Wire-Pulling Pt. 02

The drive home took me roughly forty minutes, so I had thought that Bill and the police would already be done by the time I arrived. As it turned out, though, they were still standing in the parking lot when I stopped at the gate.

"Paul!" Bill called out upon seeing me. "Nice of you to finally join us this fine evening."

I couldn't help but notice the distinct note of irritation in his voice.

"What's up? Why are you standing out here?"

"Well, Officer Wilkins here and his partner have spent the last twenty minutes sweeping the area, looking for two men matching the description Tim texted us. But he doesn't see a need to actually check your apartment."

That made me blink.

"And why's that?" I asked, now looking at the officer.

"Look, I don't know why the DA has such an interest in you, but fact is, the door to your apartment is tightly closed and locked. There are no entry marks, no signs of tempering with the lock, nothing to indicate that someone broke in."

"Oh, I can help with that!" I said and started leading Bill and the two officers into my temporary lodging.

I immediately gestured for them to follow me into the bedroom where the monitor station stood and accessed the video on the recorder. The officer's eyes didn't widen in surprise when he saw the two guys walk through my apartment. It was more like he looked annoyed. I almost expected the guy to flick his tongue as he, visibly reluctant, grabbed his radio and called for a forensics team.

"I'm gonna need that video," he said and almost immediately tried to grab the recorder off the table, only to be stopped by Bill.

"Don't you think we should wait for your team to watch the video, so they know where to look before you rip all the cables off and potentially destroy evidence?" Bill sounded remarkably calm as he said it, but the warning was clear as day. "As you said, the DA has an interest in this case. Wouldn't want anything to go wrong here, would we?"

It earned him a raised eyebrow from the disgruntled officer, but the officer pulled his hand back and, as Bill gave me a peculiar look, started for the door.

"Until the forensic team shows up, you make sure they only broke into your apartment and not in here as well. I'll keep an eye on Officer Doofy," Bill said before leaving without waiting for an answer.

Thirty minutes and an exhaustingly thorough search of my temporary abode later, I was certain that nobody had been in there since we left. I did, however, find out what Ava dropped off for Mom the other day when I came home to find the two of them on the couch. In Mom's bedroom, badly hidden under her bed, was a plain brown plastic bag containing a multitude of sex toys. For example, something that looked like a funky vibrator of admittedly intimidating proportions, with a spinning segment on the shaft that was covered in soft silicone knobs. Something that looked like a butt plug, but it was barely the size of a bullet vibrator. And, to my utter astonishment, a vast variety of bondage gear, starting with padded handcuffs, leather rims that looked like they were used to lock someone's wrists to their ankles, and ending with a ball gag. There was even one of those chokers with a metal ring in the front! The leash seemed to be missing, though.

As I marveled over my findings, I suddenly heard footsteps approach the apartment door and hastily stashed everything away. Just as I entered the living room, Bill, the suspicious officer, and two guys in civilian clothing entered the room as well. The big bags the two new guys were carrying told me who they were, though. They watched the video with a lot more interest than the officer had, and finally asked for a copy of the video, not the recorder itself. I produced the thumb drive Tim had handed me out of my pocket and handed it to them.

Next, we all went up to the apartment, and I watched the two set up in the hallway. After confirming the absence of any marks indicating that someone had tampered with the locks, they simply removed the whole locking cylinder to bag it. Then they moved into the apartment itself and immediately took care of my PC.

"Well, that's interesting!" we heard the guy's voice come from under the table before he crawled out to stand in front of us. He was holding a little black box in his gloved fingers. "This is a short-wave transmitter. At least it looks similar to the ones I know."

As his partner was now examining the gadget they found, the officer looked remarkably uncomfortable. Something that also wasn't lost on Bill. Even though we both had our suspicions about why that could be, neither of us knew how to approach that problem at that moment. All we could do was keep an eye on the guy.

Finally, they packed up my entire PC to have it examined by their IT forensics department. The one that found the little black box under my desk left me his card, which featured his direct phone line and promised to keep us up to date with their findings before all of them left.

