Windows Forensic Environment

Start Here

Available to Download Now!

Supported Systems

This is a brief overview of supported systems

Microsoft Windows

WinFE Will allow forensic imaging of Windows 2000 to Windows 10, Including server versions (x86/x64/ARM)

Apple MacOS

WinFE has been tested on the latest MacOS Operating Systems (x86/x64)


Forensic images can be created of most Linux variants running on x86/x64/ARM

WinFE Now built on ADK10

WinFE Has now been re-written in C++, which allowed the application to be built in x86, x64 and ARM architectures.

As a result of this, WinFE will now load on UEFI as well as legacy systems, without changing BIOS settings. This means that devices, such as the Microsoft Surface Pro can be easily forensically imaged. BitLocker is also supported providing that you have access to either the unlock key or password.

The ARM CPU architecture is also supported, however, this does require a separate build of WinFE to function.