Cofee

Computer Online Forensic Evidence Extractor (COFEE)

COFEE is a collection of Microsoft software designed to all the easy capture of important "live" computer evidence at the scene in cybercrime investigations, without special forensics expertise.

The fully customizable tool allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. And the COFEE framework can be tailored to effectively meet the needs of your particular investigation. To help combat the growing number of ways that criminals use computers and the Internet to commit crimes, Microsoft is working with INTERPOL and the National White Collar Crime Center (NW3C) to provide COFEE at no cost to law enforcement agencies in 187 countries worldwide. INTERPOL and NW3C are also working with Florida State University and University College Dublin to continue the research and development that will help ensure that COFEE serves the needs of law enforcement, even as technology evolves.

Law enforcement can get COFEE from NW3C at https://www.nw3c.org/ or by contacting INTERPOL at COFEE@interpol.int.