20. Case of the Lucrative Lure

Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Apr 4, 2006

“Hand me the boot disk.” I said as I motioned to Scrap with my right paw. My left paw was busy making sure that the IDE cables were securely fastened to the suspect’s hard drive and the clone drive. “Ah, acquiring a drive in DOS with Encase. This is so old school.” Scrap mumbled as he fetched an Encase boot disk from his site bag.

The office was very quiet, and only the hum of the suspect’s workstation could be heard above our breathing. It was late, much too late, for a couple of monkeys to be playing around in a client’s office trying to acquire a hard drive image.

“So, how many more nights are we going to pop in here and image this lady’s machine? You are seriously cutting into my late night IRC sessions with the cyber-babes, boss.” Scrap lamented as he watched me examine the Encase floppy disk’s label.

Scrap and I were following our hard drive acquisition procedure to the proverbial ‘T’ tonight, as we had done for the past three nights. It was important that we not make any mistakes to prevent a possible stillborn legal case against the suspect employee.

The machine was powered off when we entered the room, so we had little difficulty in removing all the wired connections from the machine beginning with the power cord. Scrap had removed the screws from the workstation’s case and had performed a quick visual inspection for strange cables or configurations. Confident that all was well, he had unplugged the IDE and power cables from the internal hard drive.

Following Scrap’s lead, I had then plugged the power cable back into the workstation and booted into the CMOS setup screen by pressing the ‘F10’ key. I was careful to make sure that the machine was set to boot from the floppy disk, and I made a quick note of the time configuration.

“Hey pretty boy, stop daydreaming. Let’s do this.” Scrap said as he poked my arm with his paw.

I powered off the machine, attached the IDE cable and power cable to the internal hard drive, and double-checked that the drive was set to ‘master’. I attached my evidence collection hard drive to the secondary IDE controller and double-checked that the drive was also set to ‘master’.

“Uh, Chief. You almost did a ‘Scrap’, man! You forgot to Scrap-proof that original drive.” Scrap chuckled as he handed me an IDE write-blocker.

I wiped the sweat from my brow. Good call from Scrap.

I attached the write blocker between the primary IDE controller and the suspect’s hard drive. No data was getting changed on this drive!

After a few minutes of careful inspection, I inserted the floppy disk into the floppy drive, and powered the machine back up.

In a matter of minutes, I was greeted with a friendly “A:" DOS prompt. I typed ‘EN’ and pressed the return key.

I glanced at my watch. It was 23:30 hours, and my coffee was wearing off. I had to concentrate.

The Enase DOS screen appeared. I carefully locked the suspect’s hard drive by hitting ‘L’. This was a secondary safeguard to make sure that no data was overwritten on the suspect’s hard drive. I then hit ‘A’ to acquire, and entered the path for storing my evidence file on my evidence collection hard drive: d:\evidence\chief\filename.e01. Encase prompted me for a case number and my examiner name. I designated this capture as evidence number ‘4’ and entered an appropriate description. I verified that the current date and time were correct and entered some notes about this capture. I decided against compressing this evidence capture because our time was short. I breezed through the last remaining questions and watched as the capture process began.

“Holy long nights, Batman! Three hours to go on that capture. Maybe one of us should go get some chow and coffee?” Scrap inquired.

“You know, that’s not a bad…” I began.

I was interrupted by the sound of keys being inserted into lock on the front door.

I glanced at Scrap, and Scrap returned my worried gaze.

I slowly raised myself up enough that I could see over the cubicle wall.

Our suspect was entering the office, with what appeared to be her boyfriend in tow.

I couldn’t take my eyes off of the object protruding from his waistband.

It was a handgun.

89646-060404-813591-60 Rate content: https://web.archive.org/web/20140911213945/http://esbn.org/esbn/verify.asp?id=8964606040481359160&rate=yes https://web.archive.org/web/20140911213945/http://esbn.org/esbn/verify.asp?id=8964606040481359160&rate=no

Source: archived original

Part II · Apr 6, 2006

Four days earlier, in Securitymonkey’s secret jungle lair…“Dude, it is hot as hell today!” Scrap moaned as he poured himself a drink in my kitchen. While I’m sure that the ‘captain and seven’ he was making was supposed to be a 50/50 mixture, he seemed to have been generous with the ‘captain’.

“Hey, go easy on the rum. That’s my last bottle.” I said as moved the bottle a few feet out of Scrap’s reach. “How’s that assessment report for XYZ company coming?”

Scrap dumped himself into a nearby leather couch and reached for his trusty Scraptop without spilling a drop of his newly created monkey potion.

“Almost done. I’m having a little problem with the phrasing in parts of the remediation section though.” Scrap replied as he tapped the keyboard with a paw. “How do you tell a company that their resident security geek needs to be beaten with his own shoes and then terminated with extreme nastiness?”

