In the age where crime may now be carried out from behind a
computer terminal, the world’s largest software maker is lending a hand to law
enforcement against cybercrime.
Microsoft said this week it will freely distributing a
specially developed USB thumb drive device that is able to quickly extract
forensic data from computers used in criminal activities.
The device is called COFEE, or Computer Online Forensic Evidence Extractor,
which was officially revealed to law enforcement experts on Monday, reported
the Seattle
Times.
Traditional procedures in cybercrime investigation call for
seizure of all computer equipment at the scene of the crime, but the COFEE tool
allows for immediate gathering of evidence such as passwords, internet activity
and other critical data all without the need to disturb the area. The tool is
capable of executing more than 150 commands to access data on a given computer
system.
According to CNET, the COFEE
tool was originally developed by Ricci Ieong and Anthony Fung, whom are members
of the High Tech Crime Investigators Associate’s (HTCIA) Asia South Pacific
Chapter. Microsoft did not share the exact contents of the COFEE drive, but did
say that it is all composed of publicly available tools.
“The key to COFEE is not new forensic tools,” said Tim
Cranton, associate general counsel for Microsoft, “but rather the creation of
an easy to use, automated forensic tool at the scene. It's the ease of use,
speed, and consistency of evidence extraction that is key.”
Contrary to earlier reports of COFEE being able to defeat
Windows BitLocker with access to a backdoor, Microsoft said that it simply isn’t
true. “COFEE does not circumvent Windows Vista BitLocker encryption or
undermine any protections in Windows through secret 'backdoors' or other
undocumented means,” added Cranton.
COFEE is currently in use by more than 2,000 officers in 15
different countries, including the U.S., Germany, Poland, New Zealand and the
Philippines