The Command (49 page)

Nimmerich said, obviously trying to be helpful in a situation he didn't understand, “She could help evaluate the files, if I can recover any. If they'll be in Arabic.”

“We'll provide any language expertise necessary.”

“Forget it, Major. Nimmerich's not gonna have any idea what he's looking at. So without her, no deal,” Diehl said. He got up. “Come on, Arnie, we're booking you back to D.C.”

Nimmerich looked up, surprised and not pleased. Or, she thought, he didn't like being called Arnie. Yousif said disapprovingly, “You're not cooperating, Bob.”

“You're
not cooperating, Major. A joint investigation means both sides get the results of all the forensics. That means both sides are
at
the forensics. But either you don't trust us to turn over everything Arnie here gets off that drive. Or else … Could there be something on it you don't want us to see?”

He didn't look at Hassan when he said this, but Aisha smiled. The senior agent might not know the local language, or the latest technology, but he'd smelled the same rat she had.

“Ridiculous. Of course we'd share everything, Bob.” Yousif motioned
like he was smoothing out a rumpled cloth, but he was showing the strain. She had noticed that he gnawed at his mustache when the pressure was on. He kept looking from Diehl to Hassan, as if caught between irreconcilable responsibilities. “Sit down, please. Commander Hooker, talk sense into him. We're all friends here. We've always been open with you, haven't we? Always shared everything? Well, well… if you want her there, she's welcome. Aisha? We'll issue you the appropriate passes and so forth as soon as we break.”

But the Saudi didn't like it. Aisha didn't miss how he stayed in his seat as the others rose. The flash of distrust, dislike, maybe even hatred, as their gazes clashed, just for a moment, then turned aside.

THE room was on the third floor of the ministry, in a lofty-ceilinged work space that bore all the hallmarks of being hastily converted to its new use, like folding tables and lots of extension cords. Four computers were set up around the walls. Two Pentium Gateways, the Sanyo from the madrassa, and an Apple. The last was the only one with a modem, set up with an encryption program for Nimmerich when he had a question for the guys back at Quantico. A laser printer, too, a hulking cream-colored Hewlett-Packard the size of a small refrigerator.

Nimmerich began by examining the hard drive again, making notes in a fresh spiral notebook. “So how do we proceed?” Yousif asked. He'd attached himself to them, and it didn't look like he was going to leave.

Nimmerich said, slightly pompously, she thought, pointing to the nearest Pentium, “First I'm going to convert this into a forensic workstation. Then I'll explain as I go, all right? If you're interested.”

“I'm interested,” she said. While Yousif sat back, making it plain as he could without saying so that the actual work of recovering the data was beneath him.

“Most girls don't know much about computers. Or care.”

“I'm probably not like the other girls you know,” she said.

Nimmerich pursed his lips, but didn't follow that one up. In fact he reddened and buried himself in his work.

Using screwdrivers from a kit in his briefcase, grounding each on a conductive pad, he took off the side panels to access the interior of the computer. He pulled off cables, slid out the hard drive, and replaced it with the evidence hard drive.

He said, not meeting her eyes, “Okay. I'm going to configure the evidence as the master, and this second drive as the slave.” He installed
one of the blank, formatted drives he'd brought in the lower bay. “Now we're gonna copy it to this new drive, make what we call a forensic image. That means everything: active files, deleted files, hidden files, password-protected stuff, everything. Then we'll take the evidence out and bag it again. Protect it from viruses or data corruption, and any accusation from the defense we added files that weren't there.”

When he had the machine buttoned up again, he put a 3.5-inch minidisk in the A drive and turned the power on. As it whirred and images flickered across the screen she said, “What was that? A boot disk?”

“Uh-huh.”

“Why don't you boot from the hard drive, like usual?”

“So we don't accidentally write to the original evidence. I just took a normal boot disk and neutered it—made all the pointers look at the floppy disk, and not the hard drive. That's also got the SafeBack software, the utility I'm going to use to make the image.”

