In retaliation against Microsoft's Computer Online Forensic Evidence Extractor (COFEE), which frequently helps law enforcement officials extract data from password-protected or encrypted sources, two talented developers have created what they call "Detect and Eliminate Computer Assisted Forensics" (DECAF), to be used as a counter intelligence tool. It was specifically designed to thwart the Microsoft forensic toolkit. DECAF works by monitoring the computer it's been installed on for any indications that COFEE may be operating on the machine and does everything in its power- which is quite a bit- to stop COFEE from getting through. More specifically, the program goes about deleteing COFEE's temporary files, killing its processes, erasing all COFEE logs, disabling USB drives, and even contaminating or spoofing a variety of MAC addresses in order to muddy its own forensic tracks. DECAF can be directed... --