I laughed. We had just ended a four-week engagement at XYZ company that left us shaking our heads in disbelief. Every workstation and server in the company was about a year behind in security patches, had no password policy, controls were misconfigured, and the whole place was ripe for an ugly security incident.

“Just stick to the facts, Scrap. You have about twenty pages of findings in the preceding section. Take each finding under it’s own merit and write a practical suggestion to fix it. I’m sure you’ll come up with some clever wording for the ‘poor security management and practices’ item.” I said with a large grin. I couldn’t wait to read the final executive summary.

My giggling was interrupted by the familiar skull-shattering ring of my cell phone.

“Chief.”

A soft feminine voice responded to my terse greeting.

“Hi, Chief? This is Susan Espinoza. I’m the office manager for Mendoza Management Minds here in town. I was talking to a private investigator and he recommended that I discuss my ‘situation’ with you.”

Have I mentioned how much I love referral business?

“Hi Susan! I can only guess who recommended me. What can I do for you?” I replied.

Susan placed her hand over her phone and was talking in a hushed voice to someone nearby.

“Sorry about that. My employers, Mark and Mike Mendoza have a situation with an employee that they would like to discuss in person with you. Would you be able to come by tomorrow and meet with the brothers?” Susan asked in a very professional manner.

“Absolutely. Let me take down your information. Ten o’clock tomorrow would work great for me. Sound good?” I asked.

“Could we make it eleven o’clock? We’d like you to arrive while… an employee… is at lunch. I hope you understand.” Susan responded.

“Not a problem Susan. Can I ask what type of situation you’re having? My associate and I would like to be prepared for the meeting.” I said as I gave a familiar ’thumbs up’ sign to Scrap.

“We’re missing some money. A lot of money.” Susan replied.

99379-060406-910927-70 Rate content: https://web.archive.org/web/20140910120057/http://esbn.org/esbn/verify.asp?id=9937906040691092770&rate=yes https://web.archive.org/web/20140910120057/http://esbn.org/esbn/verify.asp?id=9937906040691092770&rate=no

Source: archived original

Part III · Apr 7, 2006

Previously… from Part I of our story… SecurityMonkey and Scrap have an unexpected visitor…

The suspect entered the office with her boyfriend in tow. The boyfriend closed the door behind him and appeared to respond in a very slow, almost 70’s dopehead voice.“How long is this going to take? I want to go to the bar.” he said after a few cigarette-induced coughs.

“It’ll be just a minute Nevits. Calm down or you won’t have any money to spend at that dive or on that thing you call a ‘motorcycle’” said the suspect as she dropped her office keys in her purse.

“Of all the cases that we’ve worked, we’ve really picked a doozy this time!” I muttered quietly to Scrap.

Scrap took a deep breath. “Boss, how we playing this one? Homeboy has a gun!”

My mind was racing, complete with monkey screams and heavy chimp noises. This could go really, really bad.

My eyes widened, and a smile crept across my face.

Bingo.

“Follow my lead. Try not to say too much.” I whispered.

I crawled on all four of my paws back to the wiring closet of the office. The closet wasn’t viewable from the front of the office, and had a clear shot of the back door should I have needed to perform my Jesse Owens impersonation.

I cleared my throat.

“Hello?” I said as I wandered around the corner and faced the suspect and Nevits.

The suspect placed her hand over her heart and let out a quick scream.

“OH MY GOD! Who are you? What are you doing here? You about scared the crap out of me!” the suspect yelled. Nevits appeared to have been caught off guard as well.

“Hi! Sorry about that. My associate and I are here doing upgrades on the computers. I didn’t mean to scare you. To be honest, we weren’t expecting anybody here!” I said in my best mid-western accent. I was really laying it on thick.

The suspect walked forward a few paces and stared at her workstation. It was laying in pieces, and the hard drive was making a familiar ‘click click’ sound as Encase did it’s dirty work.

“Well, dammit. I need to get on my computer! How long is this going to take?” the suspect asked.

“Oh, this machine? Well we’re making a quick backup of it, and then we’re going to upgrade it to the newest version of Microsoft Windows. It might be a few hours until the backup is done.” I said with a sincere smile.

The suspect was not happy.

“A few HOURS? Boy, I don’t have a few HOURS. I need to get some work done RIGHT NOW. You better put that thing together and plug all that crap back in because I need to work!”

It was clear that things were not happy in the office.

Almost on cue, Scrap walked around the corner with a screwdriver and a battery-powered drill in each paw.

“Hey y’all! What’s going on? Hey boss, which computer do you want me to take apart now? I think I found another spare EYE-DEE-EEE cable in the toolbox!” Scrap said in an almost too-perfect southern drawl.

“List to me, this is my computer - in my office - and it has MY work on it. Put it together NOW!” the suspect said angrily.

