Windows Forensic Environment (WinFE) is a modified Windows PE that disables automatic drive mounting and prevents writes to evidence media, letting investigators boot directly from CD/USB on a target machine to acquire the disk without altering the original operating system.