"Well... that was interesting," Bill suddenly said in an amused tone.

"Yeah. If you say so. That officer, though..."

"No question about it. That guy is on someone's payroll. Nothing we can do about it, though. The more pressing issue is: Why did they break in here now?"

We both contemplated this question for a while but ultimately came up with nothing. It would've made a lot more sense if they tried this at the start. There was no way they waited only a week for us to grow less cautious. So, something must have happened on their end that explained this sudden change in tactics.

"I need to get back to Tim's. I also have to ask him a few questions about my PC."

Bill looked pensive for a moment, but then just nodded. To my surprise, he decided to accompany me.

When we arrived at Tim's home, Mom was still on the sofa with Ava and her mom, now, however, they had obviously consumed more than one bottle of wine as we could hear their exuberant laughter resound through the house. This caused us to not check in on them, but instead make our way directly to Tim's home office.

"They still at it?" was all he asked once the door opened and we stepped inside.

"Yup. And, going by how they sound, they are not planning to stop soon," Bill laughed, which caused Tim to groan.

"What's the problem?" I asked, confused.

"Dude! You'll take only one of 'em home. I'll be stuck here with TWO drunk women. And they're annoying drunks!"

This caused Bill and me to laugh before we all turned serious.

"So, question!" I started. "If your suspicion is correct, and those guys planted some kiddy porn on my PC... how will the police know that it's not mine?"

I could see that he was intending to make another joke, but the genuinely concerned look on my and Bill's faces must have stopped him. Instead of a witty remark, I actually got my answer in a rather professional tone.

"The NTFS File System your hard drive's formatted in has alternate data streams to save a lot more information for every file than Windows displays. For example, I could check every file in your 'Downloads' directory and see the URLs from where you downloaded them. It also saves a number of timestamps for every file." This caused me to look at him with great interest as he raised two fingers. "Two of those are the time of creation and the time of 'entry modified'. Clear so far?"

"No," Bill and I said simultaneously.

"Great. So, the time of creation is when the file was created on your hard drive, while 'entry modified' shows the time the file was last moved into a cluster on your hard drive. These clusters are basically... Imagine your hard drive like a shelf full of letter trays. Your OS keeps track of all the files by remembering which file sits in which letter tray. Now, the value for BOTH these timestamps I just mentioned comes from the device that performed those operations. So, if they changed the clock on their laptop to some time last year, the file they copied from that laptop will claim to have been on your hard drive since some time last year. But, according to the entry modified identifier, it was then somehow never touched by your OS since its creation."

After he finished talking, he just sat there, looking at us as if we were supposed to know how that helped anyone. Soon, though, he noticed our empty eyes and groaned before continuing like we were five-year-olds struggling to understand something that's common knowledge.

"The files on your hard drive are a lot bigger than the clusters they are saved into. So, your OS splits the files to store them in multiple clusters. Now, it tries to keep them together, but as files get changed or deleted, your hard drive turns into a mess. So, your OS constantly updates its file index for faster operations, trying to move the files between the clusters to get them back together. It's like the defragmentation process for HDDs. Every time your OS does that, the 'entry modified' timestamp gets updated. But, since you never had a chance to turn the PC on before the cops took it, this value will still show whatever time their laptop was at. Which is impossible because, as I said, your OS does that reorganization routine constantly."

"Oh! Okay, that makes sense," I called out. "I think I understand. And, if they didn't bother to switch the time on their laptop, these timestamps would show that the files were copied onto my hard drive at the same time we have video footage of them messing with it." I waited for Tim to nod and confirm that I had indeed got this right.

"Exactly. The only problem that could possibly come up is if they switched the time on their laptop specifically to the exact time and day you moved out. You actually never touched your PC since then, making the timestamp for 'entry modified' plausible, since all the other files on your hard drive would have the same value."

"Couldn't they have just pulled that timestamp from another file and then set their laptop to that time?" Bill asked.

