Image via WikipediaWell the big story today is that Microsoft's law enforcement only tool, COFEE has been leaked to the internet and is a big hit on the torrent download servers.
I did not bother to locate a download source for it, since I am not supposed to have a copy of it. However, I did locate a link to the user manual on an official law enforcement website, which I shall not name or link to here.
With so much hype about the wonders of this tool, I was pretty disappointed when I read the user manual. Basically all it is, is a shell on a USB Windows FE stick for the free tools you can get anywhere, including some of the old sysinternals, aka Winternals..
To be honest, law enforcement agencies would be better off using Helix 3 Pro or Drive Prophet. There is a free LEO version of Drive Prophet available from the DOD Cybercrime folks who purchased a license for the purpose of distribution to law enforcement agencies.
And of course there is the new commercial version of Drive Prophet that was just released by our company, Guardian Digital Forensics.
From what I saw in the user manual, it is not even that easy to use. Built for untrained first responders, I did not see anything in the examples given that would be useful to anyone other than a trained person who can interpret the information.
It is interesting to read some of the message board posts talking about the leak. This is probably a good thing since most of the posts I read on various boards were completely clueless about what COFEE does and is for even after they downloaded and ran it.
It is certainly not what I expected to see. I was expecting a tool that provides something closer to what Drive Prophet does: extract and generate reports that are immediately useful to the first responder. Digital triage that can be used and is useful for anyone without the need for training in interpreting a bunch of cryptic reports.
Now that the mystery is solved, at least in my case, I can stop wondering what magic Microsoft has developed to advance the forensics field. The answer is; none at all.