This whole coffee thing seems like a distraction to me. The Microsoft toolkit is very primitive. It doesn't do much more than run standard system utilities that are freely available, and log the results to a USB drive. It is an amateurish tool for people who know little or nothing about computer forensics.

Any law enforcement agency worth its salt is going to have a computer forensics department smart enough to remove the hard drive from the machine in question, and examine it in a non-destructive way. Thus this decaf toolkit is useless.