The Neighbor - Lisa Gardner [107]
“Okay.”
“Like any library, the computer needs to be able to retrieve the books at a moment’s notice. So it creates a directory, its own version of a card catalogue system, which it can use to find each particular piece of data on the bookshelves. Got it?”
“Got it,” I assured him.
Ethan beamed at me. Apparently, in addition to being a good teacher, I was an excellent student. He continued his lecture: “Now this is where the computer gets lazy: When you delete a document, the computer doesn’t take the time to track down the actual data on the bookshelf and trash it. That would be too much work. Instead, it simply deletes the reference to the document in the directory. The book’s still there; the card catalogue, however, no longer shows its location.”
I stared at my red-headed partner for a bit. “You mean to tell me, even if the cache is cleared, those particular Internet files are still on the computer somewhere?”
I got a second smile for that one. “Great job!”
I couldn’t help it. I smiled back. This made Ethan blush, and reminded me I had to be careful. Just because I was using Ethan Hastings didn’t mean I wanted to hurt him.
“So, if the card catalogue has been cleared,” I asked, “how do I find the data?”
“If you really want to know what’s in the computer’s browser history, I recommend Pasco.”
“Pasco?”
“It’s a computer forensic software you can download from online. Here’s the deal. When someone ‘clears the cache,’ the computer rarely clears all the cache. At least a few index.dat files get left behind. So you open the history files, run Pasco, and it’ll spit out a CSV—”
“CSV?”
“Comma Separated Values, which opens an Excel spreadsheet that will show every URL that was visited by the computer with a date-time stamp. You can cut and paste one of the URLs straight into the computer’s search engine and it’ll take you to that website for inspection. Voila, you’ll know everyplace the computer has visited.”
“How do you know so much?” I had to ask.
Ethan blushed furiously. “My um … family.”
“Your family?”
“My mother runs Pasco on my computer each week. Not that she doesn’t trust me!” He flushed brighter. “It’s just, um, ‘due diligence,’ she calls it. She knows I’m smarter than her, so she’s gotta have something on her side.”
“Your mother’s right, Ethan. You are a genius, and I can’t thank you enough for assisting me with this teaching module.”
Ethan smiled, but he appeared more thoughtful this time.
At home that night, I got serious. Two stories, one song, and half a Broadway show later, Ree was down, Jason was out, and I was all alone with my newfound computer skills and a whole host of suspicions. First order of business: downloading and installing the Pasco forensic tool from Foundstone.
Next up, I started working the menu system, identifying possible history files and running Pasco on the contents. Shoulders hunched, head down, I pecked away at the computer with eyes glued to microscopic type on the screen and ears perked for the first sound of Jason’s car in the driveway.
I didn’t know what I was doing, and everything took longer than I thought. Next thing I knew, it was after midnight and Jason was due home any minute. I was still running reports and hadn’t figured out yet how to uninstall Pasco, whose mere presence on the desktop would alert Jason that I knew something was going on.
I was hopped up and jumpy when I finally got the dialogue box asking if I wanted to open or save the CSV. I didn’t know what I should do, but I was running out of time, so I hit Open and watched an Excel spreadsheet fill the screen before me.
I figured I would discover dozens of URLs. Porn sites? Chat rooms? More terrible photos of terrified little boys? Evidence that the man I’d chosen to raise my child was a hard-core pedophile, or one