ComputerForensicsDigest.com

Early last year, Microsoft Corporation announced that it was developing the Computer Online Forensic Evidence Extractor (COFEE), a USB thumb drive loaded with approximately 150 tools for conducting live forensics on a suspect computer. After an eighteen-month, limited test run with Interpol, Microsoft is now making the device widely available to law enforcement agents across the United States.

Microsoft says that its COFEE device makes it possible for officers to collect "volatile live evidence" with a minimal amount of training. (Now there's a promise defense attorneys will find intriguing.) The company has struck a deal with the National White Collar Crime Center (NW3C) to distribution COFEE at no cost to law enforcement agencies around the country.

"The fully customizable tool," the company says, "allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution."

Access to the device is limited to law enforcement, so there's little available information on what specific tools are served with COFEE. When the device was publicly introduced last year, Seattle Times writer Sharon Chan tried to learn more about the device, but was brushed off by Microsoft spokespeople. The most the company would say is that the thumb drive "is a compilation of publicly available forensics tools."

For civil libertarians and conspiracy theorists, alarm bells went off when Microsoft General Counsel Brad Smith told Chan that COFEE could be used to extract encrypted data from a suspect's drive in 20 minutes or less. That led some to speculate that the device makes use of some hidden back door in the Windows operating system.

The same Microsoft spokesperson told Chan that COFEE "does not circumvent Windows Vista BitLocker encryption or undermine any protections in Windows through secret 'backdoors' or other undocumented means."

As the COFEE device becomes more widely available, details about its operation will inevitably emerge, since defense attorneys will be entitled to ask what tools investigators used to examine a suspect system. In the meantime, I'll see if it is possible to compile a component list through some other source.