Nevits apparently woke from his stupor coma and walked up behind the suspect.

“Yeah, man. You need to fix that thing now. We got things to do.” said Nevits as he uncrossed his arms to expose the handgun shoved in his pants.

I took a gamble and nudged Scrap in the side. “Hey Scrappy, let me bend down here and speed this backup up so the lady can do her work. Why don’t you ask these nice folks where we can get some good grub around here?”

Scrap knew what I wanted: a distraction. He immediately delved into a mindless tirade of useless banter on food and beer.

I knelt down next to the machine and carefully removed my cell phone from my pocket. I only had a few seconds to make a wager on our lives.

It was time to place my bet.

15576-060407-728990-86 Rate content: https://web.archive.org/web/20140910114022/http://esbn.org/esbn/verify.asp?id=1557606040772899086&rate=yes https://web.archive.org/web/20140910114022/http://esbn.org/esbn/verify.asp?id=1557606040772899086&rate=no

Source: archived original

Part IV · Apr 10, 2006

Three days earlier, Securitymonkey and Scrap are on their way to visit their new client …

Scrap was belching like an elementary school kid after a government-sponsored lunch program.“Dude, that last one was just repulsive.” I said in disgust as I rolled down my driver’s side window in the chimp mobile.

Scrap wiped his mouth with a look of youthful satisfaction. “That was an awesome cheeseburger man. I’m kind of wondering if that was really a 100% beef patty though.”

Nice thought, Scrap.

We arrived at MMM at 10:55 and found a secluded parking spot on the other side of the office park. Scrap grabbed our laptop bags and followed me up a flight of stairs to suite 222, home of Mendoza Management Minds.

Scrap had barely cleared the entry door of the office when we were greeted by a familiar voice.

“Gentlemen! Welcome. I’m Susan. Let me take you back to the brothers.” Susan said as she shook our paws and escorted us down a short hallway and into a spacious office suite decorated in beautiful oak furniture and equipped with a ‘harmony waterfall’.

Apparently the brothers needed to remain calm a lot.

“Chief! Scrap! Welcome.” said Mark as he shook our paws and introduced us to his brother Mike. The brothers looked like a pair of linebackers crammed into very expensive Armani suits.

We sat down in a pair of plush leather office chairs and listened to a brief history of MMM.

“My brother and I have done everything together our entire lives. We played high school football together, college football together, and graduated college together. It was only natural that we go into business together. MMM has been in business for five years, and we provide management consultation services to a pretty impressive list of clientele. Our services aren’t cheap, but the results are guaranteed!” Mark said with a huge grin.

Scrap and I nodded in agreement. I was being periodically blinded by the sun reflecting off of the Rolex watch on Mike’s wrist.

“Well, with success comes many challenges, right? Our business has grown so much in the past few years that we had to hire Susan to run the office, and most recently we had to hire a bookkeeper named Dana. Susan is a dream come true, and runs a very tight ship here. Dana, on the other hand, has presented us with a few challenges.” Mike chimed in.

“Like missing money?” I inquired.

Mike and Mark exchanged a glance and nodded in agreement.

“Do tell.” I said as I got comfortable in the new-found luxury of the leather chair.

“About six months ago we had a bit of a snafu with our state income tax payments. Dana was on sick leave, so Susan brought in an accountant girlfriend of hers named Barbara. During her first examination of our books, Barbara brought a few things to our attention that completely escaped us.” Mark said. “She noticed that a few routine vendors were being issued payment checks for services that weren’t being rendered.”

Scrap leaned forward in his chair and cleared his throat. “What kind of money are we talking about here?”

Mike and Mark exchanged another painful glance between themselves.

“Tens of thousands of dollars.”

53960-060410-456734-24 Rate content: https://web.archive.org/web/20140910114028/http://numly.com/numly/verify.asp?id=5396006041045673424&rate=yes https://web.archive.org/web/20140910114028/http://numly.com/numly/verify.asp?id=5396006041045673424&rate=no

Source: archived original

Part V · Apr 12, 2006

Securitymonkey and Scrap ponder their master plan after meeting with their new client…“Stop sweating on me dammit!” I yelled as I wiped away a small pool of liquid off of my arm.

Scrap stared at me, slowly raising an eyebrow. “You feeling okay, boss?”

We were camped outside of a local bean shrine, enjoying a few frozen coffee fraps. Mine, for whatever reason, insisted on dripping large pools of condensation onto my person.

“I prefer to ingest my caffeine orally. This drink is determined to enter my body through osmosis.” I complained as I reached for another Starbucks-engraved napkin.

“It’s the heat man. It’s melting your little monkey brain, kind of like the ridiculous amount of cash that we’re charging these two guys to produce their ‘smoking gun’.” Scrap said as he waved his cigarette smoke away from my face.