Aisha kept watching, a little surprised this wasn't black magic. She was following everything so far.

The FBI tech finished the boot and in DOS, not Windows, typed in the command to make the forensic image. The little lights that showed hard drive activity started to flicker, the machine making an intermittent chirruping that reminded her of a cricket.

He got up. “Okay, where do we eat?”

“You're hungry? It's only ten o'clock.”

“Jet lag. It's dinnertime for me—at least, I think that's right.”

“What about this? You're not going to just stop. We need access to whatever's on this drive. It's urgent.”

“Really urgent? Or just department urgent?”

She looked at Yousif, who hesitated, then nodded. She told Nim-merich, “Really urgent. You know someone tried to bomb one of our ships.”

“They told me that. Yeah. A navy ship, right?”

“USS
Horn,
here in Manama harbor. This belonged to the perp. We missed him just by minutes, the day of the attempt. We think he's on his way to do the same thing, or something like it, somewhere else.”

“You mean, another bomb?”

“Based on the MO, we think he's done this before. It'd be nice if we could catch him before the next one.” She glanced at the flickering lights. “So if you can do that for us—”

Nimmerich checked his watch. “Okay, I'm motivated, but it's still gonna take awhile. What it's doing now, it's actually checking each bit
on the disk and copying it and checking to make sure it copied it right. Then it goes on to the next one. It's going to do that even for the overwritten parts, even for the parts on the drive that were never used.

“After that we're gonna try our recovery procedures, sector by sector. I'll look for hidden files, then any temporary or swap files used by applications or the operating system. I'll go through the unallocated spaces and any slack space. Then we go after password-protected or encrypted files. I'll go as fast as I can. But we still have to analyze the system as we go, list all the files of interest and any data we discover. That's evidence, too—file structures, authorship information, any efforts to hide or delete or encrypt data. Okay? You following all this?”

“Actually I was.”

“Good,” he said. “So. Where are you taking me to eat?”

THE image took four hours to make. When the screen showed
OPERATION COMPLETED,
Nimmerich powered down the computer, took the side panel off again, and slid the evidence drive out. Yousif immediately held out his hand. The SIS man locked it in the briefcase and left. While he was gone Nimmerich fitted a second blank hard drive in the upper bay. Then, using the SafeBack disk again, he recopied the image to the second blank hard drive.

Meanwhile she drove back to the base and caught up on her e-mail and phone messages. Four hours later she was back at the ministry to find Nimmerich blinking sleepily and drinking coffee with Yousif. Which she hadn't thought Mormons were supposed to do, but she didn't ask, didn't want to bring up religion in any way, shape, or form.

Nimmerich had put the computer's original hard drive back in and loaded Norton Utilities for the analysis. He explained what he was doing as he used the diskedit feature to recover files.

“Hmm. He reformatted it.”

She said, “I thought so, when I found it wouldn't boot. When we discovered it. That wipes everything, right ?”

“Not exactly, but it makes it harder.”

Yousif said, “These are all erased files, right?”

“Erased, right, but also reformatted. You probably know this— Aisha?”

“Right.”

“But what DOS actually does when you erase something, it just reclassifies that file sector from ‘used' to ‘available.' That's easy to recover, especially the last things they deleted before they left, that's all
gonna be there. But this guy's wise to that, he actually reformatted. Then it gets tricky. But fortunately he didn't have the software for an actual wipe. That overwrites every physical byte on the disk.” He worked on for some minutes. Then he clicked his tongue as a list of files came up. She saw some titles were in Arabic, others in English, a few in a character set she didn't even recognize.

“Here's something. Can you read this?”

Yousif leaned forward, too, as she went down it, reading the titles and translating. Nimmerich clicked his tongue again. “Here's his system. The stuff in English is unprotected. Everything else is password-protected. I'm gonna assume the passwords are in the same character set as the file name. I got one program that just runs through all the possible combinations that you give it. A five-character password, that's not gonna take it too long to … How many letters are there in Arabic?”

