The growing use of encryption software -- like Microsoft's own BitLocker -- by cyber criminals has led Microsoft to develop a set of tools that law enforcement agents can use to get around the software, executives at the company said.

Microsoft first released the toolset, called the Computer Online Forensic Evidence Extractor (COFEE), to law enforcement last June and it's now being used by about 2,000 agents around the world, said Anthony Fung, senior regional manager for Asia Pacific in Microsoft's Internet Safety and Anti-Counterfeiting group. Microsoft gives the software to agents for free.

While Microsoft can point to wide usage of COFEE, some experts are skeptical about using that type of tool to recover data, and even the developer of the product at Microsoft acknowledges that it's not accepted by some users.

Fung, who initiated the creation of COFEE, spent 12 years as a police officer in Hong Kong, with the final seven dedicated to fighting cybercrime. When he joined Microsoft, he sought to devise a way that agents could do better at finding valuable information on computers used by cyber criminals.

When he was an officer, the protocol for handling computer crime was to remove a computer from the scene of the crime, taking it back to the lab where computer scientists would search it for information. In many regions of the world this is still the standard procedure. "At that time everybody followed that principle, but they knew that once they unplugged the computer, which was the guideline, a lot of potential information was lost," Fung said.

That's because data on an encrypted system is accessible to police so long as the criminal has logged on and the PC remains on. But if police shut the system down, they need to have the criminal's password to get past the encryption software when the computer boots back up. The release of Vista has accelerated the problem because BitLocker, a data encryption feature, comes with Windows Vista Enterprise and Ultimate versions, Fung said.

"Criminals are taking advantage of these technologies like BitLocker," Fung said. "BitLocker was the real driving force because it's becoming ubiquitous." In addition to BitLocker, other hard disk encryption methods, like one from PGP, also frustrate agents, he said.

The IDG News Service is a Network World affiliate.

Whitepapers

• The Trend from UNIX to Linux in SAP(r) Data Centers
• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology

View more SECURITY whitepapers

Webcasts

• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports