Microsoft COFEE Leaked 171
54mc writes "Crunchgear reports that Microsoft's long-searched-for forensics tool, COFEE, has been leaked. The tool started on a small, private tracker, but has since worked its way to The Pirate Bay. Not all those who have gotten hold of it are enthused, and reviews have ranged from 'disappointing' to 'useless.' From the article: 'You have absolutely no use for the program. It's not something like Photoshop or Final Cut Pro, an expensive application that you download for the hell of it on the off-chance you need to put Dave Meltzer's face on Brett Hart's body as part of a message board thread. No, COFEE is 100 percent useless to you.'"
While I don't have any use for the program (Score:5, Insightful)
It's a bit short-sighted to say that nobody does. I'm sure there are lots of people out there with material on their machines that they wouldn't want a law enforcement officer to find. This tool would be perfect for their needs.
Re: (Score:2)
It sounds so basic that you really don't need to see the application to prevent it from hurting you.
Re:While I don't have any use for the program (Score:5, Insightful)
As a fan of maximizing my privacy, I would find such a tool useful just for auditing the effectiveness of my standard cleanup procedures.
You don't need to break the law to have an interest in others not seeing what you do with your computer. Whether making sure you haven't left personal financial information unencrypted on your machine, or have accidentally clicked "yes" to have your browser remember your passwords, or simply your taste in porn stars... All legal, yet things you probably would rather not leave lying around for anyone other than yourself.
Now, aside from that, don't forget that police exist to help prosecute cases, not to protect us or find the guilty party or any fluffy BS like that. Once they have you in their sights, the less they can dig up, the better. "Good news - Your alibi checked out, you didn't kill that girl. Bad news - Your computer proves that you played poker online once last year, enjoy your 2+ year federal sentence".
And hey, who better to know where Windows leaks information than Microsoft itself? Not that I would trust them as my sole source of privacy maintenance, but as I said, for auditing "best practices", such a tool would appear fairly useful.
Re: (Score:3, Insightful)
Most warrants are specific... not that I'd want to defend myself on that basis, but I'm sure a good lawyer could help you if you were investigated for child porn and the only thing they find is some evidence of Internet gambling.
On the other hand, I'd stop the Internet gambling right away, because you know they'd be looking for a way to justify getting you for that having 'lost' the child porn case.
Re:While I don't have any use for the program (Score:5, Informative)
Most warrants are specific... not that I'd want to defend myself on that basis, but I'm sure a good lawyer could help you if you were investigated for child porn and the only thing they find is some evidence of Internet gambling.
On the other hand, I'd stop the Internet gambling right away, because you know they'd be looking for a way to justify getting you for that having 'lost' the child porn case.
The *warrant* is specific, but if, in the service of the warrant, the officer finds something else, that evidence *can* be seized, and I believe it would be admissible in a court of law (IANAL!).
The police cannot search for something that is not on the warrant, however. So if the warrant specifies a "bicycle", the police would have no business looking in your sock drawer (unless said sock drawer was large enough to hold the bicycle, of course). But if the warrant specifies drugs (which could reasonably be hidden in a sock drawer), and when searching the sock drawer find a pistol, they can seize the pistol, even though it's not on the warrant.
Given the nature of a computer search, I'd expect anything on the hard drive to be fair game...
Re:While I don't have any use for the program (Score:4, Informative)
But if the warrant specifies drugs (which could reasonably be hidden in a sock drawer), and when searching the sock drawer find a pistol, they can seize the pistol, even though it's not on the warrant.
No they can't. They can only seize it if it is illegal, by itself, for the owner to possess. Now, if they find drugs as well they can probably do so under the right circumstances.
Owning a firearm, in and of itself, is not illegal for most people. This, of course, excludes certain persons such as felons, the mentally unstable and most legal, yes legal, aliens.
Re: (Score:2)
No they can't. They can only seize it if it is illegal, by itself, for the owner to possess. Now, if they find drugs as well they can probably do so under the right circumstances.
Actually, they *can* seize a perfectly legal weapon, if the police can assert that they felt it was necessary to do so to ensure their safety while performing the search. Of course, if they do this, they have to give it back again (I'm assuming they can make you jump through hoops to get it back).
That said - I didn't explicitly state it was an unlawful weapon (unregistered, in possession of a felon, etc), but that *was* what I meant. A better example would be if they were searching for cocaine, and in the
Re: (Score:2)
In my case, safes are necessary but in most they are not.
