Computer Online Forensic Evidence Extractor (COFEE)

Easily capture important "live" computer evidence at the scene in cybercrime investigations, without special forensics expertise.
Law enforcement agencies around the world face a common challenge in their fight against cybercrime, child pornography, online fraud, and other computer-facilitated crimes: They must capture important evidence on a computer at the scene of an investigation before it is powered down and removed for later analysis. "Live" evidence, such as active system processes and network data, is volatile and may be lost in the process of turning off a computer. How does an officer on the scene effectively do this if he or she is not a trained computer forensics expert?

More:
http://www.microsoft.com/industry/governme...ee/default.aspx
http://arstechnica.com/microsoft/news/2009...-free-cofee.ars
http://seattletimes.nwsource.com/html/micr..._msftlaw29.html