$145.00 USD

Want to teach others how to build and use WinFE with documentation standing behind you?

Take the WinFE Train-The-Trainer (Instructor) course and have documented proof of training in teaching the Windows Forensic Environment.

If you pass the instructor course, you have permission to distribute the PDF version of the WinFE guide, and full use of the slidedeck used in the WinFE cert course.

All the work is done for you!

An account already exists with this email address. Is this you?

Sign in

WinFE Certification

The ONLY WinFE course that you need! 

 What you'll get:

  • WinFE Certification course ($145) 
  • PDF WinFE Guide (ONLY available in this course!)

Disclaimers and notes:

  • 6 months access 
  • Must pass all exams and do all work to pass the courses
  • Payment options

You can use PayPal or a credit card. For credit cards, click the PayPal button and checkout with a credit card, not your PayPal account.

WinFE Mastery

The key to mastering any subject is being able to teach it to others after you have first learned the subject yourself. Certainly, there are those who teach a subject without knowing more than what they have read or heard in a lecture, but I am referring to those who have learned a subject by doing it well enough to teach it.

Teaching a subject forces you to learn that subject more than just doing it. It requires being able to distill that which you know into instruction so that others can learn (and do!) what you know.

My promises to you in this course

You will learn all that you need to know about using WinFE. The course does not teach ‘how to do forensics’ or ‘how to boot a computer’. WinFE is not a forensic analysis application. You run forensic apps “in” WinFE as WinFE is an operating system.

For booting a computer, there are so many variations in systems to boot to an external media that it deserves its own training curriculum. For that, you need to research the machine in front of you that needs to be booted to WinFE/*nix yourself. This is not difficult and does not need a formal education to understand.

The topics taught in the course include how to build WinFE (of course), but the other must-know topics are the ones that (1) help support your evidence collection, (2) make cross-examination and depositions easier, and (3) prevent errors in using WinFE or choosing to use WinFE.

The WinFE Certification Course

If I “certify” someone in training, I require proof of knowledge and practical hands-on. Do not take this course unless you want to build WinFEs, test them, and pass an exam or two. You won’t get any document of attendance or completion unless you do everything you need to know about WinFE.

As a side note, building WinFE is fast and easy. You do not need a training course in how to build it. There are enough YouTube videos and blog posts showing how to do that. If that is all you want to know, you are good to go without any formal training. With that, be prepared to withstand cross-examination as to your source of learning about WinFE where you collected first-evidence in a legal case with WinFE…

But if you want proof of successful building and testing from one who has been involved in further developing Troy Larson’s original WinFE for the past 15+ years, and you want to put that on your resume, and you want to stun opposing counsel that you have been tried and tested in your use of WinFE, then this course does that. Want a step higher than that…

 Tech Support for WinFE

The short story: There is none.

You are your tech support for WinFE. You control all aspects of it. Building it, troubleshooting it, testing it, validating it, and using it. There is no toll-free number to call if you are trying to figure it out or have questions about it. No support tickets either.

Ergo, these courses. You become the master of WinFE. There is no higher cred of any DFIR tool user than one who is a master of it through training, education, testing, and validation of that tool.