Hi everyone,
Recently I have started building my own customized forensic bootable CD by following instructions found at
http//www.forensicfocus.com/windows-forensic-environment-boot-cd
I booted my machine with the CD and i found that it has detected my local hard disk however, the status is that the disk is mounted and readonly set to no. I have made the relevant registry modifications by Troy and i am curious to know if this is a "normal" behaviour of WinFE. If I plugged in an external USB drive, it is not mounted and readonly set to yes by default which is good.
As an alternative, i have also tried the WinFE Lite version however i did not manage to get the ISO to boot.
I look forward to hear from any of you who has encountered such issues or managed to build your own WinFE successfully! Thanks in advance!
Something not right with that, you should be seeing all disks connected as read-only on boot.
I used WinBuilder and Colin Ramsden's script in the build which gives you an easy to use GUI at WinFE boot to enable read/write access and mounting of the disk you wish to push your image files out to.
This is where you can get Colin's script
http//
There is an exception, not yet fully solved/fully reported as working AFAICR, about Dynamic Disks
http//
besides the issue with "scan hardware"
http//
jaclaz
Thanks all for your replies. I will take note of the exceptions and try out the winbuilder and Colin's script to build it this time.