"Theoretically, yes. But I don't think they did," Tim replied before pulling up the video of them and gesturing for us to look at it. "He just mounts the hard drive, taps a few times on his touchpad, and then disconnects the drive again. It's not exactly complicated to get those timestamps but would still take longer than the few seconds he had the drive mounted. And, remember, all of this is only necessary in the first place if they anticipate that their target gets the hard drive examined before turning the PC on. They'd have to have anticipated that we could catch them in the act. Then... why bother planting something on it? Why risk it? Their attempt would only work AND make sense if they somehow knew the last time Paul used his PC and set their laptop to that time beforehand."

"Nah," Bill shook his head, "To even guess when he last used his PC, they'd have to have him under surveillance since before he switched apartments. But then they would have also known about us bugging the place. I can't imagine them knowingly doing this in front of a camera."

"No, definitely not," I added. "But we still need to find out why they moved now of all times, and not when they learned about Mom living with me. They must have anticipated that I would support Breston to take the senator down, regardless of how estranged I am from my mother."

For some reason, hearing this caused Tim to act... awkwardly. Almost as if he was embarrassed. Something that caused Bill to lean forward and fix Tim with a stern look.

"What did you do?" he asked in a dry tone.

"Well... I mean..." Now Tim was definitely acting embarrassed.

"Spit it out, Kid!" Bill pushed, now with a distinct note of anger in his voice after seeing his suspicion confirmed.

"Okay, look. I... might... have gotten tired of waiting and decided to poke around in the senator's IT?"

He actually ended that sentence as if it was a question, as if he was testing how bad his admitted actions were. For about three seconds, there was total silence in the room before Bill exploded.

"ARE YOU FUCKING CRAZY!?"

"Welllll..." Tim replied while pulling his shoulders up and tilting his head as if to say 'Don't act so surprised'.

"I swear to God, Kid... you're gonna kill me someday." Bill was rubbing his temple before continuing in a quiet voice, sounding like he was talking more to himself than to us. "This is my fault. I should have expected that shit after that stunt you pulled in Austin."

"What stunt?" I asked, thinking he was talking about the day we picked up Mom from jail. Which confused me because Tim wasn't part of that. To my utter astonishment, though, Bill threw a cautionary glance at Tim before shifting his eyes to me.

"Do not ask. We don't speak about Austin." His voice was now tired but, somehow, still firm enough to tell me that there would be no discussion about this regardless of how curious I was. "Just get on with it, Kid."

"Okay, so..." Tim started, shrugging his shoulders once more. "The day after Paul showed up with the photos, the senator attended some kind of gala-thing. So, I downloaded all the photos of that event that I could find on the web and put all the photos on a thumb drive. Then I created a little letter in the gala's promoter's name, thanking the good senator for his attendance. And then I placed the letter and the drive in an envelope and sent it to his home address."

"Uh-huh. And?" Bill asked.

"I may have forgotten to remove a little something I had on that thumb drive before copying the photos onto it. So, when he plugged the thing into his computer..." His voice drifted off, but we both got his meaning. Strangely, I found this to be more exciting than concerning.

"Oh, nice!" I called out. "What did you find?"

"That his computer was already bugged."

"What!?" Bill and I called out simultaneously.

"Yeah. Crafty little piece of FUD malware acting as a keylogger while providing a remote-control component. Honestly, I only noticed it because his computer suddenly attempted to contact a weird IP address even though nobody was using it."

"Interesting..." Bill mused.

"It gets even interesting-er!" Tim grinned like a little boy getting to report something awesome that happened at school that day, causing me to shake my head. "After I noticed that connection attempt, I had a little hunch. So, I traced it back to check which ports it used to communicate with its C&C Server and contacted a few other addresses using that port. And guess where else I found the thing!"

"Schrader Bank & Trust?" I tried.

"The senator's bank, Schrader Bank & Trust," Tim nodded with a serious face before reaching for a drawer and pulling a bunch of papers out of it. "AND the bank that was accused of buying the stolen data AND the bank in Gibraltar that the four million were transferred to. By the way, here are the scanned documents with your mother's supposed signature those banks have. I should add that I could not find a scan of your mother's signature on the senator's PC. And, even more importantly, as you can see in those documents... The ID used to open all of those accounts was her marriage certificate!"

