Microsoft Forensics Tool COFEE - In the wild!

It doesn't do anything that you can't already do with existing Windows tools!

How true… think of COFEE is a Script or batch file program that will execute Freely available software in an automated method. If you don't have a need for the tools now you won't need COFEE. Lot's of Hype around the Program because it's from MS…Seems folks thought this was the keys to the Windows Kingdom…
lol

Contrary to popular belief, what you get from Starbucks is not coffee.

-)

COFEE is very similar to the other forensics frameworks which call CLI utilities. The one nice feature I saw was the automatic renaming of the tools in addition to hashing to make sure that is the intended version running. Otherwise, it runs builtin OS tools and sysinternal tools off USB intended for non-technical law enforcement. Technical folks will be better off with the tools already available like FSU, FTK, IRCR, etc.

http//praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/

Please note, requesting download information or offering unauthorized distribution of this tool falls outside acceptable use of these forums.

Jamie

Agreed, point taken, no more mention about unauthorized distribution of any tool from me

Regards
Spirovski Bozidar
http//www.shortinfosec.net

Please note, requesting download information or offering unauthorized distribution of this tool falls outside acceptable use of these forums.

Jamie

Agreed, point taken, no more mention about unauthorized distribution of any tool from me

Regards
Spirovski Bozidar
http//www.shortinfosec.net

My bad sorry, forgive me o great admin )

http//happyasamonkey.wordpress.com/2009/11/11/computer-forensics-in-the-geek-press-a-taxonomy/ seemed to have a good take on it D

http//happyasamonkey.wordpress.com/2009/11/11/computer-forensics-in-the-geek-press-a-taxonomy/ seemed to have a good take on it D

GREAT one. D

jaclaz

Agreed - we could do with more writing of this calibre! Anyone know who's behind it?

Jamie

COFEE had been in the wild 1-2 month after official release, already available on web based file shares. Apparently the people making a fuzz about it only monitor torrents.

What this demonstrates IMOH is that
- Not everyone in the forensic world act ethically or at least in the respect of the law (asking for a copy they are not allowed to own)
- The poor security around the distribution of the software; wherever the leak appeared originally, my guess is that it must have been either from Microsoft or from a law enforcement agency

Isn' it the most frightening?