by David Poyer
“Teacher,” Rasheed said at last, “you will become a shaheed with us?”
“I will accompany you. But it is not written that I am to die with you.”
“You’ll sail with us? We don’t know the way.”
“I will go with you even to the gates of Paradise. From there on, you will be far above me in honor. You will be the truly firstborn sons of God. His beloved soldiers, who will purify the earth of the Zionists and restore His golden land to the Faithful. Insh’allah, and your names will be inscribed forever in the Book of Life.”
“Insh’allah,” they murmured, shyly. May it be the will of God.
“I bow down to you, and wish you the tranquility that comes before battle. I only wish I could join you at the end. But perhaps one day I will.”
This last, he thought, was not perfectly accurate. He yearned for a cool house and a young wife more than martyrdom. This would be his last work for the Sheikh. But these were young and filled with zeal, and he turned his face away that they might not see his thoughts. Might not see his contempt for them … The sun was declining. It would be best to be at sea before the night was complete.
“First we’ll pray,” he told them. Then Antar will go below and start his engines. I’ll take Ali on the wheel for the first watch. Rasheed, eat of the food below, then sleep against my waking you. And then we will see what God has written.”
30
Base Security, U.S. Naval
Support Activity, Bahrain
HI. Hi.” The FBI agent smiled shyly as Diehl introduced him around the table. To Aisha, Major Yousif, Commander Hooker, and a somber-suited, light-skinned Arab who had been introduced only as Mr. Hassan.
Arnold Nimmerich was a computer forensic examiner. The first one Aisha had ever seen, though she’d read about them in the criminal justice journals. He was her age, but his blond hair, long in back, was already receding in front.
Presently everybody in the agents-only meeting upstairs in the base security building took seats. At last, as if bringing forth crown jewels, Major Yousif unlocked a briefcase, unwrapped several layers of bubble wrap, and gently placed on the table the drive a joint SIS/NCIS evidentiary team had seized from the Salmaniya Avenue madrassa.
Diehl asked whether they’d dusted it. Yousif said dusted and photographed, but the only prints on it were old, from when it had been assembled. Which meant they didn’t need to do the usual rubber-gloves routine.
Nimmerich picked it up and turned it over. Studied the label pasted to the bottom, then rattled it, like a kid with a present. He put it back on the bubble wrap and said, addressing nobody in particular, “So, is this particularly time sensitive?”
“We think it might be,” Hooker said.
“Ey-yup. Well, sometimes these things take awhile. Just to let you know. Was the computer running when it was taken into custody?”
“No.”
“If you take one running, dump the RAM to a disk before you pull the plug. That’ll give you passwords resident in memory, any decrypt process that’s running, stuff that makes my job easier. If there are usable files on this one I can probably get you some degree of recovery, unless whoever used it last knew how to do a disk wipe. Was there a modem on the source machine?”
“Yes,” Aisha said, since no one else looked like they knew what he was saying.
“Then there are probably e-mail files. They can lead to other connections and potential suspects.”
She said, “He could have used a Web-based e-mail, like Yahoo or Hotmail. Then the files wouldn’t be resident on his computer.”
Nimmerich looked at her and said, rather unwillingly, she felt, “Correct, but you can find traces and sometimes parts of messages in the unallocated clusters. I can do string searches to bring up hidden information like that. But again, it’ll take time.”
“What do you need from us?” said Hooker.
“Well, I brought the software I think I’ll need, and some blank, formatted hard drives and cables, but I’ll need two machines. One like the one this came out of. The other, the fastest IBM compatible you have, with a dual processor and a high-capacity tape drive. A phone line, back to Quantico. And a secure place to work.”
He looked around uncertainly, not meeting her eyes, obviously wondering who was in charge. He picked Diehl to address, probably because he was the oldest white man. “Where will that be? Someplace I can plant myself for a couple of days?”
“Major?” Diehl deferred to Yousif.