"Seriously!?" I said while losing control of my facial muscles. This day was better than Christmas! "Not a photo ID?"

"Nope! The bank in Gibraltar and Schrader had identical signatures on the documents, and neither of the accounts were opened using a photo ID. So, all we have to do now is get a sample of her real signature and have an expert state that they don't match."

"Kid," Bill suddenly said. "May I remind you of the day you met that new girlfriend of yours? Specifically, the talk we had about admissible evidence?"

"Oh. Right. There's that," Tim said, sounding deep in thought as his whole body kinda slumped in on itself. "Guess I kinda forgot about that since I actually wasn't the one who hacked anyone this time."

"Can you trace back that C4 Server you talked about?" I asked.

"It's C&C, and no. The IP points to a Russian data center owned by a company in the Seychelles islands," Tim replied in frustration, followed by Bill releasing his own groan of frustration. We all knew that, if you wanted to create a perfectly anonymous letterbox company, the Seychelles was the place to go. "And the server itself has the best protection imaginable: It's offline. Has been ever since I found it."

"And if that's the reason why they made their move now, it would mean that they know about your discovery and the server will stay offline indefinitely," I said dejectedly, realizing that this lead was probably dead, which meant that we couldn't use it even if he knew of a way to point it out to the DA.

The three of us silently sat in Tim's office for a few more minutes contemplating our options. This discovery did push the case along... but in a way that left a bitter taste behind. After all, since the senator's former employer and his own home computer were infected with this malware as well, it was now a real possibility that he wasn't the mastermind behind all of this. Maybe, there was an unknown third party acting in their own interest against those banks, and the senator would turn out to be just another pawn in their scheme.

I pondered those thoughts until we heard the women in the living room laugh hysterically. Smirking, Bill stood up to open the door and we could hear that the ladies' mood had become quite exuberant by now. Though, after looking at my watch, it made sense for them to be that drunk. They had been at it for hours while I drove back and forth between Tim's house and my apartment.

As we stepped into the living room, the extent of their indulgence became apparent. We saw no less than five empty wine bottles on the small couch table. Between the three women, who were all relatively small in size, that looked like a lot! Tim seemed to think the same as he groaned while rubbing his hand over his face, causing the three women to finally notice us.

"There'sh mah baby boy!" Tim's mother slurred out, clearly unable to control her volume, as she jumped out of her seat to unsteadily wobble her way towards him. When she reached him, she grabbed his head and pulled his face into her chest. "I'm shoooo gla' t'have you home! I luv you shoooo much!"

While Ava giggled upon seeing her brother weakly struggle against their mother's surprisingly forceful cradling, I saw Mom watch their interaction with downright admiration in her eyes. It made me wonder just how much she knew about what had happened between Tim and his family, and if that was why she watched this scene with so much interest. Before I could voice my thoughts, though, Bill spoke up.

"Well, I guess it's time to call it a day." He turned to me. "Take your mother home. We'll speak more tomorrow after we all had time to digest this shitshow."

I gave him a short nod before fixing Mom with a look, who needed a few seconds to rip her attention away from the mature woman's cooing over her son. But, when she finally noticed me watching her, she very quickly reassumed her usual persona, stood from the couch to take her position one step behind me, and then waited for me to lead the way with her hands folded in front of her.

I could only shake my head. Even when drunk, which was apparent by the light red hue on her cheeks and the slightly glassy eyes, she wouldn't let herself relax in my presence.

The drive home was strained as my thoughts were, once again, fully occupied with the case. I kept returning to the possibility of Dick being just an instrument for someone else's plans. Ever since I woke up with my dick in Mom's mouth, I had told myself that, once I successfully ruined the man, I could approach Mom with a clearer head. If I got my revenge on him, it would allow me to deal with her while not being influenced by all the hate I felt. But now... What the fuck was I supposed to do if clearing Mom's name would turn out to actually help the bastard!?