4 ms·
This whole coffee thing seems like a distraction to me. The Microsoft toolkit is very primitive. It doesn't do much more than run standard system utilities that
by teilo 17y ago
This whole coffee thing seems like a distraction to me. The Microsoft toolkit is very primitive. It doesn't do much more than run standard system utilities that are freely available, and log the results to a USB drive. It is an amateurish tool for people who know little or nothing about computer forensics.
Any law enforcement agency worth its salt is going to have a computer forensics department smart enough to remove the hard drive from the machine in question, and examine it in a non-destructive way. Thus this decaf toolkit is useless.
- tptacek 17y agoEvery LEO doing "forensics" is basically an EnCase jockey today. It's not like they're shipping these things to Quantico for imaging under a scanning electron microscope. Regardless, the reason for online tools like Coffee is that you want to preserve an image of the running system. Removing the hard drive defeats that objective.
- stse 17y agoSometimes they even leave the encase cd behind ;) http://translate.google.se/translate?js=y&prev=_t&hl=sv&ie=UTF-8&layout=1&eotf=1&u=http%3A%2F%2Fwarpdrive.se%2F34861&sl=sv&tl=en http://translate.google.se/translate?js=y&prev=_t&hl... (jar = computer)