“The cash is nice, but we haven’t done anything yet besides bake in this heat. So what did you think of the brothers’ little speech?” I asked.

Scrap scratched his poor excuse for a goatee with his paw and took another drag off of the stinky weed smoldering three inches from his mouth. “Pretty cut and dry. Videotape the act, daily snapshots of the workstation, perform a little magic with Forensic Toolkit, and cash the check. What’s to think about?”

That wasn’t the reaction I was hoping to hear. It was clear that padawan-learner Scrap had not yet mastered his control of the intuition forces within his chimp-like interior.

“Step back from the situation, man. Look at what we do for a living. Look at the reputation we have. Look at the incredible detail involved in this type of work. Now look at… are you listening to me?” I asked as I waved my paws in front of Scrap’s face.

“Huh? Yes, I’m listening. So you’re saying that we’re overkill for this situation.” Scrap hypothesized.

By George, there was hope for Scrap yet.

“That’s a big affirmative. They don’t need us. They need a private investigator, or hell… a frick’in CPA could go through the darn books and provide an adequate audit trail to show fraud. We need to ask ourselves a question.” I said as I took one last slurp of my frap. “Why go to all of this trouble, and all of this expense, when it’s not really necessary?”

Scrap extinguished his smoke and peered at me over the top of his sunglasses. “Chief, look at those two gorillas. Do you think they take the cheap way out of anything? That one dude’s watch costs more than my car!”

I peered at Scrap over the top of my chimp shades, and inched closer to the table.

“Aren’t you the least bit curious in finding out who talked who into hiring us? I have no doubt the referral was genuine, but who was the driving force in hiring us?” I asked as I pointed to both of us.

Scrap thought for a moment and placed his drink on the table in front of him.

The wheels were turning!

“We’re doing someone else’s dirty work? AGAIN?” Scrap moaned and he fumbled around in his pockets for his pack of smokes.

“I’d bet my Starbucks gift card on it.” I said. “And I’ll tell you why on the drive back there.”

All was not what it seemed.

57602-060411-493157-28 Rate content: https://web.archive.org/web/20140910120104/http://numly.com/numly/verify.asp?id=5760206041149315728&rate=yes https://web.archive.org/web/20140910120104/http://numly.com/numly/verify.asp?id=5760206041149315728&rate=no

Source: archived original

Part VI · Apr 19, 2006

_Okay, okay … I can take a hint! This is my busy time of year, so my apologies for the delay in the case file updates. You bunch of addicts!!! =) _

Our story continues!

The Chief and Scrap arrive back at MMM after their strategizing at the bean shrine …“Great hammer of Zeus!” Scrap said as he threw his head back into his seat in the chimp mobile. “Where do you come up with this stuff?”

I chuckled. “You did it again. It’s ‘great hammer of Thor’. Zeus used lightning bolts.”

Scrap cussed under his breath.

I peered over at Scrap out of the corner of my sunglasses, careful to not take my eyes off of the road for very long.

“Look, it’s instinct. Put all the facts of the case together so far, then mix in the people that we’ve met and the conversations that we had today. Now look at my theory again. What do you think?”

Scrap tilted his chimp head against the passenger side window and gazed at the traffic nearby. “I think that reality is calling you collect, man. And it got your answering machine!”

I silently giggled inside. I certainly didn’t want to encourage the blinders that Scrap was apparently wearing.

“Scrap, let’s think about what …”

RING

The chimp phone was squawking from my belt.

“Chief? Hi! It’s Susan. I just wanted to tell you that Dana has the afternoon off, so it’s safe to roll on in and start your investigation.” came the same pleasant voice from my phone.

“Sounds good. We’re already en route and should be there in ten minutes. See you then.” I said as I pressed the ‘disconnect’ button.

“Oh crap!” Scrap exclaimed.

“WHAT!” I replied back in a startled manner.

“Dude, when I packed up our stuff I totally forgot Roscoe. He’s back at your pad in your living room.”

Three seconds until Chief’s head explodes… two… one…

“DAMMIT SCRAP!” I said in disgust as I flipped an illegal u-turn and headed back towards my secret jungle lair.

“How could he have forgotten to load Roscoe in the trunk? He’s the biggest item we carry!” I pondered to myself.

Roscoe was the code name for my beloved forensic workstation that I had purchased on the internet. Roscoe, like any other tool in my arsenal, evolved over time. During this moment in time, he was your basic Pentium III workstation packed securely into a custom-made hard plastic carrying case. The top lid of the case had an LCD screen built-in, and a USB keyboard and mouse fit neatly into a side compartment.

Roscoe was loaded to the hilt with Encase, Forensic Toolkit, several hex editors, a specialized file viewer capable of rendering just about any file format imaginable, password cracking software for zip files, pgp-encrypted files and Microsoft Office documents … you name it, it was on that box. The machine had an easily replaceable IDE cable that snaked out of the side of the workstation making the attachment of write blockers and hard drives a snap.