Re: (Score:2)
In the context of a legal discussion on an American centric website*, I think it is a fair assumption that most of the parties involved are talking about US laws. If we throw that assumption out the window then the "searches require a warrent" statment could also be considered false.
*Yes it is, and it has never pretended to be otherwise.
Re: (Score:2)
I hate to break it to you but I don't have a bubble to burst. Using Australia as an example for ANY firearm law is ludicrous. Their current laws were put into place in an over the top reaction to a psycho who shot some people.
An armed society is a polite society.
Re: (Score:3)
This may be true for many parts of the U. S. A. In much of civilized world,
Don't pull that "civilized world" shit. Your government telling you that you can't own them is quite uncivilized. I suppose you think the police are there to protect "you" as an individual, too.
Which, in my opion, is a good thing, but that's a different matter altogether.
Well, you're wrong. See above.
Re: (Score:2, Informative)
Re:While I don't have any use for the program (Score:5, Interesting)
They'll get you, one way of the other.
I'm too lazy to find links, but there was a case a while back of some minor who was accused of accessing child porn from one of Yahoo's services. By all accounts I've read, the defense correctly used the high probability of malware infection to introduce doubt that he actually downloaded the CP himself. Facing a harsh, drawn-out legal battle (as most defendants in these cases do), the family took a plea. The boy plead to a count of (something like) corruption of a minor. His "crime"? He apparently gave (or displayed -- can't recall) some adult magazine to one of his fellow under-aged buddies.
That's right, folks, some kid ended up with a criminal record and a listing on his local sex offender list for looking at nude pin-ups with a friend, something countless curious teen boys have done since nude centerfolds have been around.
Won't somebody think of the children?!?
Re:While I don't have any use for the program (Score:5, Informative)
Well, that sort of thing comes from the idea that if we don't tell kids about sex then they won't have it. You know, unlike their parents, grandparents, great-grandparents, and great-great-grandparents.
Re: (Score:2)
Yes but it stops the paedophiles because...er.....
Well, there ought to be a law.
Anyway, if legislators did not pass laws about everything people panicked about, we might realise how useless they are.
Re:While I don't have any use for the program (Score:4, Informative)
Most warrants are specific
Yes but IIRC, in the US, they can use any evidence, even of a crime other than what the warrant was initially for, if they found it while carrying out a legitimate search, while acting within the scope of the warrant.
This happens with Terry stops all the time: The officer has a right to perform a limited search of a suspect (a pat down) to ensure he isn't armed, but in so doing finds a nickle bag, which he can keep as evidence, even though that wasn't what he was allowed to look for.
I believe this goes back to the plain view doctrine [wikipedia.org].
Car analogy: If they have a warrant to search your car for coke, and while searching, notice a bloody body in the trunk and a machete with your fingerprints and the victim's blood on it in the glove box, they can certainly charge you with murder, even though that's what the warrant was for.
IANAL
Re: (Score:2)
FTFM
Re: (Score:2)
plus if they find Y (or evidence of Y) during a search for X they can in fact ring up a judge to ammend the warrant to include Y or W or Z or ...
this can also be used to expand the search area if evidence supports same (they have a warrant for your house but not grounds and they see something in the house that points to your shed in the garden having evidence they can get the warrant expanded to include the grounds (which they should have had anyway)
Re: (Score:2)
Um warrants are specific but you certainly can be prosecuted based on evidence discovered pursuant to an otherwise legal search on an unrelated matter. So hypothetically lets say the police suspect you of dealing in child porn (sense you used that example) and get a warrant to search your computer of electronic mails relating to that activity.
If They then open your mail program and the first 10 message subjects displayed are all "hey man its your bookie where is my money for the CAVs game yesterday" they w
Re: (Score:2)
COFEE is a live-response tool. It's by no means sufficient to audit the effectiveness of your cleanup procedures.
Re: (Score:2)
What I'd like to know is does this thing work with autorun disabled? Say your PC booted up but locked, will this thing be able to access the data on it?
It's important because if it can then is bypasses the usual autorun mechanism, which as a security precaution I leave disabled and which Vista/7 put up UAC prompts for. I already disabled by Firewire port because that can be used to access the computer's RAM via DMA without any user interaction.
