Microsoft COFEE (Computer Online Forensics Evidence Extractor) tool and documentation, Sep 2009

Unless otherwise specified the document described here:

• Was first publicly revealed by Wikileaks working with our source.
• At that time was classified, confidential, censored or otherwise withheld from the public.
• Is of political, diplomatic, ethical or historical significance.
• Any questions about this document's veracity are noted.
• The summary is approved by the editorial board.

Released November 30, 2009
Summary

This release presents the Microsoft COFEE (Computer Online Forensics Evidence Extractor) tool version 1.1.2 as well as related documentation. The tool is reportedly not publicly available for purchase or made available, as far as we can ascertain, to a number of developing world polices forces.
The ZIP archive includes the MSI installer file, the handbook and documentation for each single tool COFEE is comprised of, verification studies from both the Florida State University (FSU) as well as the National White Collar Crime Center (NW3C).
The WikiLeaks release follows various takedown demands issued by Microsoft[1], including one sent to Cryptome's John Young[2], and an uncontrolled spread of contaminated versions of the tool via P2P filesharing networks, which may compromise important investigations.

Help us create a just and corruption free world.

DOWNLOAD/VIEW FULL FILE FROM

fastest (Sweden), current site, slow (US), Finland, Netherlands, Poland, Tonga, Europe, SSL, Tor

Context

United States

Company

Microsoft

File size in bytes

37628547

File type information

Zip archive data, at least v1.0 to extract

Cryptographic identity

SHA256 c217bbfbfe95575ab0e5cda2e8c1bf387c5356749a98f79b1ec5194061febef0