Roscoe’s case was secured inside a larger travel case that was packed with a craftsman toolkit, external hard drives and CD/DVD writers, disc media, floppy disks, a flashlight, evidence collection/chain of custody bags, safety vests, shoe booties, surgical gloves, a digital camera, a digital video recorder, and a printout of every known Starbucks location in the continental United States.

Needless to say, I wasn’t going anywhere on this case without Roscoe even if he did weigh in at an impressive 85 pounds or so.

A solid hour later, we had retrieved Roscoe and made the long journey back to MMM. We were greeted at the door by Susan and given full access to Dana’s workstation and MMM’s storage room full of files and records.

We were given clear marching orders from the brothers in our previous meeting: they wanted photographic evidence and concrete digital proof of what Dana was doing so that they could expedite her termination and counteract any potential lawsuit.

“Scrap, why don’t you go grab that ladder out of the wiring closet and take a peek above the ceiling tiles. See what you can do about rigging a camera up there, and one in the work area with a clear view of the screen.” I said as I tossed Scrap a nylon bag full of surveillance gear.

“Roger that.” Scrap replied as he wandered over to the wiring closet to locate the ladder that we both spied on our first visit.

I turned my attention to Susan.

“Susan, I have some basic questions that I need to ask you. Do you have a moment?” I inquired as I sat down in a chair near Susan’s desk.

“Oh, sure. Fire away.” Susan said with a smile.

“Scrap and I looked over the background materials that you provided us this morning, and I noticed that the brothers didn’t have an actual staff until you were hired. Who did the books before you and Dana were employed here?” I asked as I scribbled the question down on my notepad.

Susan gave me a surprised look and responded matter-o-factly “I thought you would have asked that question this morning in your meeting with the brothers. Mike always did the financial work and Mark did the marketing.”

I could barely write her answer down on paper.

“So Mike turned the books over to an accountant every quarter?” I queried.

“Chief, Mike is a CPA. He did it all.”

My stomach grumbled.

92623-060418-843361-63 Rate content: https://web.archive.org/web/20140910142208/http://numly.com/numly/verify.asp?id=9262306041884336163&rate=yes https://web.archive.org/web/20140910142208/http://numly.com/numly/verify.asp?id=9262306041884336163&rate=no

Source: archived original

Part VII · Apr 20, 2006

When we last left the Chief and Scrap, they were at MMM beginning their investigation…

“Auuuugggghhhhhhh CRAP!” came a scream from Dana’s cube.

BOOMI got up from my seat across from Susan and peered over the cubicle wall. Scrap had somehow kicked the ladder out from under himself and fell through a ceiling tile in the false ceiling.

Luckily for Scrap he landed on a pile of papers and an empty box full of styrofoam chips.

“Scrap, you okay? What the hell?” I asked as I approached his slow-moving chimp body.

“Man, what a rush. Dude, I think I bruised my brain!” Scrap said as he scratched the side of his head with his paw.

Like we could tell a difference?

“How about you get back up into the ceiling and get this done? We have a lot of material to go through, an initial image of the workstation to make, and additional interviews to conduct. Come on man, on with it!” I said with a grin.

Susan was standing behind me, her mouth still agape from watching Scrap fall through the ceiling.

“Is he hurt?” She asked quietly.

I chuckled. “Nah, happens all the time. Some kind of equilibrium problem in his head. Anyway, let’s get back to the topic at hand. You told me earlier that while Dana was on leave, you had an accountant acquaintance come in to do some light bookkeeping work, right?”

Susan nodded. “Correct. Dana deals primarily with the vendors that we use; places like hotels, meeting halls, catering services, office supplies, airlines, etc. I wanted Barbara to come in and do some account postings and then a quick balance.”

“So Barbara started reconciling the accounts payable, and realized that she had more entries than invoices?” I queried.

Susan kept nodding. “Yep, that’s exactly what happened. When she pointed this out to me, I thought perhaps one of the brothers had forgotten to give Dana a bill or something. However, I have a pretty good idea about what the brothers need on their gigs, and some entries looked suspicious. I asked Mark about them, and he couldn’t figure it out either. He called Mike, and Mike was all over it. Hence the reason you’re standing here in front of me.”

I scribbled on my notepad.

“You mentioned that there’s a fear that if Dana is terminated that she’s going to pursue legal action? On what grounds?” I asked.

“Well, Dana is a minority and she plays that card ALL THE TIME. We didn’t realize this until she needed to take her sick leave months ago. Dana was out of vacation time, so I encouraged her to explore an FMLA unpaid leave. Dana wanted to take a credit on her future vacation hours, which we don’t permit. Of course, according to Dana, we weren’t doing what she wanted because she was a minority. The brothers agreed to credit her a week of vacation hours just to shut up. You have to understand that I’m pretty sure she plays this card to everyone that doesn’t agree with her. It’s unreal!” Susan ranted.