Re: (Score:2)
You use virtually all forensic tools like this on an offline system - Meaning that you most likely boot to it, and it inspects the HDD in read-only mode.
Actually using this on a live, running system just begs to have any findings thrown out on grounds of tampering with the evidence... "So, you use this little USB stick on a lot of machines, Officer? Did any of those machines have a virus? Congratulations, you didn't find child porn,
Re: (Score:2)
COFEE runs on a running system. Encryption is a big problem for law enforcement so they need tools which can grab keys from a working system. If you read the documentation it states that the software is designed to have as little impact on the running system as possible.
Re: (Score:2)
The grandparent was discussing Australia. Nobody is going to going to be fined or even tried by an Australian court for playing online poker. I'm not sure what the case is when something is banned in other countries, but in Australia, generally it just means it can't be
Re: (Score:2)
Wow, you are the least civil person I have encountered on slashdot. I am sad I didn't just simply mod you down rather than waste the effort to reply to your enraged and incoherent ranting.
Re:While I don't have any use for the program (Score:5, Insightful)
I agree. Using the software may not prove useful, but studying the software to see how it works might be. It is said the software can decrypt passwords and access otherwise inaccessible files. If true, that would be a major security hole that black hats could exploit, so the public has the right to know what exactly COFEE does, how it works, and how to defend their systems from it and similar software.
Re: (Score:2)
It is said the software can decrypt passwords and access otherwise inaccessible files
This is probably true if one depends upon Microsoft products for their security (ha). However, I would wager that the sorts of people that COFEE is typically used against are not depending upon the built-in Microsoft file encryption for their security needs. They probably use open-source security tools (non-Microsoft browser with private browsing, TrueCrypt or other Full Disk Encryption software, and hidden partitions/OS). There are generally two types of people in this world when it comes to security; (1)
on a live computer system? (Score:5, Insightful)
So, don't run windows, encrypt your drive with hidden partitions and turn the thing off when the cops arrive.
Re: (Score:1)
Re: (Score:3, Interesting)
One of the things that happened during the "Hacker Crackdown" in 1990 was that Law Enforcement were trained to quickly separate people and their computers. Then take pictures of the set-up before touching anything. IDK if that is still the case or if they do it for say any old warrent they are serving.
Re: (Score:2)
Re: (Score:2)
Mercury tiltswitch from a thermostat + relay. Cuts the power if anyone tries to move your box. It wouldn't be hard to wire it such that it sends mains voltage to your hard drives instead, but I stopped short of that because I was just doing it for fun and didn't want an accidental kick to the tower to destroy all of my data.
Re: (Score:2)
And watch out for evil maids [schneier.com] installing [blogspot.com] malware [stoned-vienna.com] that subverts your encryption and sends/stores everything unencrypted.
And don't tell me that ain't easy with Linux.
That's right, you can never leave your computer unlocked unattended. Realistic?
Not having seen the app, but (Score:5, Insightful)
Re:Not having seen the app, but (Score:5, Insightful)
I would think even mere insertion of a USB device into a computer could lead to all sorts of problems - what if that USB key had a virus that transferred itself to the PC and then deleted itself from the USB device? The fact that this is a bog-standard set of files means that someone has to put these programs onto a writable USB drive (it's possible it's write-once but I would be dubious of that actually being the case) and then plug it into a computer - exactly the action that companies block by default because of the potential for rogue programs to be introduced and destroy/modify data.
Want to put someone in jail? Put something illegal on that USB drive, plug it into their computer with an autorun script that copies itself over and then deletes itself (and the script) from the USB drive. Then claim that it was a *different* drive you put in and submit a "clean" drive as evidence if they demand to see it.
Not to mention that actually doing *anything* on the original PC is damn stupid anyway but relying on a USB stick to run it? That's got to be asking for trouble. Oh, and disable USB and you've just stopped that attack.
I was always told that *anything* capable of writing to the drive or modifying the data you're trying to access was a no-no... that's why they image the drives through special "read-only" adaptors (apparently harder with SATA nowadays) and then analyse the image. Saving transient information onto a writable USB stick by execution of a program from that stick? Sounds like a recipe for disaster. That's gotta touch your swap or do something to memory in order to execute and proving that happened cleanly and provided a complete accurate copy of the contents of RAM/disk/swap before you plugged it in is probably impossible.
