Windows Forensic Environment (WinFE)

WinFE update, training notes, etc... **Follow the official WinFE blog that tens of thousands of WinFE users follow.** winfe.wordpress.com/2025/12/13/not…

Dell Machines and WinFE mreerie.com/2026/05/14/del… via @MrEerie #DFIR

Pure awesomeness.

WinFE Gets You In. It Doesn’t Get You Home. PSBK CASEWORK will, tho. winfe.wordpress.com/2026/01/28/win… #dfir

You did the tools. Now do the cases. suspectbehindthekeyboard.com/psbk-casework #DFIR

You keep taking DFIR tool classes and STILL not improving your CASEWORK? Spend a day with me and I'll help you break through the barrier to become the most effective DFIR practitioner. You have the talent. You have the software. You just need a system. suspectbehindthekeyboard.com/psbk-casework #DFIR

Check out our latest Insights article "Quick Tour Of New Features In Arsenal Image Mounter v3.12.331" to see highlights (lots of screenshots!) of the latest AIM functionality: arsenalrecon.com/insights/quick…. #DFIR

Did you know that AIM Remote Agent can be run from @SUMURIForensics PALADIN? See Anastasia boot a Surface Pro 5 w/ two 512gb drives, connect both drives to AIM across a network (w/ automatic Storage Spaces reassembly), & launch a virtual machine. ArsenalRecon.com #DFIR

Do you have a #DFIR workstation running Windows on Arm? If you don’t now, you may soon after checking out Arsenal Image Mounter’s new Arm on Arm virtualization. While waiting on the Snapdragon X2 Elite, we're using a Dell XPS 13 (X Elite) with 64gb RAM. ArsenalRecon.com

Arsenal Image Mounter's new Arm on Arm virtualization is powerful, unique, & a big deal for #DFIR practitioners. If you have Windows on Arm computers (or disk images) in your evidence room, time to get them out! What do you see in these screenshots? ArsenalRecon.com #DFIR

Arsenal Image Mounter v3.12.331 just released w/ Arm on Arm virtualization, Windows S Mode bypass (x64 & Arm!), multiple simultaneous disk connections w/ AIM Remote Agent, BitLocker support extended to Windows File System Driver Bypass Mode, & more. ArsenalRecon.com #DFIR

TERABYTES OF FORENSIC TEST IMAGES HUNDREDS OF CTFs dfir.training/downloads/test… #DFIR #CTF

I Was There When Digital Forensics Lost Its Soul. linkedin.com/pulse/i-when-d…

On the left, a Samsung Galaxy Book Go (Snapdragon 7c Gen 2 CPU & broken screen) booted w/ WinFE & then running AIM Remote Agent to attach its disk over a network to another Arm laptop on the right (Dell XPS 13, Snapdragon X Elite CPU) where AIM launches the remote disk into a VM!

BOOT ARM DEVICE INTO WINFE. THEN BOOT THE ARM INTO A VM. HAPPY HAPPY HAPPY HAPPY

A major new build of Arsenal Image Mounter is just around the corner! Check out this brief teaser demonstration of forensically-sound Arm on Arm virtualization over a network. An enormous amount of effort over the summer went into making this happen. ArsenalRecon.com #DFIR

Have you thought about how the new AIM Remote Agent could assist in your digital forensics workflow? Check out these use cases involving Windows Forensic Environment (WinFE). ArsenalRecon.com #DFIR

5 minutes to start! us02web.zoom.us/webinar/regist…

WinFE is not on trial. You are. Thu Aug 14, 11AM MT. 14 roles judge your testimony learn what they look for. Certificate + + chance to win free book + live-only offer.