“Interesting.” I said as I turned to a fresh page in my notebook. “One last question, Susan. Does Mark ever examine the financials?”

Susan thought for a moment. “Well, he looks at the monthly numbers. He pretty much leaves that side up to Mike. They both draw the exact same salary, and they split a bonus amount at the end of every year. I always got the feeling that Mark wasn’t really interested in the financials.”

“Gotcha. I appreciate your cooperation Susan.” I said as I shook her hand with my paw.

I hadn’t heard a peep out of Scrap, so I wandered over to Dana’s cube. Scrap was sitting on the top of the ladder, fondling a pinhole camera.

“Um, Scrap? What are you doing?” I asked with a laugh.

“Looking at this camera.” Scrap replied as he held the device a few feet from his eyes.

“And you’re not installing it because…?” I whined.

Scrap looked over at me and raised an eyebrow.

“Because I just pulled it out of the ceiling. Somebody beat us to it.” Scrap said as he tossed me the camera.

My mouth was agape.

23052-060420-147652-93 Rate content: https://web.archive.org/web/20140910135201/http://numly.com/numly/verify.asp?id=2305206042014765293&rate=yes https://web.archive.org/web/20140910135201/http://numly.com/numly/verify.asp?id=2305206042014765293&rate=no

Source: archived original

Part VIII · May 1, 2006

“You trying to catch flies or what boss?” Scrap said as he peered down from the ladder, and watched me inspect the camera.I immediately closed my mouth and rotated the tiny camera device in my hands. It was pretty standard fare for a wireless pinhole camera. It appeared to run off of an external battery.

“Scrap, what’s the power source up there?” I asked. Scrap stuck his head into the ceiling once more, careful not to fall off of the ladder this time.

“Looks like a pretty big battery pack wrapped in duct tape. Not too clean. I’d say there are four or five cells in it. You want me to glove up and bag it?” Scrap responded as he carefully climbed back down the ladder.

I thought intently to myself. “A single battery would probably run this little guy for seven to eight hours. Assuming there were four cells, the owner of the camera was probably looking for 24 hours of coverage. The unit had a very small transmitter, so it couldn’t transmit more than a thousand feet or so…”

“Hey, sleeping beauty? You want me to grab this pack or what?” Scrap said again.

“No. Leave it there. Actually, put the camera back up there but don’t hook up the power supply.” I said as I handed Scrap the camera.

“Let me guess. You want me to move our camera to another location.” Scrap said as he placed a finger next to his temple.

“Correct. Don’t use the wireless gear. Run wired back to that telephone closet and drop the receiver and the VCR into one of our travel cases and lock it.”

Susan appeared out of nowhere.

“Everything going okay? You guys need anything?” she asked with a smile.

“I think we’re doing fine. Would it be okay if I examined some of your personnel records and skim through the past six months of payables?” I asked sincerely.

Susan thought for a moment. “Sure, let me go pull all of that stuff. The brothers are out of the office for the rest of the afternoon, and Mark wanted me to remind you to call him later this afternoon on his cell phone with a status update.”

“Thanks. I’ll do that.” I said as I turned around to eyeball Scrap’s camera installation.

Moments later, Susan informed me that she had pulled the requested information and it was ready to be examined in the sitting area in Mike’s office.

“Scrap, I’m going to stick my nose in some paperwork for a while. You got this covered?” I joked.

Scrap was covered from head to toe in dust and crud from the false ceiling tiles.

“Don’t hurt yourself.” Scrap mumbled.

I wandered into Mike’s office and spied a few boxes of folders. I turned my attention to the employment records, taking down a few notes on my notepad as I examined Dana’s folder. Everything in the records jived with what I had been told.

Interesting.

I moved on to the box of accounts payable documents, filled with copies of invoices and printouts from the accounting software. Susan had given me everything for the past six months, including Barbara’s reconciliation work. According to Barbara, the late tax payments were the result of Dana not printing and mailing the checks. Below these notes was a table of payments made to vendors with question marks near several transactions. The transactions were for even dollar amounts, however the dollar amounts were never the same. They ranged from several hundred dollars for ’event planning services’ to several thousand dollars for travel agencies and catering services.

My curiosity was getting the best of me. I started thumbing through copies of bills and invoices until I arrived at some of the suspicious invoices that Barbara had flagged. The invoices were Xerox copies, but were very clear and easy to read.

I placed the suspicious invoices in a separate pile, and then laid them out on the table next to each other in a nicely organized row.

They all looked the same, aside from differing dates and dollar amounts and … wait a minute. Out of sheer habit, I had lined the invoices next to each other in chronological order by company.

