It can save information such as what user was logged on and for how long and what files were running at that time, Fung said. A law enforcement agent connects the USB drive to a computer at the scene of a crime and it takes a snapshot of important information on the computer. While COFEE doesn't break BitLocker or open a back door, it captures live data on the computer, which is why it's important for agents not to shut down the computer first, Fung said.
#MICROSOFT COFEE DOWNLOAD SOFTWARE#
COFEE's solution: plug in a USB drive containing the software and record. That meant a lot of valuable information was lost since police couldn't log in as the suspect when the machine was rebooted. The old protocol was to unplug the machine and take it back to headquarters. It was created by Anthony Fung, a former Hong Kong cop and now a regional manager in Microsoft's Internet Safety and Anti-Counterfeiting group.ĬOFEE changes the basic police protocols for dealing with suspects' machines. PC World has an extensive article about Microsoft's COFEE - Computer Online Forensic Evidence Extractor – which some 2,000 law enforcement officers have been using since last June. Microsoft has released a tool to law enforcement that helps get around the encryption provided by the company’s own BitLocker software, distributed in Windows Vista.
0 kommentar(er)
