Microsoft COFEE v1.1.2 (Computer Online Forensics Evidence Extractor)

[312c]

Law enforcement agencies around the world face a common challenge in their fight against cybercrime, child pornography, online fraud, and other computer-facilitated crimes: They must capture important evidence on a computer at the scene of an investigation before it is powered down and removed for later analysis. "Live" evidence, such as active system processes and network data, is volatile and may be lost in the process of turning off a computer. How does an officer on the scene effectively do this if he or she is not a trained computer forensics expert?

To help solve this problem, Microsoft has created Computer Online Forensic Evidence Extractor (COFEE), designed exclusively for use by law enforcement agencies. COFEE brings together a number of common digital forensics capabilities into a fast, easy-to-use, automated tool for first responders. And COFEE is being provided—at no charge—to law enforcement around the world.

With COFEE, law enforcement agencies without on-the-scene computer forensics capabilities can now more easily, reliably, and cost-effectively collect volatile live evidence. An officer with even minimal computer experience can be tutored—in less than 10 minutes—to use a pre-configured COFEE device. This enables the officer to take advantage of the same common digital forensics tools used by experts to gather important volatile evidence, while doing little more than simply inserting a USB device into the computer.

The fully customizable tool allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. And the COFEE framework can be tailored to effectively meet the needs of your particular investigation.

To help combat the growing number of ways that criminals use computers and the Internet to commit crimes, Microsoft is working with INTERPOL and the National White Collar Crime Center (NW3C) to provide COFEE at no cost to law enforcement agencies in 187 countries worldwide. INTERPOL and NW3C are also working with Florida State University and University College Dublin to continue the research and development that will help ensure that COFEE serves the needs of law enforcement, even as technology evolves.

Link: http://la.gg/v/cofee.rar

The program is really nothing more than a gui around some .bat files, but its still kind of interesting.

[Freq]

It might be a good idea to have a background process that disables this?

[vZc]

So does it need to be on already or can they boot it up? Can't remember that software that will automatically delete everything if you enter the wrong password in it and is encrypted in 9billion to the power or 8 or something.

It would be funny if you just had fake USB drives on your computer that just turned on some sort of protection if plugged into.

[312c]

Its a program that goes on a USB drive, plugs into a target computer, then runs a small .exe and saves back to the usb drive. Its meant for use by retard cops that don't actually know anything about computers and there is a computer in a house that gets raided.

[BB5k]

It's so if there are shady people doin shady things on the internet and before they can get a warrant to take the shit they use this USB real quick to gather evidence....basically lets say FOR EXAMPLE. FOR FUCKIN EXAMPLE. God damn stop accusing a nigga. You know what fuck this. I'm out.

[Nore]

is this shit legit? is this the one that was posted on what.cd then removed shortly after? that fucking request had a bounty of like 2 TB

[le0]

heh

[sKyZ]

Funny, was just talking to a few ppl on IRC about this.

[Kobal]

what happens when someone sets up a trojan to automatically dl on the flashdrive and then download on the cops computer

[312c]

Originally Posted by Nore

is this shit legit? is this the one that was posted on what.cd then removed shortly after? that fucking request had a bounty of like 2 TB

Yea it is, except already extracted from the .msi and re-rared

[davids61]

5kbs on la.gg ftw

[Crazy]

Yeah this was a let down, although since it does have the capability of adding other utilities it's pretty cool, especially since it generates a fairly detailed report. Anyone have any memory acquisition tools they can point to that successfully dumps physical memory on WinXP SP3?

[kditty]

the DL failed for me.