dfir-workstation-guide

A How to Step by Step Guide of how I set up my Windows Forensic Windows Workstations and create a golden Image out of it.

Bios Setup

• Enable Virtualization Technologies

Windows Install

• Install the Laptops / Towers Default Windows iso (See vendor instruction)
• Install Firmware updates (See vendor instruction)

After first Reboot

• Open the update Settings and update until there are no updates to get installed
• Open "Turn on Feature" and enable WSL and Windows-Sandbox

Power Settings

Rekated Settings -> Choose what the power button does:

• Uncheck "Turn on fast startup"
• Check Hibernation on
• Configure Extended Display Sleep Time and Closing Lit do nothing except in battery mode.

Hardening

Download and run W10Privacy using the config in this repo

If Defender is not disabled after reboot, use the GroupPolicy Editory to set the Computer -> Administrator -> Wind-comp -> MS Defender

• MS Defender AV Disabled: Active
• RealtimeProtection -> Disable RTP: Active

This should keep MS Defender Disabled over reboots.

Disable UAC

CLick on every tool that needs Admin priviledges and when it is prompted to elevate use this: TODO Add Images

Install DFIR-Tools

Run the DFIR-Installer as intended using the Forensic-Workstation config (Full List of Configs Here) and run the installer with -conf and the name (without .conf), more insights in the Repos README

Edit Explorer Options

TODO Add Images

Setup WSL

Kali WSL (From the MS Store):

Use this for the latest Installation Guide for Kali (WSL)

sudo apt update && sudo apt upgrade -y
sudo apt install --fix-missing

# Only if Errors occure during update and upgrade
# Start 
sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg
sudo apt update
sudo apt install --fix-missing
sudo apt install gpg -y
gpg --no-default-keyring --keyring /usr/share/keyrings/kali-archive-keyring.gpg -k
sudo apt update
sudo apt install --fix-missing
sudo apt full-upgrade -y  # This may take some time!
sudo apt install --fix-missing
sudo apt update && sudo apt upgrade -y
sudo apt install --fix-missing
# End

# Continue here, if no errors occured (or if you fixed them)
sudo apt install kali-tools-forensics kali-tools-passwords kali-tools-respond kali-tools-recover kali-tools-reporting kali-tools-reverse-engineering kali-tools-social-engineering kali-tools-top10 kali-tools-windows-resources

Sift Workstation and REMnux WSL - Ubuntu 24.04 LTS (From the MS Store):

Sift Workstation

sudo su

cd ~
wget https://github.com/ekristen/cast/releases/download/v1.0.13/cast-v1.0.13-linux-amd64.deb
dpkg -i cast-v1.0.13-linux-amd64.deb
sudo cast install --mode=server teamdfir/sift-saltstack

If you need to rerun the last command, you might get an error like FATA[0116] handling file: salt/lib/libkrad.so.0:. Use this to fix this error:

rm -rf /var/cache/cast/
sudo cast install --mode=server teamdfir/sift-saltstack

REMnux Follow this guide: https://docs.remnux.org/install-distro/add-to-existing-system

If something breakes:

Use this to uninstall a wsl distro:

wsl --unregister <Distro> # use <wsl list> to get all distros

Parrot OS - PawnBox / Security

• Download WSL Config of Parrot OS: https://www.parrotsec.org/download/
• Double Click on the Config to import the settings
• Open Parrot OS Shell by clicking on the Icon of Parrot OS in the Start Menu (and Pin it to taskbar)
• Execute the following commands

sudo apt update && sudo apt upgrade -y
sudo apt install --fix-missing
sudo apt install parrot-tools-full -y
sudo apt install --fix-missing
echo "-----------------"
echo "Add to file:"
echo "[boot]"
echo "systemd=true"
read -p "Add the Lines above to the file after klicking enter"
sudo nano /etc/wsl.conf
sudo apt install bash git npm wget curl pipx dracut dbus* -y
sudo apt install --fix-missing
sudo apt install gdm3* -y
sudo apt install --fix-missing
sudo apt update && sudo apt install parrot-desktop-mate -y
sudo apt install --fix-missing
sudo apt install mate* -y
xdg-user-dirs-update
sudo systemctl set-default multi-user.target
sudo systemctl set-default graphical
sudo ln -fs /usr/lib/systemd/system/graphical.target /etc/systemd/system/default.target
echo "-----------------"
echo "Add to file:"
echo "export XDG_SESSION_TYPE=x11"
echo "export XDG_SESSION_CLASS=user"
echo "export GDK_BACKEND=x11"
echo "export LIBGL_ALWAYS_SOFTWARE=1"
read -p "Add the Lines above to the file after klicking enter"
sudo nano ~/.wsl_x11_env
echo "Start Mate Session with:"
echo ". ~/.wsl_x11_env"
echo "mate-session"