Re: (Score:1, Insightful)
Once again, slashdotters seem to think that because something involves a computer it's a new concept, rather than one that has been around since the beginning of civilization.
How is that ANY different than any other case where someone given the task of investigating a crime decides to set up a frame instead? It's not. Planting files on someone's hard drive is exactly like planting fingerprints. Or before fingerprints, planting a gun. Or before guns, planting a weapon with blood on it.
Please stop thinkin
WRONG (Score:3, Interesting)
You are 100% incorrect.
I would think even mere insertion of a USB device into a computer could lead to all sorts of problems
The mere insertion of a USB device has its problems. First, you have to differentiate. Say, on a WinXPsp2 machine, a USB device has no working autostart mechanism. You can circumvent that, e.g. by using those "U3" devices that emulate a CD drive (Autostart is working fine with CD drives if you didn't disable autorun at all) or like the Conficker worm does, by displaying an "open folder" icon that will result in the action of calling
Re: (Score:2)
The idea of the utility-pack is to be run when the OS is still working (e.g. to capture passwords that are still in memory etc.). Bootable devices are another thing entirely. Such "off-line" analysis is much easier to do by just copying the drive in a special device that has no write logic to the source drive at all. You wouldn't risk an entire investigation just because you used a bootable CD to access the hard drive first, you'd access the copy.
Re: (Score:1, Informative)
"Microsoft COFFEE Spilled" (Score:5, Funny)
DECAF (Score:3, Funny)
"Won’t be long before DECAF is released, which will block attempts to use COFEE on your machine, I’m sure."
-- Mister Toast, Nov 08, 2009, 13:58 [torrentfreak.com]
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Raymond Chen wrote a blog posting about this: http://blogs.msdn.com/oldnewthing/archive/2009/11/05/9917671.aspx [msdn.com]
The installers of the coffee machine didn't consider the number of visitors. I don't see what it has to do with software leaking though.
At least 2nd degree burns to the groin (Score:2)
I believe you must have at least 2nd degree burns to the groin region before it validates a lawsuit.
The Solution? HURD! (Score:5, Funny)
Its a tool written by Microsoft, for Microsoft products. Do you have nefarious stuff you'd rather not have leaked? Warez or other secret stuff you'd rather keep hidden? The solution? Don't run Windows, run HURD! As added bonus, there's no viruses, no nasties that'll install on your system. No COFEE or other LEO programs to infect your privacy.
HURD...The only sensible solution. [wikipedia.org]
Re: (Score:2)
Do you have nefarious stuff you'd rather not have leaked? Warez or other secret stuff you'd rather keep hidden? The solution? Don't run Windows, run HURD! As added bonus, there's no viruses, no nasties that'll install on your system.
Are you fucking serious?! The HURD has been in development for almost 20 years, still isn't properly finished, and I've never heard of any software for it, aside (I assume) from the GNU stuff that forms the basis of any Linux distro anyway.
The HURD has likely missed the boat anyway, Linux drove it away years ago.
Re: (Score:1)
Re: (Score:3, Insightful)
Re:The Solution? Removable Drive Bay (Score:3, Interesting)
Anyone who is truly concerned with security knows that you take your drive with you and/or lock it up at night. Thankfully SSDs are lightweight and easy to stick in a pocket. I'm amazed at how many businesses don't have any physical protection plan in place, because that's how most data ends up getting into the wrong hands.
http://www.startech.com/item/SAT2510U2REM-InfoSafe-35-Bay-Removable-25-SATA-Drive-Enclosure.aspx [startech.com]
Under $40 for this model.
Re: (Score:2)
Re: (Score:2)
You've got that right. Many of the people I have worked with have excellent heads for business, graphic design, administration, or programming, but I still don't trust them to put their pants on the right way around every morning. Why would I want them pulling their hard drives out of their computers every night?
Re: (Score:2)
The typical "solution" to this is to check you drive in and out every morning, at least in places that do this sort of thing.
Re: (Score:2)
Maybe. Except things like Firewire (and some USB controllers) allow a device to read all the memory, so they are practically operating system agnostic. They can just grab a live memory image of your Hurd running, which will contain the hard drive crypto key (the only really interesting piece of information I can think of, if your HDD is not encrypted, you don't have much privacy anyway).
