Two bad boy hackers have come out with a tool called DECAF. It defends against a COFEE, which is a Microsoft tool that stands for Computer Online Forensic Evidence Extractor. DECAF will check for the presence of COFEE on your machine. It will then delete temporary files, erase logs, and disable USB ports (from which COFEE runs).The source code for DECAF has not been released. However it is being licensed for free as long as you use it for personal and noncommercial uses. The app looks like a really simple Windows app. It does real time monitoring. And it claims to be highly configurable. You can disable all kinds of things on your machine.
In the future, the developers of DECAF intend to modify the program so that it can be remotely controlled. This sounds like some good stuff. I guess to test it out I will have to install COFEE on a memory stick and see what DECAF can do