Install Powershell Profile Oh my Posh

Set Default Terminal to: C:\Program Files\PowerShell\7\pwsh.exe

Open Powershell and run:

winget install JanDeDobbeleer.OhMyPosh --source winget --scope user --force
Install-Module -Name Terminal-Icons -Repository PSGallery -Force
oh-my-posh get shell
oh-my-posh enable reload
notepad $PROFILE
oh-my-posh font install FiraCode

Fill in this into the opened editor:

oh-my-posh init pwsh --config 'powerlevel10k_classic' | Invoke-Expression

# Icons für Dateien und Ordner
Import-Module -Name Terminal-Icons

# History-Completion mit Vorschau
Set-PSReadLineOption -PredictionViewStyle ListView
Set-PSReadLineOption -PredictionSource History

Then: Terminal -> PW7 -> Font -> Fira Code Mono

Set Default Terminal to: C:\Program Files\PowerShell\7\pwsh.exe

Set default apps:

• Browser: Firefox
• Notes: EditPad Lite 8

Plaso,Volatility3,Sherlock Installation

Download the MS Build Tools Here and import the config in this repo to install some compiler configFile

Open CMD and type Python and install the MS Store Package of Python3

Replace the <USER> with you Username and add this to the Windows Path Variables and Add to env var (Navigate to this Path, Path may be different on your laptop (log2timeline.exe should be in the folder)): PATH:

C:\Users\<USER>\AppData\Local\Packages\PythonSoftwareFoundation.PythonManager_qbz5n2kfra8p0\LocalCache
C:\Users\<USER>\AppData\Local\Python\pythoncore-3.14-64\Scripts
C:\Users\<USER>\AppData\Local\Python\bin\

Run x64 Native Tools Command Prompt for VS 2022 as Administrator and run (Copy it by Mouse, because CMD might remove paragraths):

SET DISTUTILS_USE_SDK=1
SET MSSdk=1
python -m ensurepip --upgrade
pip install -U pip setuptools wheel
pip install plaso
pip install volatility3
pip install sherlock-project

Add to env var (Navigate to this Path, Path may be different on your laptop (log2timeline.exe should be in the folder)):

C:\Users\<USER>\AppData\Local\Packages\PythonSoftwareFoundation.PythonManager_qbz5n2kfra8p0\LocalCache

Manual Work

• MemProcFS Testing
• Run Arsenal Image Mounter and install driver
• Run in powershell: update-help
• Disable Modern Standby (Fast Boot - Energy Settings) and Autoplay (Autoplay settings)
• Install Dracula Themes (https://draculatheme.com/)
• Feel free to test some instructions and scripts in the folder: ./scripts
• Add Perl and Mactime Shortcut (Navigate to Sleuthkit folder and use perl mactime.pl)
• Add Parrot OS WSL or VM

Taskbar

• Everything
• Firefox
• Explorer
• Terminal
• Computer Manager
• Obsidian
• Windows-Sandbox
• VM-Ware
• Visio
• Marktext
• EditPad Lite 8
• Visual Studio Enterprise
• Visual Studio Code
• Libre Office
• Github Desktop
• CyberDuck
• Snipping Tool
• WSL Distros

Pin to Desktop

• Bitlocker Menu
• Windows-Tools / Administrative Tools
• exiftool(-a -u -k).exe
• Admin CMD
• Admin PowerShell
• Crystal Disk Info
• (DFIR-Installer Dependent: update-system.ps1 and Tools.lnk)

Pin to Explorer QA:

• Desktop
• Downloads
• Documents
• Trash
• <Username>
• DFIR (C:\DFIR)
• DFIR-Custom (C:\DFIR-Custom)
• Cases
• GitHub
• VirtualMachines

Set a Wallpaper and Color Configs

• Set wallpaper (if you like, my prefered one is inside of the wallpaper folder)
• Color: #44475A
• Windows-Mode: Dark
• App-Mode: Light

Create System Backup using Ash BU or a comparable Tool.

After restoring

Run update script of dfir-installer and update wsl distros (sudo apt update && sudo apt upgrade -y)

Fences / Desktop Shortcuts Navigate to Tools and create for each category a fence (Free Alternative: itop) and link each tool to its fence.

---

Disclaimer: This is my way of working. Please feel free to fork this tutorial for your purposes but keep in mind that this is my setup I share with you. I am open for suggestions using the issues section but only in matter of Documentation improvements and Fixes of wrong commands. Thank you and I hope this guide will inspire your workflow :-)