Computer Online Forensic Evidence Extractor (COFEE)

Law enforcement agencies around the world face a common challenge in their fight against cybercrime, child pornography, online fraud, and other computer-facilitated crimes: They must capture important evidence on a computer at the scene of an investigation before it is powered down and removed for later analysis. "Live" evidence, such as active system processes and network data, is volatile and may be lost in the process of turning off a computer. How does an officer on the scene effectively do this if he or she is not a trained computer forensics expert?


	Related links
	Microsoft gives Interpol free COFEE Microsoft device helps police pluck evidence from cyberscene of crime

To help solve this problem, Microsoft has created Computer Online Forensic Evidence Extractor (COFEE), designed exclusively for use by law enforcement agencies. COFEE brings together a number of common digital forensics capabilities into a fast, easy-to-use, automated tool for first responders. And COFEE is being provided—at no charge—to law enforcement around the world.

With COFEE, law enforcement agencies without on-the-scene computer forensics capabilities can now more easily, reliably, and cost-effectively collect volatile live evidence. An officer with even minimal computer experience can be tutored—in less than 10 minutes—to use a pre-configured COFEE device. This enables the officer to take advantage of the same common digital forensics tools used by experts to gather important volatile evidence, while doing little more than simply inserting a USB device into the computer.

The fully customizable tool allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. And the COFEE framework can be tailored to effectively meet the needs of your particular investigation.

To help combat the growing number of ways that criminals use computers and the Internet to commit crimes, Microsoft is working with INTERPOL and the National White Collar Crime Center (NW3C) to provide COFEE at no cost to law enforcement agencies in 187 countries worldwide. INTERPOL and NW3C are also working with Florida State University and University College Dublin to continue the research and development that will help ensure that COFEE serves the needs of law enforcement, even as technology evolves.

Law enforcement can get COFEE from NW3C at www.nw3c.org or by contacting INTERPOL at COFEE@interpol.int.

If it's vital to government, it's mission critical to Microsoft.

INTERPOL is the world’s largest international police organization, with 187 member countries. Created in 1923, it facilitates cross-border police cooperation, and it supports and assists all organizations, authorities, and services whose mission is to prevent or combat international crime. In April 2009, INTERPOL became the first global distributor of COFEE to help law enforcement fight cybercrime. For more information from INTERPOL about how to get or use COFEE, contact COFEE@interpol.int.

National White Collar Crime Center (NW3C) is a non-profit organization dedicated to providing training, investigative support, and research to agencies and entities involved in the prevention, investigation, and prosecution of economic and high-tech crime. In October 2009, NW3C became the first U.S.-based distributor of COFEE to help law enforcement fight cybercrime.

Microsoft makes no representations or warranties, either expressed, implied, or statutory, regarding any company presented herein or its products or services. The inclusion of a company does not imply endorsement by Microsoft of the company or its products or services. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.