Published: 2009-11-09
Microsoft's point-and-click forensics tool, normally only available to law enforcement agencies, has leaked to the Internet and is available to download on some peer-to-peer networks, according to reports.
The tool, known as the Computer Online Forensic Evidence Extractor, or COFEE, allows non-technical police officers to collect digital evidence by merely inserting a USB device into a computer. The leak follows Microsoft's announcement last month that it was making the tool available to U.S. law enforcement. The company had previously offered it only to international law enforcement agencies.
Several security researchers reported that they had been able to download a program from sources on the Internet that claimed to be the forensics software. The program first appeared on what.cd, according to news reports.
COFEE is a technology that is currently being jointly developed by INTERPOL, Florida State University and University College at Dublin. The device allows investigators to collect volatile information, such as active process information and network data, that might otherwise be lost, if the target computer was shut down, Microsoft says on its Web site.
Microsoft first announced it would be giving away the tool in 2008, but only to international law enforcement agencies. Last month, the company announced it would also provide U.S. law enforcement with the technology for free. The company announced the initiative in October as part of its Digital Crimes Consortium, a conference aimed at airing current issues in cybercrime and online investigations.
If you have tips or insights on this topic, please contact SecurityFocus.
Posted by: Robert Lemos
