As a senior forensic computer analyst, I see all kinds of things. Most of the work I do pertains to the examination of seized computer servers and workstations. It's good work, pays well, and gives me a certain amount of free time to pursue my own interests. None of my supervisors are overly technically astute, so, more or less, as long as I produce the results they want, I am left free to my own devices.
Late yesterday, my boss came in with a small server in hand. This was odd: normally they only brought me drives. It was also strange for my boss to be hand delivering it.
"I was downstairs. They don't know what this is." he said, unprompted. "The server was seized during a drug raid. It was not in use. No one has seen the operating system, and no one knows what to do with it."
"Have they cloned the drive?" I asked.
"Yes, they put the new one in for you. It boots. Two more clones are available if you need them, so go ahead and dirty it up if you need to."
"Ok, I'll take a look."
As he left, I noticed some paperwork taped to the side of the computer. As though he could read my mind, my boss turned around and said "Oh, that paperwork .. that's how we found it. They think it might help you." I looked at him quizzically. He just shrugged his shoulders. "The crypto guys ran through it and found nothing. They say it seems random so far."
He left, and I peeled back the tape holding the paperwork to the computer. There were three pages, obviously of some age. They were full of numbers and letters, of no apparent rhyme or reason; random. I put them aside, and put the server up onto the bench. For the first time, I had a good look at it. The first thing that struck me is that it was OLD .. like, original pentium old. When was that popular? '96? '97? I did not often see computers of that vintage.
I connected a monitor, keyboard, mouse, and power, and flipped the switch. The computer whirred to life, and started the boot process. It was an AMI BIOS: pretty normal. The drive booted, and I was presented with a prompt:
C>
I laughed. Could it be that easy? Is this just an old DOS box? I chuckled to myself: someone was going to get seriously heckled if this thing made it to me just because one of the junior people did not recognize a DOS prompt. I typed a command to test the theory.
C>prompt $p$g
C:\>
Yep. It was just an old DOS box. Although not too many people ran DOS on Pentium class computers, it was certainly done, and was not entirely abnormal. I typed DIR, listing all of the files in the root directory. There was a DOS directory, containing the operating system files, a few configuration files, and a directory labeled BACKUP. It looked pretty minimal, standard.
How did the guys downstairs have trouble with this, I wondered. My phone rang, and it was one of my junior technicians. He was at .. a client site, let's say .. and needed some guidance. It took half an hour to talk him through the problem. As soon as I was off the phone, I got back at the machine.
I examined the two main config files, config.sys and autoexec.bat. Based on those files, I determined that this computer was part of a Novell LAN. It had IPX/SPX drivers and everything: protocols that have not been widely used in decades. Looking at some log files, I was able to glean it was part of a network of at least another 11 computers.
My phone blinked. It was my boss. I hit hands free.
"Yo".
"Hey, how is that server?"
I looked down at the phone and paused, briefly. It was odd that he was asking me this, so soon. I'd only gotten the computer an hour ago.
"Yeah, it's a DOS machine. I don't know how the guys missed it."
"Uhuh. What's on it?"
"I haven't gotten to that part yet, but there is a backup directory."
He inhaled quietly. I leaned over to the computer, hit a few keys, and continued talking.
"Yeah, the backup directory is loaded with a bunch of ARC files."
"Arc?"
And at this point, I lied. I don't know why I felt the need to lie, but I did.
"I dunno, I've never heard of that extension."
He was silent, waiting for me to say more. There was an odd heaviness on the line.
"I'll go through them with a hex editor and see what I can see. Do you want me to stay in tonight, to get this done? Is it a high priority."
"No no, that's fine." he said, suddenly lighter. Artificially lighter. "I've got to run here, we'll talk tomorrow."
And he was gone. And you know, that might sound like a normal conversation, but it was not. There was something odd to it. It was abnormal that he called me so shortly after delivering the server. It was strange that he wanted details before I'd done my complete analysis. I can't adequately explain it to you, but that behavior was very abnormal.
At this point in the story, I have to make an admission. I am deathly inquisitive. It's what makes me good at what I do. It's also what has put my life in danger on at least three prior occasions. There is part of me that just can't let things go, and that part of me took hold. Something was up and, I felt I needed to do some things.
As soon as I was off the phone with him, I made a copy of the drive - I burned it to DVD, on a drive I had handy for just such occasions. I also scanned a copy of of the papers and wrote that to the drive as well: an evidenciary no-no, but hey, this was my personal copy. I wiped down the drive, and all parts of the server that indicated I'd been inside. I'd disturbed some of the dust, but there was nothing to be done about that.
I did my work using a thumb drive operating system and personal equipment, so there was no record of it having happened. As the final page finished scanning, I felt a brief flash of guilt and questioned what I was doing. Why was I risking my job, and possible prison time? Based on a phone call that "seemed strange?"
It wasn't just that though. There was the fact that the drive made it to me in the first place: the techs beneath me know DOS. There is no way they missed that. This "Operating system mystery, guys didn't know what to do with it" story had to be bullshit. Oh, and did I mention that the hard drive from the machine looked original? That drive was not a clone drive: it's the original drive. I don't know how my boss thought I'd miss that fact. Maybe he thought I wouldn't bother opening the machine. Why would he think that?
I packed things up: I closed up the server, put the papers back in their place, and stuck it on my project shelf alongside a few stacks of hard drives. I don't know precisely why, but I made a list titled "Tuesday", and listed the things I was going to do to the machine. I wanted it on record, somehow, that I had not done anything to that server.