A quick scan of the invoices revealed that the invoice numbers incremented by one for each invoice for each company. What are the odds that these companies weren’t billing any other customers within a 7, 14 or 30 day period?

This would incorrectly suggest that the companies had one client… or someone had a poor imagination coming up with invoice numbers.

97354-060430-890679-68 Rate content: https://web.archive.org/web/20140910133956/http://numly.com/numly/verify.asp?id=9735406043089067968&rate=yes https://web.archive.org/web/20140910133956/http://numly.com/numly/verify.asp?id=9735406043089067968&rate=no

Source: archived original

Part IX · May 3, 2006

If the age-old adage that “curiosity killed the cat” was true, I was one dead pussy.

Stop snickering.My attention turned to a few other stacks of invoices and bills from the past few months and centered on the cell phone bills. They were huge! Each bill was carefully marked in the upper right hand corner with a name. I quickly figured out that this was how Dana (or whoever was paying the bills) was attaching bills to employees of the company.

Mark’s cell phone bill was several pages thick with lots of calls to the MMM office and, according to the company phone list (which strangely enough had cell and home phone numbers listed as well), his brother. Mike’s cell phone bill was easily a third larger with very similar numbers. One particular number seemed to repeat throughout the bill, and the call times varied between 18:00 hours and 02:00 hours.

“Unusual.” I thought to myself.

I flipped through the rest of the bills and made note of interesting companies and amounts.

“Boss.” I heard Scrap say as he stood in the doorway of the office.

“Yo.” I responded without taking my eyes off of my notepad.

“Cameras are up. You want to check these guys out?” Scrap asked.

I peered up from my scribbling to see Scrap brush a few layers of drywall and ceiling tile dust from his shirt.

“I’m sure you have it under control. You ready to image that workstation?” I queried as I noticed that my coffee level was approaching critical.

“Sure. You want to set it up?” Scrap asked in an I-so-want-to-sit-down-and-rest tone.

I chuckled.

“Not a problem. I think I have what I need here.” I said as I placed the invoices and bills neatly back into organized piles.

We walked out to Dana’s cubicle and started to unpack Roscoe. I threw Scrap my trusty digital camera.

“Start snapping.” I said with a smirk.

Scrap was not pleased.

After photographing the work area, we focused our attention on the workstation. It was your average beige box PC with a Windows 2000 license sticker affixed neatly to the rear of the case.

“It’s powered off.” Scrap noted as pulled the workstation from its position on the desk.

After some masterful case removal by Scrap and more photographs, we snaked an IDE tap cable from Roscoe to the workstation’s hard drive.

“Write blocker is in place. Let’s welcome Roscoe to another fun-filled adventure.” I said as I powered up Roscoe.

Well, I attempted to power up Roscoe.

“DAMN!” I screamed. Roscoe was dead.

Scrap grabbed Roscoe and proceeded to initiate computer triage.

“Dude, that’s the second power supply that has died in this guy. What the hell?” Scrap said in disgust.

I dug through my bag of tools and software in despair and grabbed my trusty Encase boot disk.

“We’re saved!” Scrap joked as he unhooked Roscoe and prepared to do a local capture on the workstation.

Scrap double-checked that the internal hard drive wasn’t attached to the machine’s IDE cable, inserted the boot disk, and pressed the power button. He quickly hit the proper key and was looking at a BIOS screen.

“Date and time check out, booting from floppy … looks like we’re ready to do this.”

I was daydreaming.

“Eh, Chief are you there?” Scrap asked as he waved his paws around in the air.

“555-0055” I said out loud.

“Is that a song? I thought it was ‘8-6-7 …’” Scrap joked.

“No, no, no. I’ll be right back. Start the imaging.” I barked as I walked back into the office and towards the piles of bills and invoices.

I flipped through Mike’s cell phone records again and looked at the popular phone number, and the odd times that it was dialed.

Holding the cell phone records with one hand, I scanned the company phone directory for the phone number.

Mike and Dana must have had a lot to talk about.

At two o’clock in the morning?

21390-060502-131035-92 Rate content: https://web.archive.org/web/20140910123649/http://numly.com/numly/verify.asp?id=2139006050213103592&rate=yes https://web.archive.org/web/20140910123649/http://numly.com/numly/verify.asp?id=2139006050213103592&rate=no

Source: archived original

Part X · May 10, 2006

“I need an iced coffee, stat!” Scrap said as he plopped down on a leather couch in the office, carefully dramatizing his tired state.

I reached into my pocket, collected my car keys and playfully threw them at Scrap, who made a wide-eyed softball catch with one hand.“Hey! Not cool! You’re not coming with?” Scrap inquired.

“Is the hard drive acquisition completed?” I asked.

“Oh yeah. Right.” Scrap replied. “So, you look like somebody stepped on your banana with a pair of steel-toed work boots. What’s up?”

