Building a Bootable Version of OSForensics using WinPE

OSForensics can be started from a bootable CD/DVD or UFD

OSForensics can be configured to start directly from a bootable CD/DVD or USB Flash Drive (UFD), rather than being started from within a machine's operating system. This can be useful when the machine you need to run OSForensics on has an invalid, incompatible or otherwise non-working operating system.

To run OSForensics on a machine without a valid operating system, you will need to set up a “Pre-install environment” that allows Microsoft Windows to be booted from a CD/DVD or UFD.

PassMark Software has created a tool, WinPE Builder to help guide you through setting up a Microsoft Window Pre-install environment (WinPE) which includes both Windows and OSForensics on a bootable CD/DVD or UFD. The process will also allow you to inject new device drivers into the Windows image for system specific hardware (where required).

Creating a self bootable OSForensics with PassMark WinPE Builder

Windows Preinstallation Environment (PE) is a lightweight version of Windows built on the Windows Kernel. Windows PE is not designed to be the primary operating system on a computer; however, it can be useful for forensics purposes. For purposes such as data access, data recovery, or booting a machine without an OS installed. This tutorial will walk through the process of creating an OSForensic bootable solution on an USB Flash Drive using PassMark WinPE Builder.

Before we begin:

Starting with V2.2 of OSForensics it is possible to make your own self booting USB flash drive from within the OSForensics software.

For the most part, all the options in PassMark WinPE Builder will be set to the default. You should not need to adjust the settings unless you want to customize your WinPE build to include additional tools. The WinPE Builder program can be located in the OSForensics' Program install directory or launched from within the program itself from the Install to USB option.

Alternatively, it is possible to make your own self booting USB flash drive without using WinPE Builder by following the instructions provided in the following guide.

Exporting OSForensics files to be used in WinPE Builder

In OSForensics, choose "Install to USB". The Install to USB function will place all the necessary files to run a standalone version of OSForensics without having the software installed on the system beforehand. Select "Make self booting USB drive with WinPE)". Specify a location where you wish to place the files temporarily, this must not be a location on the USB drive and should be a temporary directory on the local hard drive. Remember the location, as it will be used later on in WinPE Builder. For "Installation Type", select licensed and enter in your license key. When ready, click install, upon completion, WinPE Builder will automatically launch. If it does not, you can manually start it from the OSForenscis program installation directory.(Note: 32-bit version of OSForensics will not run in a 64-bit WinPE environment – you will need to 64-bit version of OSForensics in this scenario.)

OSForenscis Install to USB

Specifying the WinPE build environment

Our base Windows PE image will based on 64-bit WinPE 4.0 environment. (Note: 32-bit version of OSForensics will not run in a 64-bit WinPE environment – you will need to 64-bit version of OSForensics in this scenario.) Windows PE 4.0 is selected because of its native support for USB 3.0. We will leave the Additional Packages on their default selection. Only WinPE-HTA, WinPE-Scripting, and WinPE-WMI are needed.

In the "Windows AIK or ADK installed directory:" location box. Enter in where you have installed the kit. The default location is pre-entered, if you have chosen to change the install directory. You will need to point to the location where you have it.

WinPE / Packages Tab

Adding OSForensics to the WinPE Image

On the Program / Files tab, select PassMark OSForensics in the drop down box and navigate to the folder in the previous step where you saved the OSForensics files. The "Add Additional Files" will automatically populate with four font files that are needed for OSForensics. If you would like to place any additional files into the image, you can do so with "Add" button.

Program / Files Tab

Adding Drivers (Optional)

Install the NIC and Mass Storage (RAID) drivers that you need for your target system. In many cases this is not required. You will need to specify the folder the drivers (.inf) files are in. During the build process, the folders with be recursively searched for any valid .inf driver files.

Startup Script

The startup script is used to tell Windows PE to launch OSForensics after booting. There are two default script provided. The first uses "startnet.cmd" method which will give you access to the command prompt to run additional commands, batch files or scripts. The alternative method is "winpeshl.ini" which will not provide access to the command prompt. We will select startnet.cmd and use the default script generated.

Startup Script Tab

Create the Image

The default "Temp Work Dir" will be the directory you launched the WinPE Builder program from. If for some reason, this is not an appropriate location, you can specify another directory. The location should have around 500 MB of free space. (Note: DO NOT use the OSForensics directory in the previous step as the temp work directory.)

Select "USB Flash Drive" as the target and specify the drive letter for the USB flash drive. Look over the configuration summary to verify the settings are correct. When satisfied, check the "Configuration is correct" checkbox to enable the "Create" button.

Create Tab

Sit back and wait...

A command prompt screen should appear and the build process will be under way. Once complete, the USB Flash Drive can be used to boot a system into OSForensics.

Build Process