Just wait until this falls into the hands of a bunch of skript kiddies:Â
I am increasingly glad that I dusted off my Mac Mini that I got for $50 a few years ago, and have been using that as my main machine at home. My Wintel laptop now does almost nothing but batch processing of DVDs to be put onto my AppleTV.
Microsoft has developed a small plug-in device that investigators can use to quickly extract forensic data from computers that may have been used in crimes.I wonder how far this toolkit goes. If it can be used on a Windows Domain Controller server, then all bets are off for corporate security that relies on Windows. All someone would have to do is get a copy of this toolkit, plug it into the Domain Controller, and then every Windows workstation and server on the domain would be instantly compromised. Home users will continue to remain blissfully ignorant, just as they pretty much always have, because security doesn't affect them until it does if you know what I mean.
The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB "thumb drive" that was quietly distributed to a handful of law-enforcement agencies last June. Microsoft General Counsel Brad Smith described its use to the 350 law-enforcement experts attending a company conference Monday.
The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer's Internet activity, as well as data stored in the computer.
It also eliminates the need to seize a computer itself, which typically involves disconnecting from a network, turning off the power and potentially losing data. Instead, the investigator can scan for evidence on site.
I am increasingly glad that I dusted off my Mac Mini that I got for $50 a few years ago, and have been using that as my main machine at home. My Wintel laptop now does almost nothing but batch processing of DVDs to be put onto my AppleTV.