The SIS man cocked his head. Running out the various angles, she thought. At SIS headquarters, where his men could learn from the visiting American computer expert? But also where the American could see how well or how badly they were equipped and trained. Here at the base? Where he might lose control of whatever they managed to extract. Aisha caught the flicker of a glance between him and the Arab. ‘Mr. Hassan’—it was like introducing someone as Mister Jones in the States. A pointed little beard, and hooded, watchful eyes over a too-ready smile. He’d spoken only a few words, in Arabic. But she’d gotten to talk to some Saudi sisters in her souk roaming. He had their accent.
“We’ll do it at the ministry,” Yousif said. “In a special room, separate from our regular offices. We’ll have to restrict access. I’m sure everyone understands how sensitive this information may be.”
“I don’t,” said Diehl. He’d hauled out one of his El Stinkos, was chewing it, and seemed, despite annoyed glances from around the table, about to light it. “We’ll close-hold it, but this is a criminal investigation of a very nearly successful attack on one of our ships. We led you to the evidence. We want access to the result.”
Yousif said, “Mr. Nimmerich will be your access, Bob. What more can you want? He is, after all, an agent of the FBI.”
Diehl asked Nimmerich, “You read Arabic, Arnold?”
“No.”
“You a Moslem?”
“I’m a Mormon.”
“A what?” said Yousif. No one answered, and he frowned and made a note on his pad.
“Well, Aisha does, and Aisha is. So she goes, too,” Diehl said. “She’s got a top-secret clearance. She knows the background of the case. She’s hot stuff on the computer, too.”
She reflected bitterly that now she “knew the background.” Somehow the senior agent had conveniently forgotten she’d actually broken the case, getting a confession from Childers-Jaleel, tracking down the missing explosive, finding the computer. Yes, a woman needed all the modesty God could give her. Not to mention a hide like a rhinoceros.
And here was “Mr. Hassan” pursing his lips, shaking his head. And Yousif taking his cues from him, saying lightly, “No, no, that won’t be necessary.” Who was this guy? The only guess she came up with was one she didn’t like to contemplate. The Al-Mabahith al-Amma, “General Intelligence,” the Kingdom of Saudi Arabia’s shadowy and ruthless secret police.
Nimmerich said, obviously trying to be helpful in a situation he didn’t understand, “She could help evaluate the files, if I can recover any. If they’ll be in Arabic.”
“We’ll provide any language expertise necessary.”
“Forget it, Major. Nimmerich’s not gonna have any idea what he’s looking at. So without her, no deal,” Diehl said. He got up. “Come on, Arnie, we’re booking you back to D.C.”
Nimmerich looked up, surprised and not pleased. Or, she thought, he didn’t like being called Arnie. Yousif said disapprovingly, “You’re not cooperating, Bob.”
“You’re not cooperating, Major. A joint investigation means both sides get the results of all the forensics. That means both sides are at the forensics. But either you don’t trust us to turn over everything Arnie here gets off that drive. Or else … Could there be something on it you don’t want us to see?”
He didn’t look at Hassan when he said this, but Aisha smiled. The senior agent might not know the local language, or the latest technology, but he’d smelled the same rat she had.
“Ridiculous. Of course we
’d share everything, Bob.” Yousif motioned like he was smoothing out a rumpled cloth, but he was showing the strain. She had noticed that he gnawed at his mustache when the pressure was on. He kept looking from Diehl to Hassan, as if caught between irreconcilable responsibilities. “Sit down, please. Commander Hooker, talk sense into him. We’re all friends here. We’ve always been open with you, haven’t we? Always shared everything? Well, well… if you want her there, she’s welcome. Aisha? We’ll issue you the appropriate passes and so forth as soon as we break.”
But the Saudi didn’t like it. Aisha didn’t miss how he stayed in his seat as the others rose. The flash of distrust, dislike, maybe even hatred, as their gazes clashed, just for a moment, then turned aside.
