or examine suspect/custodian machines in a forensically sound environment." - https://winfe.wordpress.com/