What's new

LEO'S Computer Forensic Evidence Extraction Flash drives

I.M. Boggled

Certified Bloomin' Idiot
Veteran
FYI
Computer Online Forensic Evidence Extractor (COFEE) is a modified USB flash drive for investigators for quick extraction of forensic data from computers that are suspected to contain evidence of criminal activity.

It allows investigators to search through data on site as an automated forensic tool.

The device, developed by Microsoft, is activated by being plugged into a USB port, and purportedly contains 150 commands that can dramatically cut the time it takes to gather digital evidence (estimates cited by Microsoft state that a job that previously took 3-4 hours can be done with COFEE in as little as 20 minutes.

These commands offer such functions as the ability to decrypt passwords, search a computer's Internet activity, and analyze the data stored on a computer — including data stored in volatile memory, which could be lost if the computer were shut down for transport to a lab.

Microsoft currently provides COFEE devices and online technical support free to law enforcement agencies.

http://en.wikipedia.org/wiki/Computer_Online_Forensic_Evidence_Extractor

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
INTERPOL media release
15 April 2009


INTERPOL initiative with Microsoft aims to raise global standards against cybercrime through strategic partnership with IT sector


REDMOND, USA – As part of INTERPOL’s Global Security Initiative (GSI) to address 21st century security challenges and equip global police forces with cutting edge tools, INTERPOL has signed an agreement with Microsoft Corp. at the first international public safety symposium, in line with INTERPOL’s growing partnership with the Information Technology sector.

With INTERPOL committed to raising standards globally in the fight against IT crime, today’s agreement will see INTERPOL’s 187 member countries use Microsoft tools to improve police capacity and technical expertise in cyber forensics and against cybercrime.

Under this agreement, Microsoft will make available to INTERPOL’s 187 member countries its Computer Online Forensic Evidence Extractor (COFEE) software tool to aid law enforcement investigators in incident response investigations access live computer system data.

Since volatile data collection is a paramount concern in live incident response situations, investigators often need to create a record of existing system files and folders without compromising its evidentiary value. COFEE will assist police in INTERPOL’s member countries gather information that might otherwise be lost if the target system was shut down, by allowing investigators to configure and use a set of programmes designed to gather content from a running system.

“Law enforcement organizations face an evolving and increasingly complex set of challenges, in the information age,” said Linda K. Zecher, Corporate Vice President of the Worldwide Public Sector at Microsoft. “It is essential that they are equipped with the right technologies to meet these challenges and we are pleased to partner with INTERPOL to support that cause through free distribution of the COFEE tool to frontline investigators across the world.”

After INTERPOL undertook a computer forensic examination of computers and hardware seized from a FARC rebel camp by Colombian authorities in March 2008, INTERPOL determined that more resources had to be committed to first responder police units in handling electronic evidence.

“As the world’s global police organization, INTERPOL is uniquely suited to forge partnerships across all sectors that will help law enforcement in its member countries raise their standards, particularly in the area of IT crime which is borderless and constantly evolving,” said Elaine Dezenski, INTERPOL’s Global Security Initiative (GSI) Managing Director. “In extending vital frontline tools and resources such as COFEE to cyber investigators worldwide, INTERPOL’s initiative with Microsoft shows how it is working to bring additional resources and cutting-edge tools to its members to fight the threats of the 21st century.”

With law enforcement continually challenged in a more complex and interdependent world, INTERPOL is forging partnerships across the public and private sectors to enhance collective security. The organization’s concept of strategic global partnerships was formalized as a key part of INTERPOL’s platform for 21st century law enforcement when it launched its Global Security Initiative in October 2008.

“The COFEE agreement and training programme will help establish a recognized international standard for digital forensics and cyber crime investigations and will therefore help law enforcement to develop internally the expertise which it requires in the long-term,” said Professor Joe Carthy of University College Dublin’s (UCD) Centre for Cyber Crime Investigations, which is partnering INTERPOL to develop training programmes to enable forensic experts to use COFEE.

INTERPOL's 2008 General Assembly in Russia approved the creation of an INTERPOL Computer Forensic Analysis Unit. Working with partners, its services to member countries will include training, impartial and independent assistance with computer forensics examination on missions, and the development of international standards for the search, seizure and investigation of electronic evidence.
 

