Last week, Microsoft demonstrated to law enforcement experts a new cybercrime-fighting tool called COFEE – short for Computer Online Forensic Evidence Extractor. Essentially a USB thumb drive pre-loaded with about 150 publically available tools, law enforcement can use COFEE to extract sensitive information from a computer before it’s powered down and confiscated.

There was certain confusion, however, as some believed that COFEE is able to defeat Windows BitLocker with access to a backdoor. Microsoft denied such functionality, as Tim Cranton, associate general counsel for Microsoft, said, “COFEE does not circumvent Windows Vista BitLocker encryption or undermine any protections in Windows through secret 'backdoors' or other undocumented means.”

“The key to COFEE is not new forensic tools,” said Cranton, “but rather the creation of an easy to use, automated forensic tool at the scene. It's the ease of use, speed, and consistency of evidence extraction that is key.”

To help further clear any misconceptions regarding its COFEE tool, Microsoft shared with BetaNews some additional information. “COFEE works by being plugged into a running system where a user has already logged on. It enables law enforcement to expedite the evidence gathering process by automating over one hundred different commands that would otherwise have to be typed by hand. COFEE saves the results for later analysis, preserving information that could be lost if the computer had to be shut down and transported to a lab,” a Microsoft representative wrote in an email.

“COFEE is designed for use by law enforcement only with proper legal authority. It does not contain new forensic tools, but rather is an easy to use, automated forensic tool at the scene,” it continued. “Because COFEE is designed to be used by law enforcement officials in investigations that deal with highly sensitive evidence and information, the exact methods by which the COFEE tool works cannot be disclosed.”

Microsoft credits the conception of COFEE originally by Anthony Fung, formerly of the Hong Kong Cybercrime Police Unit, in 2006. COFEE was released to a limited group in 2007, and is now used by more than 2,000 forensic examiners in more than 15 different countries.