The FBI tech finished the boot and in DOS, not Windows, typed in the command to make the forensic image. The little lights that showed hard drive activity started to flicker, the machine making an intermittent chirruping that reminded her of a cricket.
He got up. “Okay, where do we eat?”
“You’re hungry? It’s only ten o’clock.”
“Jet lag. It’s dinnertime for me — at least, I think that’s right.”
“What about this? You’re not going to just stop. We need access to whatever’s on this drive. It’s urgent.”
“Really urgent? Or just department urgent?”
She looked at Yousif, who hesitated, then nodded. She told Nim-merich, “Really urgent. You know someone tried to bomb one of our ships.”
“They told me that. Yeah. A navy ship, right?”
“USS
“You mean, another bomb?”
“Based on the MO, we think he’s done this before. It’d be nice if we could catch him before the next one.” She glanced at the flickering lights. “So if you can do that for us—”
Nimmerich checked his watch. “Okay, I’m motivated, but it’s still gonna take awhile. What it’s doing now, it’s actually checking each bit on the disk and copying it and checking to make sure it copied it right. Then it goes on to the next one. It’s going to do that even for the overwritten parts, even for the parts on the drive that were never used.
“After that we’re gonna try our recovery procedures, sector by sector. I’ll look for hidden files, then any temporary or swap files used by applications or the operating system. I’ll go through the unallocated spaces and any slack space. Then we go after password-protected or encrypted files. I’ll go as fast as I can. But we still have to analyze the system as we go, list all the files of interest and any data we discover. That’s evidence, too — file structures, authorship information, any efforts to hide or delete or encrypt data. Okay? You following all this?”
“Actually I was.”
“Good,” he said. “So. Where are you taking me to eat?”
The image took four hours to make. When the screen showed OPERATION COMPLETED, Nimmerich powered down the computer, took the side panel off again, and slid the evidence drive out. Yousif immediately held out his hand. The SIS man locked it in the briefcase and left. While he was gone Nimmerich fitted a second blank hard drive in the upper bay. Then, using the SafeBack disk again, he recopied the image to the second blank hard drive.
Meanwhile she drove back to the base and caught up on her e-mail and phone messages. Four hours later she was back at the ministry to find Nimmerich blinking sleepily and drinking coffee with Yousif. Which she hadn’t thought Mormons were supposed to do, but she didn’t ask, didn’t want to bring up religion in any way, shape, or form.
Nimmerich had put the computer’s original hard drive back in and loaded Norton Utilities for the analysis. He explained what he was doing as he used the diskedit feature to recover files.
“Hmm. He reformatted it.”
She said, “I thought so, when I found it wouldn’t boot. When we discovered it. That wipes everything, right?”
“Not exactly, but it makes it harder.”
Yousif said, “These are all erased files, right?”
“Erased, right, but also reformatted. You probably know this— Aisha?”
“Right.”
“But what DOS actually does when you erase something, it just reclassifies that file sector from ‘used’ to ‘available.’ That’s easy to recover, especially the last things they deleted before they left, that’s all gonna be there. But this guy’s wise to that, he actually reformatted. Then it gets tricky. But fortunately he didn’t have the software for an actual wipe. That overwrites every physical byte on the disk.” He worked on for some minutes. Then he clicked his tongue as a list of files came up. She saw some titles were in Arabic, others in English, a few in a character set she didn’t even recognize.
“Here’s something. Can you read this?”
Yousif leaned forward, too, as she went down it, reading the titles and translating. Nimmerich clicked his tongue again. “Here’s his system. The stuff in English is unprotected. Everything else is password-protected. I’m gonna assume the passwords are in the same character set as the file name. I got one program that just runs through all the possible combinations that you give it. A five-character password, that’s not gonna take it too long to … How many letters are there in Arabic?”
“Twenty-nine,” Yousif said.
“Well, we’ll try that first.”
It took him awhile to set up the program, but after twenty minutes’ run time it opened the first file. “Uh-huh. Uh-huh.” Nimmerich made another note in his spiral-bound, then went back to keyboard and screen. “Okay, this looks like a graphic of some kind … reach into my bag of tricks … we’ll try QView Plus … Anybody recognize this?”