Creation of Adam... thought it was the same story (Score:3, Funny)
At first I thought these two stories were related.
http://gizmodo.com/5399583/famous-paintings-reproduced-in-coffee [gizmodo.com]
I was about to download the MS tool so I could create my own spectacular tasting, eye-opening, knock-off classic art.
Bloody DUH (Score:5, Insightful)
Well, of course it's useless to most of them...but that has nothing to do with whether or not COFEE is any good. Let's face it; how many casual downloaders are going to need a forensics toolkit? They already have access to all of their own files, and already know what they've been doing with their system. And COFEE is not meant to be a "point and shoot" system; it's really meant for professionals that know what they're looking for to some degree. So getting a copy and using it doesn't instantly give you some insight into how computer forensics work.
"COFEE is 100 percent useless to you" (Score:1, Redundant)
with that ringing endorsement and the spelling that looks annoying like "coffee", but not quite... I didn't even read TFA
I'm not even sure why I'm even commenting.
This is kinda like the message you occasionally see on Slashdot for idle.slashdot.org "don't go there"
Of course it's useless... (Score:1, Redundant)
Ummm.... well.... (Score:5, Insightful)
> No, COFEE is 100 percent useless to you.'"
Yes, and the software that runs voting machines is "useless to us", too.
I think the submitter is missing the point. This (probably) closed-source tool by Microsoft (that bears repeating... by MICROSOFT) is going to be used by law enforcement to help throw people in jail. If for no 'practical' use, now that COFFEE is leaked, people will be able to reverse-engineer it an see exactly what it is doing, and how. That is a good thing.
free alternative (Score:3, Interesting)
Yummy! (Score:1)
Hmm... I wonder (Score:2)
I wonder... does cofee have a java component?
Can Cofee check my Kaffeine history?
Yes, but does it run Gnu/Linux on Alpha and others (Score:1, Informative)
As having known a person who had their house raided by the Calgary Police (many times) and their computers stolen as a result of their former employer making false claims, the tool is as useful as the Calgary Police Computer Tech Team (or whatever they are called today).
I saw the photos of the damage caused by the Calgary Police, cut keyboard cables, broken doors, general damage done to the house, broken commercial (legally bought PS3 games, music, films) CD/DVD/BDs, broken case covers, cut USB cables, are
Re: (Score:2)
Re: (Score:2)
That's the nasty sort of positive feedback loop from which an innocent person, once trapped, can never escape. The burden of proof should grow each time, not shrink, to prevent police harassment.
Re: (Score:2)
As having known a person who had their house raided by the Calgary Police (many times) and their computers stolen as a result of their former employer making false claims, the tool is as useful as the Calgary Police Computer Tech Team (or whatever they are called today).
"Many times" probably occurred due to not finding anything, and said employer continuing to insist there was.
Re: (Score:2)
Some links would be useful. This is the internet after all :)
Re: (Score:2)
Thanks AC !
Nice but there are more robust tools (Score:1)
Cofee leak (Score:1)
How do we know that Microsoft didn't intentionally leak this?
Maybe they did it so that they can start selling Microsoft CREAM!
What about locking your computer? (Score:2)
Would this utility be useless if you lock your computer when you get up from it? If so, the criminally-minded among us should do that.
If it works even with the computer locked, it implies a Microsoft back door into Windows. I doubt this.
Horay, MS is on the right track! (Score:2)
Couple of days from now there will be a HOT COFEE mod for Windows. So much more comprehensive than whatever was in GTA.
You can find EnCase on TPB also (Score:2)
Re:But (Score:5, Informative)
Wikipedia is your friend [wikipedia.org].
Re: (Score:1)
Ah, yes; the stalking horse to justify the destruction of the individuals' right to privacy. And of course, this evidence could never been planted by self-same investigators via their self-same COFEE USB key. Perish the thought.
Re: (Score:3, Interesting)
As far as I know, COFEE is only used when you have a search warrant. If you have a search warrant, then by definition there is no right to privacy - by granting the search warrant, the court has said that investigators are allowed to look at your stuff.
In the past, people have tried the "I was framed by the police" gambit before with very limited success - typically courts assume that the people investigating crimes aren't out to plant evidence. I'm not sure that this is a wise decision on the part of the
Re: (Score:2)
typically courts assume that the people investigating crimes aren't out to plant evidence. I'm not sure that this is a wise decision on the part of the courts but it is what it is.
generally courts presume everyone is honest and play by the rules unless there is some specific reason to think otherwise. It probably can be no other way. if the court assumed everyone was a liar, then it would be impossible to get anywhere, as the only evidence would be evidence submitted by other people also presumably lying.
the sad fact is that if someone really wants to fuck you over, they probably can. but planting evidence is one of the more complicated ways of doing it.