I.M. Boggled

Certified Bloomin' Idiot
Veteran
From Microsoftdotcom:

From Microsoftdotcom:

http://www.microsoft.com/industry/government/news/cofee_faq.mspx

(FAQ) about Computer Online Forensic Evidence Extractor (COFEE)


Q. What is COFEE?
A. COFEE (Computer Online Forensic Evidence Extractor) is a tool that helps simplify the very complex problem of gathering “live” computer evidence of cybercrime. It utilizes common forensics tools to aid officers at the scene in gathering important live evidence with a single USB device. It also provides reports in a simple format for later interpretation by computer experts, or as supportive evidence for computer investigations. This means that first-responder officers on the scene of a crime don’t have to be computer forensic experts to capture live data for later analysis and that this critical information does not have to be lost once a computer is shut down to be taken for a traditional offline forensic analysis.

Q. Who are the intended users of COFEE?
A. COFEE is currently designed exclusively for use by law enforcement officials and is provided at no cost. Law enforcement can find more information about COFEE on our Microsoft Law Enforcement Portal (and associated newsletter).

Q. What benefit does COFEE provide to law enforcement?
A. A common challenge of cybercrime investigations is the need to conduct forensic analysis on a computer before it is powered down and restarted. Important “live” evidence, such as active system processes and network data, is volatile and can be lost in the process of turning off a computer. This means that when gathering evidence, law enforcement must either send trained computer forensics examiners to the crime scene to gather live data or risk losing evidence by having untrained officers gather evidence or remove the computer from the crime scene.

COFEE does not provide new forensic tools, but is rather an easy to use, automated tool for first responders. It’s the ease of use, speed, and consistency of evidence extraction that is key. The tool allows law enforcement to run over 150 commands on a live computer system and save the results for later analysis, preserving information that could be lost if the computer had to be shut down and transported to a lab.


Q. Who are you working with for distribution and law enforcement training on COFEE?
A. In April 2009 Microsoft and INTERPOL announced that, as a result of its leading position among worldwide law enforcement agencies and with the knowledge that INTERPOL has the infrastructure in place to both efficiently distribute the tool and to understand the unique requirements and technical needs of its diverse affiliated regional agencies, INTERPOL would serve as the principal global distributor for COFEE. While Microsoft is still working to announce a distributor within the United States, with the INTERPOL announcement COFEE is available at no charge to law enforcement in 187 countries worldwide today.

For training, Microsoft and INTERPOL are working with the School of Computer Science and Informatics at the University College Dublin, which houses the university’s Cybercrime Center. The center’s staff has experience training law enforcement in computer forensics, and is in the process of expanding its curriculum in this area. In fact, the Cyber Crime Center actively engages with INTERPOL, and other law enforcement agencies, to develop training modules that cover all aspects of computer forensics. UCD’s experience in the field makes it a perfect fit for developing training modules on COFEE that can be delivered efficiently to law enforcement agencies worldwide. Moreover, given the university’s expertise in the forensics field, INTERPOL will have a knowledgeable partner to help configure the tool to meet the individual needs and requirements of all of INTERPOL’s affiliated regional agencies.

Q. What languages is COFEE developed in?
A. COFEE is currently available in six languages: English, French, German, Chinese, Russian and Spanish.

Q. What is the LE Portal (Law Enforcement Portal)?
A. The Microsoft Law Enforcement Portal, launched in September 2006, is a web “portal” that provides law enforcement with secure online access to a centralized resource containing Internet crime-related information as well as tools, training, and technical support to assist in cyber crime investigations. We believe technological solutions like these that facilitate the sharing of resources can be a powerful weapon in the fight against cybercriminals.

Q. Who is the audience for the LE Portal?
A. The LE Portal is designed to be a resource for law enforcement officials focused on cyber crime investigations. The fundamental idea is to give cyber crime focused law enforcement officials a designated contact point for Microsoft in order to support their efforts. The LE Portal is not designed to replace enterprise support arrangements, but rather to be a resource for those customers/partners who do not have a designated support contact at Microsoft.

Q. What kind of information can law enforcement expect to find on the LE Portal?
A. The LE Portal offers targeted technical and investigative support resources, information on specific threats, information on Microsoft enforcement programs and contact information for various Microsoft teams. The Portal also includes online training modules, as well as a calendar of upcoming training sessions, conferences and LE collaborations.

Q. Who maintains and updates the LE Portal? How frequently is it updated?
A. The Microsoft Internet Safety Enforcement team manages the LE Portal with contributions from several groups across Microsoft. It is updated constantly as new information becomes available.

