Microsoft’s Computer Online Forensic Evidence Extractor (COFEE) has made it into the hands of pirates. The tool uses common digital forensics tools to help law enforcement officials at the scene of a crime gather volatile evidence of live computer activity that would otherwise be lost in a traditional offline forensic analysis. Microsoft is working on a new version of COFEE for next year that fully supports Windows Vista and Windows 7. The forensics tool is approximately 15MB in size and works best with Windows XP. Microsoft first revealed the tool back in April 2008, so we have a good job keeping it away from pirates for almost two years.”]
Source: https://arstechnica.com/information-technology/2009/11/pirates-get-to-taste-microsoft-cofee/