Disclaimer: I have never used COFEE, although I have had discussions about it with fellow digital forensic practitioners.
Unless something has changed, COFEE was intended only for law enforcement use and to the best of my knowledge it offered no real workflow integration with any of the mainstream forensic platforms. IIRC, I've heard nothing at all about it in a year or two, which leads me to believe it never really took off as a significant forensic tool.
Regarding EnCase specifically: EnCase can handle its own forensic image format, the widely used E01. It can handle RAW images. It can import native files through its Single Files feature. It can create and open its own L01 format, which is a forensically sound container format which can store various and sundry files. There are also EnScripts which allow it to exchange data (both in and out) with specialized tools like NetAnalysis, CacheBack, and others.
I don't know exactly how COFEE outputs its information but I strongly suspect that if it's any way other than native files, then the only way it could be brought into EnCase is via a custom EnScript.
Hope this helps...
Jerry
Main Topics
Browse All Topics
by: MikeHolcombPosted on 2009-10-22 at 09:07:31ID: 25635802
At this point, I do not believe data collected using Microsoft's COFEE can be imported into EnCase.
Perhaps it is just a matter of time before this functionality is allowed or I am incorrect, though a search of all my EnCase support documentation doesn't discover any mention of COFEE.
Mike