Computer Online Forensic Evidence Extractor

From Wikipedia, the free encyclopedia

Computer Online Forensic Evidence Extractor (COFEE) is a modified USB flash drive for investigators for quick extraction of forensic data from computers that are suspected to contain evidence of criminal activity. It greatly reduces the need to seize a computer, and allows investigators to search through data onsite as an automated forensic tool. The device, developed by Microsoft, is activated by being plugged into a USB port, and purportedly contains 150 commands that can dramatically cut the time it takes to gather digital evidence (estimates cited by Microsoft state that a job that previously took 3-4 hours can be done with COFEE in as little as 20 minutes^[1]^[2]). These commands offer such functions as the ability to decrypt passwords, search a computer's Internet activity, and analyze the data stored on a computer^[3] — including data stored in volatile memory, which could be lost if the computer were shut down for transport to a lab^[4]. Microsoft currently provides COFEE devices and online technical support free to law enforcement agencies.

COFEE was developed by Anthony Fung, a former Hong Kong police officer who now works as a senior investigator on Microsoft's Internet Safety Enforcement Team^[2]. Fung conceived of the device following discussions he had at a 2006 law enforcement technology conference sponsored by Microsoft^[3]. The device is used by more than 2,000 officers in at least 15 countries^[5].

A case cited by Microsoft in April 2008 credits COFEE as being crucial in a New Zealand investigation into the trafficking of child pornography, producing evidence that led to an arrest^[2].