MICROSOFT'S DIGITAL FORENSICS software has been spotted on a file-sharing site, available for all to download. Computer Online Forensic Evidence Extractor (COFEE) is a forensics tool that fits on. Microsoft Has Developed Windows Forensic Analysis Tool for Police. The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB 'thumb drive' that was quietly distributed to a handful of law-enforcement agencies last June. The antidote for Computer Online Forensic Evidence Extractor has been released to web and is currently available for download under the moniker DECAF, an acronym for Detect and Eliminate Computer.

reader comments

Download Microsoft Coffee

Microsoft's Computer Online Forensic Evidence Extractor (COFEE) has made it into the hands of pirates, and their virtual ships are distributing it quickly for everyone to get a taste. The COFEE application uses common digital forensics tools to help law enforcement officials at the scene of a crime gather volatile evidence of live computer activity that would otherwise be lost in a traditional offline forensic analysis. In other words, it lets officers grab data from password-protected or encrypted sources. That means you can now break the law twice over: download the software and then use it to steal information from other people's computers.

'We have confirmed that unauthorised and modified versions of Microsoft’s COFEE tool have been improperly posted to bit torrent networks for public download,' a Microsoft spokesperson told Ars. 'We strongly recommend against downloading any technology purporting to be COFEE outside of authorised channels - both because any unauthorised technology may not be what it claims to be and because Microsoft has only granted legal usage rights for our COFEE technology for law enforcement purposes for which the tool was designed.'

Chances are you won't have any use for the tool, but pirates get a thrill from having something they shouldn't, and a forensics tool only distributed to police departments around the world is pretty high up on the list of things you shouldn't have on your computer. 'Note that contrary to reports, we do not anticipate the possible availability of COFEE for cybercriminals to download and find ways to 'build around' to be a significant concern,' a Microsoft spokesperson told Ars. 'COFEE was designed and provided for use by law enforcement with proper legal authority, but is essentially a collection of digital forensic tools already commonly used around the world. Its value for law enforcement is not in secret functionality unknown to cybercriminals, its value is in the way COFEE brings those tools together in a simple and customisable format for law enforcement use in the field.'

The forensics tool is approximately 15MB in size and works best with Windows XP. Microsoft is working on a new version of COFEE for next year that fully supports Windows Vista and Windows 7. Here's the official description of COFEE:

With COFEE, law enforcement agencies without on-the-scene computer forensics capabilities can now more easily, reliably, and cost-effectively collect volatile live evidence. Vmware client integration plugin download. An officer with even minimal computer experience can be tutored—in less than 10 minutes—to use a pre-configured COFEE device. This enables the officer to take advantage of the same common digital forensics tools used by experts to gather important volatile evidence, while doing little more than simply inserting a USB device into the computer.

The fully customizable tool allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. And the COFEE framework can be tailored to effectively meet the needs of your particular investigation.

Microsoft first revealed the tool back in April 2008, so we have to say that the software giant did quite a good job keeping it away from pirates for almost two years (that has to be some kind of record for Redmond). In April 2009, Microsoft announced that it will aid global law enforcement in fighting cybercrime by providing its COFEE tool free of charge to International Criminal Police Organization's (Interpol) Global Security Initiative (GSI), a project that addresses international security challenges, and the participating 187 countries. Now though, the valuable tool is available to more than just government crime fighting bodies, and we can't say we're comfortable with the possible implications.

Microsoft Coffee Table Computer

Hat tip to CrunchGear.

Coffee Forensics

Listing image by Codepo8