I felt a fizz of excitement.
Though sealed in plastic, the item was familiar.
22
I HURRIED TO THE BEDROOM, FLOUR-COATED HANDS HELD AWAY from my body.
“Find something?” Chenevier asked.
“In a canister. Better shoot it in situ then dust for latents.”
Chenevier followed me back to the kitchen. Scribbling an evidence label, he photographed the bowl from several angles. When he’d finished, I extracted the object, tapped it on the rim, and laid it on the counter.
Chenevier snapped more photos, then checked for prints on the object’s outer surface. There were none. Twirling a finger, he indicated that I should unroll the plastic. I did. He photographed every few inches.
Within minutes, a baggie, an eight-inch length of clear plastic wrap, and a thumb drive lay side by side on the Formica. None yielded prints.
“Got something,” I called into the living room.
Ryan joined us. Floating one brow, he brushed flour from my nose.
I narrowed my eyes in a “don’t say it” warning.
Ryan handed me a towel, then scanned the small assemblage beside the bowl.
“USB flash drive,” I said. “Sixteen gigabytes.”
“That’s massive.”
“You could store the national archives on this thing.”
Ryan indicated that I should bring the thumb drive to the computer. Chenevier returned to the bedroom.
I passed the drive to Lesieur. She thumbed a button, and a USB connector slid from one end.
“We got paper for this?”
Ryan nodded
Reaching under the workstation, Lesieur inserted the drive into the CPU tower.
The computer ding-donged, then a box appeared requesting a password.
“Try using Cormier,” Ryan said.
Lesieur shot him a “you’ve got to be kidding” look.
“Try it.”
Lesieur typed
The screen changed. A new box stated that a removable device had been detected, and that the disk contained more than one type of content.
“What a bonehead.” Lesieur hit several keys.
Columns of text appeared. Folders. Files. Dates.
Lesieur opened a file. Another. Ryan and I leaned in for a better view of the screen.
“I’ll be at this awhile.” As before, her message was not subtle.
Ryan and I returned to the kitchen.
Several cabinets and a silo of cereal and cracker boxes later, Lesieur spoke. Ryan and I went to her.
“OK. Here’s my take. Everything looks innocent enough on the surface. Tax returns. Business files. But I think your guy’s got another whole layer buried in the unused space of his thumb drive.”
Ryan and I must have looked blank.
“Some of the newer encryption programs provide plausible deniability by creating two layers. The user stores some innocuous files in the first layer. Tax returns, business contacts, information a reasonable person might want to encrypt. The second layer is a disk volume hidden in the ‘unused’ space of the drive.”
“So Cormier uses a simple password for layer one because he doesn’t really care about those files,” I guessed. “It’s a cover. He’s really concerned about layer two.”
“Exactly. With this type of setup, if someone starts poking around, they see some files, some open space, everything looks copasetic. When they view the open area of the disk byte by byte, all they find is gibberish.”
“That’s not suspicious?” Ryan asked.
Lesieur shook her head. “Operating systems don’t normally delete deleted files. They just change a marker that says, ‘This file has been deleted and can be written over.’ Everything that was in the file is still on the drive until its space is needed, so if you look at the unused areas on a normal disk drive, you’ll see bits and pieces of old files. Remember Ollie North?”
Ryan and I both said yes.
“That’s how Irangate investigators recovered information Ollie had deleted. Without those chunks of old files,