“Twenty-nine,” Yousif said.

“Well, we'll try that first.”

It took him awhile to set up the program, but after twenty minutes' run time it opened the first file. “Uh-huh. Uh-huh.” Nimmerich made another note in his spiral-bound, then went back to keyboard and screen. “Okay, this looks like a graphic of some kind … reach into my bag of tricks … we'll try QView Plus … Anybody recognize this?”

Yousif leaned close over her shoulder. She could smell the coffee on his breath, the musky scent of his body. He was gradually moving his stool forward, crowding her. Bob and Kinky had done that. Gotten in real close, in the office, till they were all but touching her. After asking them a couple of times to back off, and seeing their confused reaction, she'd realized it wasn't intentional; they were just both ex-submariners. But Yousif had no such excuse. She edged her chair away.

The major said, “It's our harbor. Manama Harbor.”

“Ey-yup. You want a hard copy of that?”

They said they did. Keys clicked, and the printer started to hum.

“This?”

They studied the next image for a long time before Yousif suggested it might show the layout of the explosives in the dhow.

“So you want that one, right? Printing. Another graphics file … map here, I'd say… how about it? What's that look like to you?”

Aisha said, “It looks like … Israel?”

“Palestine,” Yousif muttered, correcting her.

Aisha furrowed her brow. This was something she hadn't expected.
In the upper right corner was a scale in kilometers. In the lower right corner, a feathered arrow that after a moment she recognized as showing the prevailing wind direction.

“Print it?” Nimmerich asked, into the sudden puzzled stillness.

Yousif said casually he guessed not. Aisha cocked her head, still trying to figure what this was doing here, but when the FBI man looked at her, she did not object.

He went on. Plowed through more files, muttering to himself, while she tried to work out why a map of Israel might have resided on a hard drive in Bahrain.

Meanwhile Nimmerich came on the .exe file for an e-mail program. “Which means there should be address files and some in and out mailboxes here somewhere, too. I'm glad they didn't wipe. Then you've got to take the drive apart and put it on this special machine that detects like really minute remaining magnetic charges, try to recover data from that… and … uh-oh.”

She said, trying to push away what she'd been thinking, “That doesn't sound good.”

He pointed at the screen. “I was cruising around while I was talking. … This is Windows Explorer, the attributes window. Look at that.”

“What is it?”

“That's an encrypted file, guys.”

“Encrypted,” said Yousif, leaning forward to see. Suddenly going tense, as if this was what he'd been waiting for.

“Huh. He's got encrypted files in nonencrypted folders. Cute.”

So far Nimmerich had seemed relaxed, more so than when he'd been talking to her, but now he went into a focused mode. “Might be harder than I thought. This looks like PGP Disk, or … no, it's not, but something like it… uh-oh. Seven-digit key.
Not
that Indian thing!”

“What Indian thing?”

“It's an encryption program that has this extra wrinkle. You bring up the file, it prompts you for a key. If you don't have that, or the god mode, all you see's garbage.”

She didn't like the sound of that. “The what mode?”

“God mode—the master key that gets you into any of the files. Oh, I don't even want to get into public-key encryption. Factorials and all that crap … but you can understand every file getting its own individual key. As it's being created.”

“Sure.”

“But only the master administrator has the god key. Him and maybe a deputy, for backup. He can read everybody's files. They can only read their own.”

“Okay, so this program—”

“Just wait a minute. Regular encryption programs, the file comes up, you don't put in the right key, you just don't get in. It just sits and waits. But this one—Shiva. That's what it's called. If you don't put the key in right the first time, type the whole ten digits exactly right, it overwrites everything in the file. Self destructs, like in
Mission Impossible.”
He clucked his tongue. “Somebody was serious.”

Yousif said, “But you have a copy. This whole drive you're working on is a copy. Right? So do like you did with the other passwords. Try a key, and if it doesn't work—”