Microsoft COFEE unveils all your private data

The COFEE – a somewhat laboured acronym for Computer Online Forensic Evidence Extractor – is a USB mass-storage device which started trials at law enforcement agencies across the US last June. Containing a toolkit of approximately a hundred and fifty commands, the software included on the drive is capable of decrypting passwords, copying the Internet history log, and accessing files owned by any user on the computer.

Microsoft general counsel Brad Smith has described the unit, which the company is offering free of charge to verified law enforcement officers, as something the company invests “substantial resources in, but not from the perspective of selling to make money. We're doing this to help ensure that the Internet stays safe.”

The article goes on to mention that the COFEE device “eliminates the need to seize a computer itself, which typically involves disconnecting from a network, turning off the power, and potentially losing data. Instead, the investigator can scan for evidence on site.” What isn't mentioned in the article, however, is whether the evidence gathered by the toolkit is actually suitable for law enforcement purposes.