Microsoft supplies Interpol with DIY forensics tool
Interpol plans to distribute a Microsoft DIY computer forensics tool to its 187 member countries under an agreement announced Wednesday. Cofee, short for Computer Online Forensic Evidence Extractor, is a thumb drive containing more than 150 investigative applications police can use to collect digital evidence at crime scenes. …
So when will some honest cop...
So when will some honest cop place this tool set on the web so that it can be examined by people who can actually test & vet it properly?
@AC 00:12 GMT
That will happen some where around half past never. However if the cops have a break in their schedule they may think about doing that sometime between 27 and 30:15 in the AP on Monday Mayuary 45th 2550.
I've said it before and I'll say it again...
Use Truecrypt.
In related news ...
... Microsoft announced its corresponding client-server application, Technical Evidence Analyser (TEA) which runs atop the desktop environment, Single-User Graphical Analysis Runtime (SUGAR).
Works on Macs does it?
How about Linux? FreeBSD? Solaris?
Or, more accurately EXT3 (4), JFS, XFS, or any of the more esoteric file systems?
"Running Linux sir? Must have something to hide!"
The Met
Will their USB stick come with an integrated baton, cos it would be demeaning to the officer to be seen beating people with a little ole memory stick
@Alex Wright
>"Running Linux sir? Must have something to hide!"
Boston College Campus Police: "Using Prompt Commands" May Be a Sign of Criminal Activity
http://www.eff.org/deeplinks/2009/04/boston-college-prompt-commands-are-suspicious
@AC 00:50 GMT
...and if you have your TrueCrypt protected harddrive mounted when the eh... bad guys barge in? Will they be able to open your locked windows, make a memory dump simply by inserting a USB device? How secure are you really?
@Alex...
..I would think so yes. After all, the first tool they would use is to mirror the drive....then give it a good whack with a baton.
Not all MS products only work with MS, you know maybe Windows may be able to connect to Novell one day, or Unix, maybe even a printer or two....who knows....
Bitlocker
I guess it's pointless me using Bitlocker any more. With Vista 64 on a Core i7 with 8 GB Ram and fast RAID 0 disks performance was excellent. Other products might be "compatible" with 64 vbit vista but not native 64 bit. I had no choice on the 64 bit Vista, it's all Dell ship/support with Core i7 systems.
I'm sure some office somewhere in the world is going to lose his USB key with all this neat software on it. Unless there is access control within the toolset, it'll be on the web before the end of the year !
What's New About Windows Backdoors?
There have been backdoors in Windows for years.
See http://www.heise.de/tp/r4/artikel/5/5263/1.html
http://news.bbc.co.uk/1/hi/sci/tech/437967.stm
http://www.schneier.com/blog/archives/2007/01/nsa_helps_micro_1.html
@Alex Wright
"Running Linux sir? Must have something to hide!"
More embarrassing than running Linux?
This is quite hillarious
A forensic-evidence gathering tool from a company renown for its products not being able to read from or talk to anything else.
Microsoft "Security" vs Security Forces
Let's face it, their systems are plagued by security holes.
I'd be more surprised if they *weren't* relying on secret backdoors built into windows. Considering that it *only* works on Windows, all the evidence points that way.
Seriousness aside though.
Microsoft Security & Security Forces : which are the most incompetent?
Microsoft allow hackers to steal your sensitive data. The security forces merely leave theirs lying around on trains. I'm not surprised they've teamed up.
Now perhaps the security forces can leave *your* sensitive data lying around on trains!
Re: Works on Macs does it?
Depends what you mean by 'works'. If you mean 'secretly injecting and subsequently discovering incriminating evidence of a number of crimes including proving the owner to be both Lord Lucan and Jack the Ripper onto any non-Windows machine', then yes, it works...
Steve.
One detective at a time
Obviously only suitable for use by a single detective at a time because there's only one F in Cofee.
@ The Met
Yes, but a USB stick is easier to insert where it belongs.
I would not trust any forensic tool unless it has been subjected to formal, published analysis, and neither should a court. For all you know it allows INSERTION of "evidence", or will compromise information integrity rendering it useless.
Call it "president Bush lost email" mode, that gives you an idea.
Fascinating detail: in almost 2 decades of operation, Microsoft has not managed to inspire trust in what it supplies ONCE. So, my apologies, but I can't trust such tools either so I look forward to the first cases brought with evidence so generated. It may be laughed out of court.
Useless in .. hmm .. 5 days
A copy will find itself on the net soon enough , then in a few days , all their tricks
will be known and soft spots it exploits , and within 5 days all that soft will be useless.
Cheer up .. we're about to have a good time with that toy kit. ; )
Ric
@AC 00:12 GMT
On the web???!!!!!!
Based on Plods Previous Performance the toolkit should be available quite soon, on a USB stick, on public transport
RE: Iam Me
Not to worry sooner or latter they will leave one on a train....
Backdoors in Windows? Who'd have thought....?
There have been backdoors in Windows for years.
See:
http://www.heise.de/tp/r4/artikel/5/5263/1.html
http://news.bbc.co.uk/1/hi/sci/tech/437967.stm
http://www.schneier.com/blog/archives/2007/01/nsa_helps_micro_1.html
A Nice hypothesis
Here is a hypothesis from 2004 that discusses whether MS XP is a professional bugging device.
Some *extremely* interesting points are raised about design decisions.
http://100777.com/node/1120
@AC 10:41 GMT
See I totally forgot about the train angle, thanks for reminding me. In which case you're right it should show up soonish ™.
@AC 15:10. You're welcome, I'm here to help :-).
Calm down dear, it's only a thumbdrive
It's just a collection of already-available tools, packaged into a useful format. It's no more exciting or sinister than the Windows side of the Helix CD.
Sorry to intrude on your paranoid fantasies.
*This* is why I read El Reg...
@Alex Wright
By Anonymous Coward Posted Thursday 16th April 2009 07:44 GMT
"Running Linux sir? Must have something to hide!"
More embarrassing than running Linux?
(Well, except for our dear Moderatrix's all-too-infrequent intercessions, oo-er)
