No Way Out

Twenty minutes later they were back in the office. Alex had decided not to quiz her about this latest development immediately but to let her calm down first. Her animated conversation with David had perked her up somewhat but when he asked her about the “good news” she had refused to elaborate. He sensed that she didn’t want to jinx it by talking prematurely. She would tell him in her own good time.

So now Andi sat alone in her office, searching through the laptop’s hard disk for any trace of what was downloaded from the DNA database. She was checking deleted files too. If Lannosea had really managed to gain access to the computer to log on to the Ventura LDIS and downloaded anything, then even if she subsequently deleted it, the ghost of the file would probably still be there on the system. Even if she overwrote it completely, there should be a record in the activity log.

She had to find it.

File, by file, deleted file by deleted file, she searched the disk, using a range of software tools and utilities devised for system management. Finally she saw something that made her eyes pop open. There was a file called EliasClaymore.dna and then another called nailmidfngr.dna. As she looked further, she discovered something very interesting. The nailmidfngr.dna file had been created locally on this computer, whereas the EliasClaymore.dna file had simply been downloaded.

But then as she continued to look through the deleted files, she found the shadow of another downloaded file, also called nailmidfngr.dna. This had been downloaded at about the same time as EliasClaymore.dna and then deleted. It was clear that the hacker, had downloaded the EliasClaymore.dna file and then used it to create a false evidence sample file. But why also download the real evidence sample file if they were planning to overwrite it on the DNA server with a fake one?

Maybe it was because they needed to refer to the metadata in the file header, to get it right on the forged version. Or maybe Lannosea had originally planned to create a fake Elias Claymore sample — using the real evidence sample — and then changed her mind and decided to do it the other way round.

Andi decided to compare the forged evidence sample file with what she presumed was the real one.

But what she saw this time made no sense. Because the original evidence sample file that had been downloaded and deleted was the same as the new one that the hacker had created.

Why overwrite a file with another identical copy?

Wednesday, 2 September 2009 — 9:20

“But that doesn’t make sense,” said Bridget.

She was talking on her cell phone to Victor Alvarez, from her car at San Francisco International airport, having flown in to be available to help Sarah Jensen on this, the most crucial day in the trial of Elias Claymore. It was going to be an uphill struggle winning the case if it continued. And if it didn’t, they’d have a hell of a job persuading Bethel Newton to testify at the retrial.

“That’s exactly what Paul Greenberg said. But he checked and double-checked. The fact is, whoever did it, all they did was delete the genuine evidence file that had been uploaded from a computer at the crime lab and then uploaded an identical copy from the remote computer where they were hacking in from.”

“But why would anyone do that?”

“Maybe the person who did it didn’t know that it was the same profile. Maybe they meant to upload something else and instead uploaded the same file they’d already downloaded.”

Bridget was trying to concentrate on what Dr Alvarez was telling her while at the same time navigating her way out of the airport parking lot. She didn’t relish the prospect of the morning drive across the Bay Bridge in commuter time.

“Do we know who did it?”

“Greenberg said he’d passed on some information to the FBI. I heard on the radio that Andi Phoenix was arrested in connection with it. But the hacker may have hijacked her computer with a Trojan, or spoofed her IP address. At any rate, she was released R-O-R and we’ll have to wait for the evidence hearing.”

“In any case, that still doesn’t help us resolve the question of who is actually guilty.”

“Not in itself,” said Alvarez. “The way things stand now, we’ve got two suspects, neither of whom can be eliminated by the DNA, and in both cases the chances of a random match are 500 to 1.”

“It’s worse than that, Victor. We’ve got one suspect who was identified by the victim and another who matches the age of the perp. We’ve got one who matches the description of the perp and the other who used to match that description when he was younger. We’ve got one suspect who owns a car that matches the one described by the victim and another who was caught driving that car with false number plates. We’ve got one suspect who was a rapist in his youth and another who has no priors for rape but was arrested when he tried to rape a reporter who’s covering the case.”

“The thing is,” said Alvarez, “I haven’t been able to get through to Nick Sinclair or Sarah Jensen on their cell phones. And I don’t want to leave a message with the Alameda D.A. ‘cause that might dump ‘em in the shithouse.”

“They’re probably crossing the Bay Bridge. I know Nick Sinclair lives in San Francisco and I think Sarah Jensen may be staying there. She’s been driving in with him.”

“Well, if I don’t manage to get through to them, you’d better tell them.”

“But surely it doesn’t make any difference if the results are the same.”

“Well that’s just it. You see there are some additional results.”

“What do you mean ‘additional’?” Bridget replied.

“We had one more nail sample — a third sample… from the other hand.”

“But how does that help? You said the computer guy managed to recover the original evidence sample file from the second test. Why would a third sample make any difference?”

“ ‘Cause this time we ran a mitochondrial DNA test on it.”

“And you’ve got the result?”

She could hardly contain her excitement.

“That’s what I’ve been trying to tell you. It excludes Claymore but nearly matches Louis Manning.”

“Nearly matches? What does that mean, like a sibling? A cousin?”

“Hold your horses lady! Let me explain. Okay you know that siblings and cousins who are related by the maternal line have identical mitochondrial DNA sequences in these regions.”

“I know that.”

“But two maternally unrelated people have about ten differences on average.”

“Yes but you said it nearly matches — what does that mean?”

“Well if the samples differ in two or more places they’re not related. If the samples are identical, then it means they’re related. And if there’s a difference at only one location, then it’s inconclusive.”

“And is that what we’ve got in this case? One difference?”

“No that’s the funny thing. What we’ve got in this case is two differences.”

“But you said that counts as an exclusion.”

“Well officially yes. But it’s actually quite surprising too find a difference of only two. Like I said, normally if they’re unrelated you’d expect to find about ten differences.”

“So what the heck does it mean?”

“Well there is one complicating factor that we always have to consider.”