THE room was on the third floor of the ministry, in a lofty-ceilinged work space that bore all the hallmarks of being hastily converted to its new use, like folding tables and lots of extension cords. Four computers were set up around the walls. Two Pentium Gateways, the Sanyo from the madrassa, and an Apple. The last was the only one with a modem, set up with an encryption program for Nimmerich when he had a question for the guys back at Quantico. A laser printer, too, a hulking cream-colored Hewlett-Packard the size of a small refrigerator.
Nimmerich began by examining the hard drive again, making notes in a fresh spiral notebook. “So how do we proceed?” Yousif asked. He’d attached himself to them, and it didn’t look like he was going to leave.
Nimmerich said, slightly pompously, she thought, pointing to the nearest Pentium, “First I’m going to convert this into a forensic workstation. Then I’ll explain as I go, all right? If you’re interested.”
“I’m interested,” she said. While Yousif sat back, making it plain as he could without saying so that the actual work of recovering the data was beneath him.
“Most girls don’t know much about computers. Or care.”
“I’m probably not like the other girls you know,” she said.
Nimmerich pursed his lips, but didn’t follow that one up. In fact he reddened and buried himself in his work.
Using screwdrivers from a kit in his briefcase, grounding each on a conductive pad, he took off the side panels to access the interior of the computer. He pulled off cables, slid out the hard drive, and replaced it with the evidence hard drive.
He said, not meeting her eyes, “Okay. I’m going to configure the evidence as the master, and this second drive as the slave.” He installed one of the blank, formatted drives he’d brought in the lower bay. “Now we’re gonna copy it to this new drive, make what we call a forensic image. That means everything: active files, deleted files, hidden files, password-protected stuff, everything. Then we’ll take the evidence out and bag it again. Protect it from viruses or data corruption, and any accusation from the defense we added files that weren’t there.”
When he had the machine buttoned up again, he put a 3.5-inch minidisk in the A drive and turned the power on. As it whirred and images flickered across the screen she said, “What was that? A boot disk?”
“Uh-huh.”
“Why don’t you boot from the hard drive, like usual?”
“So we don’t accidentally write to the original evidence. I just took a normal boot disk and neutered it—made all the pointers look at the floppy disk, and not the hard drive. That’s also got the SafeBack software, the utility I’m going to use to make the image.”
Aisha kept watching, a little surprised this wasn’t black magic. She was following everything so far.
The FBI tech finished the boot and in DOS, not Windows, typed in the command to make the forensic image. The little lights that showed hard drive activity started to flicker, the machine making an intermittent chirruping that reminded her of a cricket.
He got up. “Okay, where do we eat?”
“You’re hungry? It’s only ten o’clock.”
“Jet lag. It’s dinnertime for me—at least, I think that’s right.”
“What about this? You’re not going to just stop. We need access to whatever’s on this drive. It’s urgent.”
“Really urgent? Or just department urgent?”
She looked at Yousif, who hesitated, then nodded. She told Nim-merich, “Really urgent. You know someone tried to bomb one of our ships.”
“They told me that. Yeah. A navy ship, right?”
“USS Horn, here in Manama harbor. This belonged to the perp. We missed him just by minutes, the day of the attempt. We think he’s on his way to do the same thing, or something like it, somewhere else.”
“You mean, another bomb?”
“Based on the MO, we think he’s done this before. It’d be nice if we could catch him before the next one.” She glanced at the flickering lights. “So if you can do that for us—”
Nimmerich checked his watch. “Okay, I’m motivated, but it’s still gonna take awhile. What it’s doing now, it’s actually checking each bit on the disk and copying it and checking to make sure it copied it right. Then it goes on to the next one. It’s going to do that even for the overwritten parts, even for the parts on the drive that were never used.