Re: (Score:2)
You're right, I should have been more specific. If a LE officer has a search warrant for the contents of your computer, then he has the right to access the contents of your computer, your right to privacy doesn't apply.
Re: (Score:2)
Re: (Score:2)
Any computer forensics expert worth their degree will tell you NEVER to do anything to a running mac
Re: (Score:3, Informative)
Try Helix3. Don't jump up and down, telling me that it's another Linux LiveCD. There is a Windows executable in the root directory to capture system state stuff. When that finishes, you can reboot to the LiveCD for more tools.
They have an outdated version that is free, and if you wish to pay about 7 or 8 hundred bucks, you can get the up-to-date version.
Re:But (Score:5, Insightful)
Really... why should we have to look up something stated in the summary as "100% useless to us"? Thanks fuck head!
Because:
1) You are wondering what is the damn thing in the first place (like OP did), and
2) You want to make your own opinion.
No one is forcing you to read through the wikipedia entry. I hope, for the sake of people around you, that you don't flip out as easily in real life.
Re:But (Score:5, Insightful)
Responsible Mods needed...
Come on...this guy responds to someone, who calls him a fuck head for providing a link to information connected to the post, in a calm and measured way, and somehow he gets modded flamebait?
If that doesn't get fixed, I've lost the last little bit of trust I have in the /. mod system.
Re: (Score:2, Funny)
heh heh. he said he had trust in the mod system. heh heh heh.
Re: (Score:3, Funny)
Re: (Score:2)
That lady is most likely a model who was photographed by someone else, who in turn sold a photo license to microsoft.
Stock photography sucks (Score:1, Informative)
Re: (Score:1)
Re: (Score:2)
You mean like you could find here: http://www.headsethotties.com/ [headsethotties.com] ?
Re: (Score:2)
I don't know about talking to her or putting cream in her mug, but if you look through the comments below, you can get a pic at 12k resolution for ~£700. Once you've seen her skin magnified that much, you'll likely be cured of any interest you once had ;)
Re: (Score:2)
What does someone in the "security field" know about a digital forensics tool?
Very few people are actually in the security field and most who claim to be have posted a bug on a mailing list and setup a site talking about how to "hack" with Visual Basic.
Re: (Score:2)
There's nothing wrong with that. Some guys come out of the IT trenches and some come out of the management world. Most of these security guys are presenting themselves to middle and upper level management. They only need to know how to make charts and graphs, for which VB is really very good.
They of course also need to know how to get policies signed, walk into strange meeting rooms, identify and get key people into meetings to understand those policies, implement and audit them regularly. If they hav
Re:As someone in the Security Field... (Score:4, Informative)
The lowdown:
It doesn't do anything that any number of freely available, open source tools don't do (most of which, or at least most of the lineage of which can be found in Knoppix-STD (www.knoppix-std.org), and it happens to do them poorly.
Re:As someone in the Security Field... (Score:5, Interesting)
Why has the STD distro not been updated in over 5 years?
Have you tried http://www.remote-exploit.org/backtrack.html [remote-exploit.org]? It's geared towards pen testing and ethical hacking... but it's VERY good, and modern.
Re:As someone in the Security Field... (Score:5, Insightful)
If only you'd bothered to write that in the summary, rather than the clever-clever "You don't need this" shenanigans. Half these initially posts could have been avoided.
Re: (Score:2)
...then it would have been cut out as not being sensationalist enough for an article summary.
You're new here, aren't you?
Re: (Score:3, Funny)
Useful (Score:2)
If you are redhat racing with ms , you can use his tool to prove that their platform can't be trusted. All you need is running it.
Re: (Score:2)
You're safe - no one wastes mod points on an AC.
Re: (Score:2)
Generally, you don't run the forensics software on the target computer; that would be stupid.
Generally, you pull the hard drive out of the target computer, plug it into a drive duplicator (which can be a simple as a PC with an IDE cable missing the write pins), mount the duplicate, and scan it. No executables on the duplicate are actually executed.