RE FORUM

[REVERSE ENGINEERING] => Off topic => Topic started by: DARKER on November 11, 2009, 06:53:00 PM

Title: Microsoft's COFEE forensics tool leaks online
Post by: DARKER on November 11, 2009, 06:53:00 PM

Microsoft's secret Computer Online Forensic Evidence Extractor (COFEE) has leaked online, available for all.

Viac na:
http://www.neowin.net/news/main/09/11/09/microsofts-cofee-forensics-tool-leaks-online
http://praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/
http://www.chovancik.cz/stitky/vaznejsi/page/2/

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: llAmElliK on November 11, 2009, 09:30:10 PM

Mam - muzu poskytnout  ;)

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: DARKER on November 11, 2009, 09:56:53 PM

hej da sa to najist na nete, ale ta app sa mi zda dost slaba co sa tyka "kvality sluzieb" a tiez sa hovori ze vraj to nie je kompletne (45 commands - 150 in full)
postradam tam dake featurky kt normalne vyuzivam ;)

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: llAmElliK on November 11, 2009, 10:33:06 PM

Jo - to je mozny, ale je docela zajimavy procitat co jaka apzz a kde si uklada - manualy obsahuji kompletni vypisy registru apod. - jsem to rikal vzdycky ze to jsou z*rdi na microshitu..ale stejne to pro cz policajty nebude - pro uplny dementy to neni.

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: Radegast on November 24, 2009, 06:41:47 PM

Quote from: llAmElliK on November 11, 2009, 09:30:10 PM

Mam - muzu poskytnout  ;)

to by bylo fajn ... mam zasifrovany data (svoje) ke kterym jsem ztratil pristup ..

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: NeptuN on November 24, 2009, 07:12:49 PM

Tak to hodte na ftpko, nebo sem dejte linky pls, torrenty jsou uz mrtve.

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: DARKER on November 24, 2009, 07:22:38 PM

Quote

mam zasifrovany data (svoje) ke kterym jsem ztratil pristup ..

zavisi cim, ak len NTFS to by malo ist aj s inymi tools

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: NeptuN on November 25, 2009, 01:11:08 AM

Na torrentech to stale jeste je  ;)

Jinak co se tyce, ocekaval jsem vice dokumetace (treba trochu o pouzitych nativnich APInach), takhle na to holt clovek bude muset po zlym s Ollym  :D. Osobne sdilim podezreni, ze si tyhle zadni vratka pripravili dopredu.

Bohuzel jedu pod linuxem, takze nemuzu vyzkouset...  :( , dejte echo, jestli to vubec funguje, od Micro$oftu toho totiz moc neocekavam.

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: Radegast on November 28, 2009, 05:58:27 PM

Quote from: DARKER on November 24, 2009, 07:22:38 PM

Quote

mam zasifrovany data (svoje) ke kterym jsem ztratil pristup ..

zavisi cim, ak len NTFS to by malo ist aj s inymi tools

no to prave ne :-( je to truecryptem ... heslo si pamatuju, ale poskodilo se mi keyfile :-( vidim to na 99,9999999% ze uz to nedesifruju :-(

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: llAmElliK on November 28, 2009, 06:54:23 PM

A chces to tedy nekam upnout?

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: DARKER on November 29, 2009, 10:57:12 AM

Quote

truecryptem ... heslo si pamatuju, ale poskodilo se mi keyfile :-(

no v pripade truecryptu mas potom asi smolu, nevidel som este daky BF tool na TC ... a keby aj bol tak na keyfile by asi nestacil, ale pokial by si mal TC volume chraneny iba heslom tak by este bolo ako tak mozne ...

Mozno by sme mohli nieco nakodit :-)

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: NeptuN on November 29, 2009, 11:11:18 AM

no jasne, nakodit brute force, ;D a v pristim zivote (mozna az prespristim) se konecne dostanes k tem svym datum  ;D

jestli nemuzes pouzit keyfile, tak se k nim proste nedostanes. Mozna jestli ho mas jen poskozeny (jeden dva znaky), tak by to jit mohlo, ale jinak...  :P

Title: Re: Microsoft's COFEE forensics tool leaks online
Post by: DARKER on November 29, 2009, 11:19:47 AM

Quote

a v pristim zivote (mozna az prespristim) se konecne dostanes k tem svym datum

no pokial by mal volume chranene iba heslom a heslo pomerne kratke (do 5 znakov) tak su to celkom realne cisla, v pripade ze by sa pouzil distribuovany utok tak by sa dlzka hesla mohla mierne posunut smerom hore :-)