Building a Bootable Version of OSForensics using WinPE
OSForensics can be configured to start directly from a bootable USB Flash Drive (UFD), rather than being started from within a machine's operating system. This can be useful when the machine you need to run OSForensics on has an invalid, incompatible or otherwise non-working operating system.
To run OSForensics on a machine without a valid operating system, you will need to set up a “Pre-install environment” that allows Microsoft Windows to be booted from a UFD.
PassMark Software has created a tool, WinPE Builder to help guide you through setting up a Microsoft Window Pre-install environment (WinPE) which includes both Windows and OSForensics on a bootable UFD. The process will also allow you to inject new device drivers into the Windows image for system specific hardware (where required).
Creating a self bootable OSForensics with PassMark WinPE Builder
Windows Preinstallation Environment (PE) is a lightweight version of Windows built on the Windows Kernel. Windows PE is not designed to be the primary operating system on a computer; however, it can be useful for forensics purposes. For purposes such as data access, data recovery, or booting a machine without an OS installed. This tutorial will walk through the process of creating an OSForensic bootable solution on an USB Flash Drive using PassMark WinPE Builder.
Before we begin:
With OSForensics it is possible to make your own self booting USB flash drive from within the OSForensics software.
- Download and install an WinPE edition from Microsoft. Make note of the installation directory.
- A copy of OSForensics installed on your computer and your license key email.
- A USB Flash Drive (UFD). Back up any important data on the UFD, drive will be formatted during the build process.
For the most part, all the options in PassMark WinPE Builder will be set to the default. You should not need to adjust the settings unless you want to customize your WinPE build to include additional tools. The WinPE Builder program can be located in the OSForensics' Program install directory or launched from within the program itself from the Install to USB option.
Alternatively, it is possible to make your own self booting USB flash drive without using WinPE Builder by following the instructions provided in the following guide.
Exporting OSForensics files to be used in WinPE Builder
In OSForensics, choose "Install to USB". The Install to USB function will place all the necessary files to run a standalone version of OSForensics without having the software installed on the system beforehand. Select "Make self booting USB drive with WinPE)". Specify a location where you wish to place the files temporarily, this must not be a location on the USB drive and should be a temporary directory on the local hard drive. Remember the location, as it will be used later on in WinPE Builder. For "Installation Type", select licensed and enter in your license key. When ready, click install, upon completion, WinPE Builder will automatically launch. If it does not, you can manually start it from the OSForenscis program installation directory.(Note: 32-bit version of OSForensics will not run in a 64-bit WinPE environment – you will need to 64-bit version of OSForensics in this scenario.)
Specifying the WinPE build environment
Our base Windows PE image will based on 64-bit WinPE for Win10 environment. (Note: 32-bit version of OSForensics will not run in a 64-bit WinPE environment – you will need to 64-bit version of OSForensics in this scenario.) WinPE for Win10 is selected because of its native support for USB 3.0 and newer hardware. We will leave the Additional Packages on their default selection. Only WinPE-HTA, WinPE-Scripting, WinPE-WMI, and WinPE-StorageWMI are required.
In the "Windows AIK or ADK installed directory:" location box. Enter in where you have installed the kit. The default location is pre-entered, if you have chosen to change the install directory. You will need to point to the location where you have it.
Adding OSForensics to the WinPE Image
On the Program / Files tab, select PassMark OSForensics in the drop down box and navigate to the folder in the previous step where you saved the OSForensics files.
Setting the Storage Area Network (SAN) Policy can control whether or not disks are mounted when WinPE is started. The recommend setting for OSForensics is "3 - Doesn't mount storage devices" to prevent introduction of artifacts. However, if you need access to disks, e.g. external disk drive to image to, you can change it accordingly.
The "Add Additional Files" will automatically populate with four font files that are needed for OSForensics. If you would like to place any additional files into the image, you can do so with "Add" button.
Adding Drivers (Optional)
Install the NIC and Mass Storage (RAID) drivers that you need for your target system. In many cases this is not required. You will need to specify the folder the drivers (.inf) files are in. During the build process, the folders with be recursively searched for any valid .inf driver files.
The startup script is used to tell Windows PE to launch OSForensics after booting. There are two default script provided. The first uses "startnet.cmd" method which will give you access to the command prompt to run additional commands, batch files or scripts. The alternative method is "winpeshl.ini" which will not provide access to the command prompt. We will select startnet.cmd and use the default script generated.
Create the Image
The default "Temp Work Dir" will be the directory you launched the WinPE Builder program from. If for some reason, this is not an appropriate location, you can specify another directory. The location should have around 500 MB of free space. (Note: DO NOT use the OSForensics directory in the previous step as the temp work directory.)
Select "USB Flash Drive" as the target and specify the drive letter for the USB flash drive. Look over the configuration summary to verify the settings are correct. When satisfied, check the "Configuration is correct" checkbox to enable the "Create" button.
Sit back and wait...
A build progress screen should appear and the build process will be under way. Once complete, the USB Flash Drive can be used to boot a system into OSForensics.
- Create Index: You will not be able to index some file formats from 64-bit WinPE. This is due to the fact that 64-bit WinPE does not support 32-bit executables, and indexing some file formats require the use of 32-bit components. Instead, we recommend imaging the disk, and performing the indexing from an investigation machine (which should be faster and have more resources than the machine being investigated). This is generally the most practical approach given that indexing is very resource intensive.
- WinPEBuilder Error 10: See the following forum post
- Failed to open output batch file: Check that Temp Working Directory exists, if not it will need to be created.