Then and Now

I had some training in computer forensics not that long ago, but I was completely blown away by this article in the Seattle Times:

Microsoft device helps police pluck evidence from cyberscene of crime
By Benjamin J. Romano
Seattle Times technology reporter

Microsoft has developed a small plug-in device that investigators can use to quickly extract forensic data from computers that may have been used in crimes. The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB "thumb drive" that was quietly distributed to a handful of law-enforcement agencies last June.

Microsoft General Counsel Brad Smith described its use to the 350 law-enforcement experts attending a company conference Monday.

The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer's Internet
activity, as well as data stored in the computer.

It also eliminates the need to seize a computer itself, which typically involves disconnecting from a network, turning off the power and potentially losing data. Instead, the investigator can scan for evidence on site.

More than 2,000 officers in 15 countries, including Poland, the Philippines, Germany, New Zealand and the United States, are using the device, which Microsoft provides free.

Preparing a hard drive for forensic examination can take hours and hours. You remove the drive from the computer case, write protect it, clone it, hash it and then run your examination on the cloned drive. Not anymore I guess. And maybe you don't need thousands of dollars of software either. This will surely put some companies behind the eight ball. And from the recent increased cost of upgrades for forensic suites, I say it's long overdue.