Microsoft, To Fight Cyber Crime, Introduced COFEE

To fight against cyber-crime, Microsoft introduced COFEE that helps Law enforcement. Microsoft COFEE (Computer Online Forensic Evidence Extractor) is software that easily captures significant “live & volatile” computer evidence in cyber-crime investigations, without special forensics expertise. Let me explain in detail, COFEE is a USB device pre-configured with specific software that helps cyber-crime investigator to collect VOLATILE LIVE EVIDENCE in reliable and cost-effective manner. For example, files/information that are stored in RAM would be lost if the computer had been shut down. An investigator with minimal computer knowledge can be tutored to use COFEE in 10 minutes.

It allows investigator to run around 150 commands on a computer. It can generate reports in a simple format for later interpretation by experts for subsequent investigation. Even COFEE can be customized to effectively meet the needs of your specific investigation.

Few people criticized Microsoft like “COFEE is using a backdoor that Microsoft built into its operating system for law enforcement to bypass the Windows BitLocker encryption”. Those rumors were promptly suppressed by Microsoft official-Tim Carton with a statement “COFEE doesn’t get access through any secret ‘backdoors’ and does not evade any Windows Vista BitLocker encryption.”

COFEE, according to reliable source is nothing but bundle of existing and publicly available programs with easy UI, though Microsoft has not confirmed this.

Number of free COFEE downloads are available on Internet. Nobody knows whether those sources are fake or what. I am just wondering the misuse of COFEE would be challenge to data privacy and security.

Microsoft in collaboration with National White Collar Crime Center (NW3C) and INTERPOL has announced to provide COFEE at zero cost to law enforcement agencies in 187 countries all over the world.

Law enforcement agency can have it by contacting NW3C at www [dot] nw3c [dot] org or INTERPOL at COFEE@interpol [dot] int.

Share