I don't understand why this isn't a hot topic on HN right now. COFEE basically just installs a suite of mostly standard system administration/analysis tools onto a USB drive, and can then be used to glean info from a suspect's computer without disturbing any running processes (so you can see if they've been logging onto super-illegal-porn.com or dangerously-insecure-server.com etc.). Plus passwords and other good stuff.