Computer Online Forensic Evidence Extractor (COFEE) is a tool kit, developed by Microsoft, designed exclusively for use by law enforcement agencies. It help computer forensic investigators extract evidence from Microsoft Windows machine. COFEE consists of three major components the GUI interface for the investigator, the command‐line application to be executed on the target machine, and the individual tools which are managed by COFEE and the command‐line application. It can execute 150 commands on target machine. COFEE was given to law enforcement agencies by Microsoft until it was leaked
by Wikileaks in 2009. But nonetheless it is still a handy forensic tool.