Windows Forensic Environment On-Scene Triage

Law enforcement agencies strive to equip first responders with the tools and training they need to investigate a crime scene that has a technology component. WinFE (Windows Forensic Environment) is a tool that helps with that. By using a USB thumb drive that has been preconfigured with WinFE, investigators can preview a suspect computer in the field to determine if the device holds any evidence of criminal activity. WinFE is forensically sound, meaning it does not alter the suspect computer in any way. Having the ability to run a preview in the field saves agencies both time and money. This course walks investigators through the steps of building a bootable USB device that can be used in the field to rule out a computer’s role in a case. Through discussion and hands-on training, students learn how to build forensic environments for Microsoft Windows versions 7 and 8.1.