According to an article on the Seattle Post Intelligencer website, Microsoft has teamed up with the National White Collar Crime Center (NW3C) to distribute a computer forensics tool to U.S. police for free.
The Computer Online Forensic Evidence Extractor (COFEE) makes it easy for any officer, not just digital forensics specialists, to record the current processes of a suspect’s computer. An officer can plug in a COFEE-formatted USB thumb drive, run COFEE, and download data that would have been lost if the computer were turned off for transit to the police station according to the article.
COFEE can be used to identify parts of a computer’s hard drive that a criminal might use for identity theft, online fraud, child pornography or other crimes. It can speed up the forensics process when a computer-crime specialist takes over the investigation. COFEE requires Windows XP for configuration and works best at downloading data from machines running XP or earlier. However, it does have some Windows Vista support. Microsoft plans to release a new version of COFEE next year that fully supports Vista and Windows 7, a spokesperson said.
“It’s a rather straightforward tool and it uses a lot of off-the-shelf technology already,” said Richard Boscovich, a senior attorney for Microsoft’s World Wide Internet Security Program. “That’s the beauty of the tool – that you don’t need that forensics expert at the scene.” Michael Merritt, assistant director of the U.S. Secret Service told an audience at Microsoft’s Digital Crime Consortium, “The difference now with technology is that many companies like yours house valuable information … And that now has become the target of many criminals.”
Boscovich said Microsoft is offering the tool for free because it helps police cut down on the larger problem of high-tech crime. Microsoft software, because of its ubiquity, is usually considered the most at-risk for digital attacks.
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.