Q. How do law enforcement officials get access to the LE Portal?
A. Since the LE Portal is a Microsoft Extranet application all users need a Microsoft Partners Account.

Q. Why is Microsoft investing in tools, technologies and training for law enforcement?
A. These programs are just the latest example of Microsoft’s ongoing commitment to helping to create a safer, more trusted Internet experience for everyone, not just Microsoft’s customers. As a company, we believe that public-private partnerships are essential to address the increasing complexities of cybercrime; no one can do it alone. One of the things we hear from government and law enforcement officials is that they need access to the latest training and they need better tools that can aid in sharing information between different agencies. Microsoft provides law enforcement with resources, expertise and information to help them to prosecute cybercrime, not only because it is the right thing to do, but because it also helps keep the Internet safer.
 

DIGITALHIPPY

Active member
Veteran
luv my MAC

hahaha you doint think cops know how to hack-a-mac?!?!?!

"real pros" know hackin *nix boxes is easier then windows, with users almost never having antivirus. (mac core is linux)



this also isnt anything new, just put into one place 150 things.

smoke more pot people.
 

GreenGeek

Member
Just another reason to stay away from any type of Windows OS.

Switch to Ubuntu, and install TrueCrypt. problem solved.
 

Tony Aroma

Let's Go - Two Smokes!
Veteran
hahaha you doint think cops know how to hack-a-mac?!?!?!

"real pros" know hackin *nix boxes is easier then windows, with users almost never having antivirus. (mac core is linux)

Guaranteed that Microsoft device won't work on my Mac. Which was the point of that article. Gotta love MS, though. They cater to the record and movie companies with all their digital rights management crap. And now LEO.

FWIW, I read an article recently about the FBI and their hacking skills. If you run Windows, you're basically screwed (as if you weren't already). Windows boxes present no challenge to the FBI. On the other hand, the FBI reportedly has lots more trouble hacking Macs. In fact, they are pretty unhackable. Which is why the FBI is gradually replacing their field officers' Windows machines with Macs.

So when I read stories like this one, or reports of the latest virus, I'm even more happy that I use the most secure OS.
 

ninsega

Member
Let the police agencies do all they can to track whatever they want. Just give me one place on Earth to do what I want. It's getting to the point where we need a new set of pilgrims and a new constitution.
 

Pythagllio

Patient Grower
Veteran
It's tech that scares me most. How long before they have a hand held 'sniffer' that can detect metabolites in your system? You're walking down the street and a cop points one of those things at you and off you go to re-education. If we don't get things relegalized before that happens we can kiss our collective ass goodbye.

I saw them claim on CSI:NY to be able to tell that a person used cannabis by analyzing the oil of their fingerprints. (Interesting episode revolved around the mmj underground of NYC) Yeah, probably too expensive for real life if it actually exists, but christ, think 30 years down the road...
 

etinarcadiaego

Even in Arcadia I exist
Veteran
This sounds mostly like silliness. Data stored in volatile memory that would be erased in the event of a shutdown???? Try "START" > SHUTDOWN. lol. Seriously, all they did was take a bunch of commands real techs know how to type manually via the command console, and put into a drive for LEO's who don't know shit about computers.

Macs are equally as susceptible to this phenomena, just not this specific tool. We're all just as safe as we've always been, but maybe weren't ever sure of how safe we've always been . . .

We fear what we do not know.
 

homerjay

New member
It's tech that scares me most. How long before they have a hand held 'sniffer' that can detect metabolites in your system? You're walking down the street and a cop points one of those things at you and off you go to re-education. If we don't get things relegalized before that happens we can kiss our collective ass goodbye.

I saw them claim on CSI:NY to be able to tell that a person used cannabis by analyzing the oil of their fingerprints. (Interesting episode revolved around the mmj underground of NYC) Yeah, probably too expensive for real life if it actually exists, but christ, think 30 years down the road...


Ha funny you should bring that up. My father won a patent of the year at Los Alamos Nat. Lab in 89-91ish (don't remember the exact year) for designing this thing. It was "designed" lol to detect poisn gas clouds and explosives on peoples skin. I sat and watched him make it, and at the time it was not classified but it works so well you need a securty clerince to know about. I never worked for LANL nor did I aggree to fallow any of there rules. So that means since I learned about it before it went "secret" I can pass this info to ANYONE I want.
So to answer your question this thing has been around for 20 years now.
 
Top