“You said Peter was a geek, right?”
“Yeah. Computer security consultant.”
Corvallis nodded. “The format of the files from his hub suggests that they were created by Linux. And indeed when I do a little bit of searching I can see that it’s easy to download a Linux driver for this hub. It is Linux-friendly, in other words. So I suspect that what Peter did was set up a Linux-based system to manage his security cameras and perform automated backups and so on. And when he bought that hub, he junked the Windows-based software that shipped with it and reconfigured it to work directly under his Linux environment.”
“Which tells us what?”
“That we’re screwed.” Corvallis used a text editor to open one of the files that Richard had failed to open earlier. “See, the header on this file indicates that it is encrypted. All the files that you recovered from his hub have been encrypted in the same way. Peter didn’t want bad guys breaking into his system and snooping around in his security camera archives, so he set up his system with a script that encrypted all the video recordings before saving them to disk. And those encrypted files were then automatically backed up to the Wi-Fi hub.”
“And those are the files we are looking at now.”
“Yeah. But we’ll never get them open. Maybe the NSA could break this encryption. We can’t.”
“Can we know anything else? How old are the files? How big are they?”
With a bit more typing Corvallis produced a table showing the sizes and dates of the files. “Some are pretty huge,” he said, “which makes me think that they must be video files from the cameras you spoke of. Some are tiny. In terms of times and dates—”
They both scanned the table for a while, trying to see patterns.
“The tiny ones are regular,” Richard said. “Every hour, on the hour.”
“And the huge ones are totally sporadic,” Corvallis said. “Listen, it’s obvious that the tiny ones are being generated by a cron job.”
“Cron job?”
“A process on the server that does something automatically on a regular schedule. Those files are just system logs, Richard. The system just spits them out once an hour, and they get automatically backed up.”
“But let’s talk about the big files. The video files. It’s a motion-activated system,” Richard said. “Just look at it. There’s a file on Friday afternoon, which is when Peter would have been packing for the trip to B.C. Then nothing—except for the hourly log files, that is—until the middle of the night on the following Thursday. Which is weird. Because we know that a lot was going on in the place Tuesday morning. Why didn’t it get picked up by the cameras?”
“Actually, there is nothing at all—not even hourly log files—between midnight and ten A.M. on Tuesday,” Corvallis pointed out. He drew Richard’s attention to the table and traced his finger down the column listing the time/date stamps. “See, the cron job was functioning properly all through Friday, Saturday, Sunday, Monday. Monday night, it did its thing at eleven P.M.…”
“But then there’s a gap,” Richard said. “No more little cron job files until ten in the morning on Tuesday.”
“After which,” Corvallis concluded, “it resumes its usual habits until Thursday at two A.M.”
“Coinciding with a big video file,” Richard pointed out. “The reason there’s nothing after that is because the server that was running the whole system got trashed. Someone came back to Peter’s place on Thursday, two days after Peter and Zula had vanished. Bastard probably knew it was empty; he must have been an accomplice, or a friend of one of the bad guys. Broke in through an upstairs window. Went downstairs, triggering the security camera and causing that last big file to be created. Opened the front door from the inside. Carried in a plasma cutter. Opened Peter’s gun safe. Stole something from in there. Noticed the computer that was logging the security videos and used the plasma cutter to destroy its hard drives.”
Corvallis nodded. “That fits,” he said. “As soon as that computer was destroyed, the hourly log files stopped coming in.”
“The only part that doesn’t make sense is the gap on Tuesday morning,” Richard said. “As if the power went out for a while. But that can’t be it. The machine had a UPS.”
Corvallis was shaking his head. “A power outage would have showed up in these logs. I’m seeing nothing.”
“So how do you explain it?”
“There’s an obvious and simple answer, which is that the files were manually erased,” Corvallis said. “Someone who knew how the system worked went in between nine and ten A.M. on Tuesday and wiped out all files generated since midnight.”
“But this is the backup drive we’re looking at,” Richard reminded him.
Corvallis looked up at him. “That’s why I’m saying it had to be someone who was familiar with the system. He knew about the backup drive, and he was careful to erase both the original and the backup files.”
“Peter, in other words, is the one who did this,” Richard said.
“That’s the simplest explanation.”
“Either he was working with the bad guys—”
“Or he had a gun to his head,” Corvallis said, then winced at the look that came over Richard’s face.
“So where does that leave us?” Richard asked, somewhat rhetorically.
“The data from here,” said Corvallis, indicating the PC, “is all stuff that the cops should be able to analyze, the same way we have been doing. But unless they can get the NSA to decrypt the video files, it won’t go any further than we’ve already gone. The other stuff—the T’Rain logs that we used to make the connection to Wallace—they can’t get unless they come in our front door with a court order.”