“But even if the REAMDE gang knew that Zula was on to them, how would they be able to trace her to Peter’s loft in Georgetown?”
“They wouldn’t,” Corvallis said, “unless they had infiltrated Corporation 9592’s China operation and had access to our logs.”
“Noted,” Richard finally said, after thinking about it for a good long while. He pulled out his phone and accessed a little app that helped him figure out what time it was right now in China. The answer: something like three in the morning. He thumbed out an email to Nolan:
“But look,” Richard said, as soon as he heard the little swooshing noise telling him that the email was sent. “The reason I actually called you was because of this.” He rested a hand atop the PC he’d carried in from the IT lab and told Corvallis the story about the security cameras and the Wi-Fi hub in Peter’s place.
They transferred the video cable from the laptop to the PC and got it hooked up to power and a keyboard. Corvallis opened the directory containing the files copied from Peter’s Wi-Fi hub. “Hmm,” he said immediately. “What was the brand name of the hub?”
Richard told him. Corvallis visited the company’s site and, with a bit of clicking around in their “Products” section, was able to pull up a picture of a device that Richard recognized as looking like Peter’s. He copied and pasted the model number into the Google search box, then appended the search terms “linux driver” and hit the button. The screen filled up with a number of hits from open source software sites.
“Okay.”
“What are you doing?” Richard asked.
“You said Peter was a geek, right?”
“Yeah. Computer security consultant.”
Corvallis nodded. “The format of the files from his hub suggests that they were created by Linux. And indeed when I do a little bit of searching I can see that it’s easy to download a Linux driver for this hub. It is Linux-friendly, in other words. So I suspect that what Peter did was set up a Linux-based system to manage his security cameras and perform automated backups and so on. And when he bought that hub, he junked the Windows-based software that shipped with it and reconfigured it to work directly under his Linux environment.”
“Which tells us what?”
“That we’re screwed.” Corvallis used a text editor to open one of the files that Richard had failed to open earlier. “See, the header on this file indicates that it is encrypted. All the files that you recovered from his hub have been encrypted in the same way. Peter didn’t want bad guys breaking into his system and snooping around in his security camera archives, so he set up his system with a script that encrypted all the video recordings before saving them to disk. And those encrypted files were then automatically backed up to the Wi-Fi hub.”
“And those are the files we are looking at now.”
“Yeah. But we’ll never get them open. Maybe the NSA could break this encryption. We can’t.”
“Can we know anything else? How old are the files? How big are they?”
With a bit more typing Corvallis produced a table showing the sizes and dates of the files. “Some are pretty huge,” he said, “which makes me think that they must be video files from the cameras you spoke of. Some are tiny. In terms of times and dates—”
They both scanned the table for a while, trying to see patterns.
“The tiny ones are regular,” Richard said. “Every hour, on the hour.”
“And the huge ones are totally sporadic,” Corvallis said. “Listen, it’s obvious that the tiny ones are being generated by a cron job.”
“Cron job?”
“A process on the server that does something automatically on a regular schedule. Those files are just system logs, Richard. The system just spits them out once an hour, and they get automatically backed up.”
“But let’s talk about the big files. The video files. It’s a motion-activated system,” Richard said. “Just look at it. There’s a file on Friday afternoon, which is when Peter would have been packing for the trip to B.C. Then nothing—except for the hourly log files, that is—until the middle of the night on the following Thursday. Which is weird. Because we know that a lot was going on in the place Tuesday morning. Why didn’t it get picked up by the cameras?”
“Actually, there is
“But then there’s a gap,” Richard said. “No more little cron job files until ten in the morning on Tuesday.”
“After which,” Corvallis concluded, “it resumes its usual habits until Thursday at two A.M.”
“Coinciding with a big video file,” Richard pointed out. “The reason there’s nothing after that is because the server that was running the whole system got trashed. Someone came back to Peter’s place on Thursday, two days after Peter and Zula had vanished. Bastard probably knew it was empty; he must have been an accomplice, or a friend of one of the bad guys. Broke in through an upstairs window. Went downstairs, triggering the security camera and causing that last big file to be created. Opened the front door from the inside. Carried in a plasma cutter. Opened Peter’s gun safe. Stole something from in there. Noticed the computer that was logging the security videos and used the plasma cutter to destroy its hard drives.”
Corvallis nodded. “That fits,” he said. “As soon as that computer was destroyed, the hourly log files stopped coming in.”
“The only part that doesn’t make sense is the gap on Tuesday morning,” Richard said. “As if the power went out for a while. But that can’t be it. The machine had a UPS.”
Corvallis was shaking his head. “A power outage would have showed up in these logs. I’m seeing nothing.”
“So how do you explain it?”
“There’s an obvious and simple answer, which is that the files were manually erased,” Corvallis said. “Someone who knew how the system worked went in between nine and ten A.M. on Tuesday and wiped out all files generated since midnight.”
“But this is the backup drive we’re looking at,” Richard reminded him.
Corvallis looked up at him. “That’s why I’m saying it had to be someone who was familiar with the system. He knew about the backup drive, and he was careful to erase both the original and the backup files.”
“Peter, in other words, is the one who did this,” Richard said.
“That’s the simplest explanation.”
“Either he was working with the bad guys—”
“Or he had a gun to his head,” Corvallis said, then winced at the look that came over Richard’s face.
“So where does that leave us?” Richard asked, somewhat rhetorically.
“The data from here,” said Corvallis, indicating the PC, “is all stuff that the cops should be able to analyze, the same way we have been doing. But unless they can get the NSA to decrypt the video files, it won’t go any further than we’ve already gone. The other stuff—the T’Rain logs that we used to make the connection to Wallace —they can’t get unless they come in our front door with a court order.”
“But they can establish a connection to Wallace just from the fact that his car is parked in the loft,” Richard said.
“I think that all you can really do is wait for them to gather more information about Wallace,” Corvallis said. “Let the investigation run its course.”
“That’s what I was afraid of,” Richard said. “Could you do me one other favor, though?”
“Sure.”
“Keep checking the T’Rain logs. Let me know if there is any more activity on any of these accounts.”
“Zula’s and Wallace’s?”
“Yeah.”
“I’ll set up a cron job to do it right now,” Corvallis said.
“Once an hour?”
“I was thinking once a
