Please remember to protect and support our work.

Microsoft COFEE (Computer Online Forensics Evidence Extractor) tool and documentation, Sep 2009

From Wikileaks

Jump to: navigation, search

Remember to protect and promote our work.

Unless otherwise specified the document described here:

  • Was first publicly revealed by Wikileaks working with our source.
  • At that time was classified, confidential, censored or otherwise withheld from the public.
  • Is of political, diplomatic, ethical or historical significance.
  • Any questions about this document's veracity are noted.
  • The summary is approved by the editorial board.

Follow updates:

Secure talk join our chat.

To sponsor reportage of this document by mainstream journalists submit a targeted donation.

For press inquiries, see our media kit.

If you have similar or updated material ACT NOW.

For an explanation of the page you are looking at please look here.

You can save this information from legal attack.

Released November 30, 2009

This release presents the Microsoft COFEE (Computer Online Forensics Evidence Extractor) tool version 1.1.2 as well as related documentation. The tool is reportedly not publicly available for purchase or made available, as far as we can ascertain, to a number of developing world polices forces.

The ZIP archive includes the MSI installer file, the handbook and documentation for each single tool COFEE is comprised of, verification studies from both the Florida State University (FSU) as well as the National White Collar Crime Center (NW3C).

The WikiLeaks release follows various takedown demands issued by Microsoft[1], including one sent to Cryptome's John Young[2], and an uncontrolled spread of contaminated versions of the tool via P2P filesharing networks, which may compromise important investigations.
Help us create a just and corruption free world.
fastest (Sweden), current site, slow (US), Finland, Netherlands, Poland, Tonga, Europe, SSL, Tor

United States
File size in bytes
File type information
Zip archive data, at least v1.0 to extract
Cryptographic identity
SHA256 c217bbfbfe95575ab0e5cda2e8c1bf387c5356749a98f79b1ec5194061febef0

Know something about this material? Have your say!(see other comments first)
Personal tools