I left the list on top of the server.
As I made my way to my car, I found myself glancing sideways more than normal. In the parking lot, I even stopped to tie my shoe, just so I could check out my six o'clock. There was nothing amiss, no one there. I laughed at myself for my paranoia, though the slight bulge in my coat reminded me I had reason to be paranoid. I got into my car and drove home, in mercifully light traffic.
Just as I was getting in the door, my phone rang: it was an old friend who was just arriving in town, and was wondering if I'd pick him up at the airport. That might sound odd, but for this character, Art, it was normal. Calling during the final approach of his plane, he informed me that he was whispering into his phone, so as not to attract the attention of the flight attendants. He did such things just to keep life a little interesting.
I told him I'd get him: if not me, another one of his friends would have done it. Art was like a passing tornado: you could choose to step onboard or not. If I'd have said no, he'd have found someone else. For whatever reason, on that particular night, I decided to take the ride. Before leaving the house, I hid the dvd.
Waking up the next morning was a nightmare. I had a splitting, throbbing headache. My mouth was disgusting, thanks no doubt to the scotch and cigarettes. My stomach, queasy, The clock said 6:30, so at least I had that going for me. I had plenty of time to get into reasonable shape. I got up and immediately drank two glasses of water. I took two aspirin. I considered a mild muscle relaxant but thought better of it. I showered, shaved, and by 7:30am I was looking presentable, though still feeling like death. A little visine here, a little mouthwash there, and I'd be good as new. Hah.
The drive to work was uneventful, and it was only upon pulling into the parking lot that I remembered the DVD, the strange computer, and everything that had happened the previous day. I wondered what I might find.
As I walked in the front door, the receptionist looked over at me. Her eyes widened a bit, and she said "Wait here." Odd. She picked up a phone and said "He's here." Even odder. Not long after, the elevator opened, and three men in black suits stepped out. The walked towards me, purposefully. "Mr. Oltrum, come with us." They said it: it wasn't really a request. I was ushered back out the front door and into a waiting black sedan. Two of the men got in the car with me, and the third went back to the office. My stomach yawned, and I could feel the vestiges of my headache coming back.
"What's going on here?" I said. "Who are you guys?"
The guy in the back seat looked over at me. He was a big man.
"Mr. Oltrum, you worked on a server yesterday. An old server."
"Who are you guys?"
The guy looked at me briefly, deciding. Honestly, I think he was deciding whether to show me, or to hit me: that is what his eyes said. He quietly reached into his jacked and pulled out a small black leather case. He flipped me a badge that, to be honest, scared me. I work with all sorts of organizations that would freak out the average person: all the three letter agencies, homeland security, some "International folks" .. and more. I didn't work with these guys. I'd barely heard of them, and when I did, it was always in the context of "Hope to God you never meet them." They were known to be largely unaccountable to anyone. Word was, they did as they pleased, at home and abroad.
I took my eyes off of the badge and looked back at the man proffering it. I nodded at him. He nodded back, looked back, his thousand yard stare looking through me. I felt like a bug. Nothing was said for a period of time. It felt like an hour, but was probably only six or eight minutes.
"What happened with the server?"
"Which server."
"The old pentium, the one Gary brought you directly."
"Uhh, he brought it in yesterday .. told me the junior guys could not figure it out."
"Yes."
"What couldn't they figure out?"
"The operating system."
"Uhuh. So what did you do with it?"
"I got it late in the day so I didn't do too much. Can you tell me what this is about?"
"What did you do with it?"
"I booted it. I scanned the directories."
"What directories?"
"The system directories, the backup directory."
The guy in the front seat stiffened slightly.
"What was in the backup directory?"
"A bunch of ARC files."
"What are ARC files?"
"I don't know, I was going to look it up today."
At this, he looked away, and then back.
"You didn't look at any of them?"
"No, I don't know how. I need to find out how to open them to look at them."
"You don't know what an ARC file is?"
I shook my head. "No, I do not."
At this, the guy in the front seat fidgeted and turned around.
"You know what guy, when someone says "No, I do not", it often means they are lying. If you were being straight with us, you'd just have said no."
"What?"
"You're lying."
The guy in the back seat interjected, "Wait."
"Did you open the computer?"
"No", I said, and then looked at the guy in the front seat, and added "I DID NOT OPEN THE COMPUTER."
My head throbbed. My eyes were burning.
The guy in the back seat chuckled, and spoke.
"You didn't open the computer?"
"No, I didn't."
"The inside looks like someone was in there."
"Maybe it was the drive techs, when they cloned the drive."
"Did you clone the drive?"
"No." I looked at the guy in the front seat, but said nothing.
"Did you copy any of the data from the drive?"
"No, like I told you.."
"I know what you've told me."
"What about the papers?"
"The numbers and letters?"
"Yes."
"I looked at them but they look like gibberish. What are they?"
At this, he was quiet. He was considering something. Although I wanted to say about a thousand things, I decided the best thing to do was keep quiet. And then, as I often do, I changed my mind.
"Did I do something wrong here? What is this all about?" I looked at both of them, with my best confused and disoriented look. No one spoke. "Does my boss know about this?"
The guy in the front seat piped up.
"How was your night with Art?", he asked, flatly. "You're looking a little rough."
I looked at him, surprised.
I said nothing.
"We're here", said the driver, curtly.
I'd not been paying attention to the road, and was more than a little put off when I looked out the window to see our destination.
We were at my house.
@xwalkran ]Check out my news/conspiracy aggregation site @ http://walkran.com