“After that we’re gonna try our recovery procedures, sector by sector. I’ll look for hidden files, then any temporary or swap files used by applications or the operating system. I’ll go through the unallocated spaces and any slack space. Then we go after password-protected or encrypted files. I’ll go as fast as I can. But we still have to analyze the system as we go, list all the files of interest and any data we discover. That’s evidence, too—file structures, authorship information, any efforts to hide or delete or encrypt data. Okay? You following all this?”
“Actually I was.”
“Good,” he said. “So. Where are you taking me to eat?”
THE image took four hours to make. When the screen showed OPERATION COMPLETED, Nimmerich powered down the computer, took the side panel off again, and slid the evidence drive out. Yousif immediately held out his hand. The SIS man locked it in the briefcase and left. While he was gone Nimmerich fitted a second blank hard drive in the upper bay. Then, using the SafeBack disk again, he recopied the image to the second blank hard drive.
Meanwhile she drove back to the base and caught up on her e-mail and phone messages. Four hours later she was back at the ministry to find Nimmerich blinking sleepily and drinking coffee with Yousif. Which she hadn’t thought Mormons were supposed to do, but she didn’t ask, didn’t want to bring up religion in any way, shape, or form.
Nimmerich had put the computer’s original hard drive back in and loaded Norton Utilities for the analysis. He explained what he was doing as he used the diskedit feature to recover files.
“Hmm. He reformatted it.”
She said, “I thought so, when I found it wouldn’t boot. When we discovered it. That wipes everything, right ?”
“Not exactly, but it makes it harder.”
Yousif said, “These are all erased files, right?”
“Erased, right, but also reformatted. You probably know this— Aisha?”
“Right.”
“But what DOS actually does when you erase something, it just reclassifies that file sector from ‘used’ to ‘available.’ That’s easy to recover, especially the last things they deleted before they left, that’s all gonna be there. But this guy’s wise to that, he actually reformatted. Then it gets tricky. But fortunately he didn’t have the software for an actual wipe. That overwrites every physical byte on the disk.” He worked on for some minutes. Then he clicked his tongue as a list of files came up. She saw some titles were in Arabic, others in English, a few in a character set she didn’t even recognize.
“Here’s something. Can you read this?”
Yousif leaned forward, too, as she went down it, reading the titles and translating. Nimmerich clicked his tongue again. “Here’s his system. The stuff in English is unprotected. Everything else is password-protected. I’m gonna assume the passwords are in the same character set as the file name. I got one program that j
ust runs through all the possible combinations that you give it. A five-character password, that’s not gonna take it too long to … How many letters are there in Arabic?”
“Twenty-nine,” Yousif said.
“Well, we’ll try that first.”
It took him awhile to set up the program, but after twenty minutes’ run time it opened the first file. “Uh-huh. Uh-huh.” Nimmerich made another note in his spiral-bound, then went back to keyboard and screen. “Okay, this looks like a graphic of some kind … reach into my bag of tricks … we’ll try QView Plus … Anybody recognize this?”
Yousif leaned close over her shoulder. She could smell the coffee on his breath, the musky scent of his body. He was gradually moving his stool forward, crowding her. Bob and Kinky had done that. Gotten in real close, in the office, till they were all but touching her. After asking them a couple of times to back off, and seeing their confused reaction, she’d realized it wasn’t intentional; they were just both ex-submariners. But Yousif had no such excuse. She edged her chair away.
The major said, “It’s our harbor. Manama Harbor.”
“Ey-yup. You want a hard copy of that?”
They said they did. Keys clicked, and the printer started to hum.
“This?”
They studied the next image for a long time before Yousif suggested it might show the layout of the explosives in the dhow.
“So you want that one, right? Printing. Another graphics file … map here, I’d say… how about it? What’s that look like to you?”
Aisha said, “It looks like … Israel?”
“Palestine,” Yousif muttered, correcting her.
Aisha furrowed her brow. This was something she hadn’t expected. In the upper right corner was a scale in kilometers. In the lower right corner, a feathered arrow that after a moment she recognized as showing the prevailing wind direction.