I continued to scribble in my notepad. “Remember the conversation that we had in the car on the way over here?”

Scrap looked up at the ceiling. He always did that while performing mental research inside his cranial cavity. It was if he was waiting for the lone marble spinning around in there to touch a magic memory spot.

“Your theory? Sure. I remember. And I’m even low on caffeine.” Scrap laughed.

“Well, I was off a bit. I suspect that…” I trailed off as a figure appeared in the office doorway.

“GUYS! How’s it going? I see we have a computer torn apart and making weird noises, and you’re making your way through the accounting records. Excellent. Your reference said that you moved quickly. Going smooth I take it?” Mike said from behind a smile composed of perfectly capped teeth.

“Everything is going great. We’re just finishing up a few things and then we’ll be back periodically over the next few days.” I said in my best sales suit voice. “Scrap, let’s give Mike some breathing room in here. I’m sure he doesn’t want your dust-covered chimp butt on his couch.”

“Hey, it’s cool. How did you get so dirty, Scrap? You look like you fell through the ceiling of a flour mill.” Mike joked.

“Oh, just crawling around on the floor, man. My boss is a slave driver.” Scrap said as he wandered out to check on Dana’s workstation.

Mike grabbed my arm on my way out the door.

“Slam dunk?” he asked.

“Errruuuhhhh?” I asked in my best Scooby Doo voice.

“Slam dunk. You know, you found what you need to solve our little ‘problem’ in the office?” Mike persisted.

I took half a step backwards toward the door and composed myself.

“We’re making decent progress. I’ll keep you and your brother in the loop, although I’m not planning on having a status meeting for a few days.”

Mike polished the face of his Rolex with his handkerchief. People still use handkerchiefs?

“Right. No problemo. I need to make some phone calls, so I’ll let you get back to what you were doing there, Chief.” Mike said with another grin.

Okay, that was uncomfortable.

I joined Scrap in front of Dana’s cube and we watched the second Encase image of the hard drive finish. I tagged and bagged the drives while Scrap reassembled the workstation and tidied up the work area. The cubicle was almost cleaner than when we arrived.

“Ready for that coffee?” I asked Scrap as we grabbed our bags.

“And how.” Scrap replied as he licked his lips.

“Chief! Chief! Chief!” I heard Susan say in a hurried panic of a voice.

“Hey! We’re almost out of here, sorry to take so lon…”

“Chief! You guys need to go down the back steps right now. Dana just called me and she’s five minutes down the road. She’s coming in to pick up some work to take home.” Susan said as she directed us to the back door.

She didn’t have to tell us twice.

Scrap and I double-timed it down the back stairs and walked casually back out to the parking lot to our car. To my left I saw a black Volkswagen bug pull into a parking space directly in front of the walkway to MMM. A thirties-something yet trying-to-look-much-younger woman exited the driver’s door and walked with a brisk pace towards the stairs.

“Think she’ll notice?” Scrap queried as we deposited our gear into the trunk of the car.

“Notice? Notice what?” I asked.

“That we completely defiled her workplace … and, umm….” Scrap hem-hawed.

“Out with it. What?”

Scrap reached into his unzipped tool bag and pulled out a PS/2 mouse.

“That I forgot to plug her mouse back in?” Scrap said with a wince.

Dammit, Scrap.

90994-060510-827080-61 Rate content: https://web.archive.org/web/20140910144411/http://numly.com/numly/verify.asp?id=9099406051082708061&rate=yes https://web.archive.org/web/20140910144411/http://numly.com/numly/verify.asp?id=9099406051082708061&rate=no

Source: archived original

Part XI · May 16, 2006

I knew what I wanted, and I was going to get it right then and there. I put forth my paw, only to retract it and hover above another section of humid warmth.

“Buffets are evil.” I mumbled to myself as I slapped the last pound of food on my tray. Scrap had already filled his tray with a vast assortment of food and was in the process of gnawing on a chicken leg and making moves on the waitress - or maybe I had those backwards. “Two inches.” I said as I sat down at Scrap’s booth and placed my tray on the badly scratched wooden surface of the table. “You came within two inches of causing my head to explode today.”

Susan’s recent phone call echoed loudly in my memory. Dana had arrived at the office and shuffled around her work area, but did not attempt to access her workstation. Scrap’s little mishap went unnoticed.

Scrap dropped the badly devoured chicken leg on his tray and enjoyed a long drink of his soda.

“I’m sorry, man. I was in a hurry and wasn’t paying attention to what I was putting in my bag. I’m pretty sure everything else was right where it should have been according to the pictures that we took. Dude, I even vacuumed her cube!” Scrap lamented.

I stabbed a beef medallion with my fork and used the knife in my other paw to carve off a tender bit of cow goodness.

“I understand, but try to keep in mind that you have to work backwards sometimes. After the acquisition is complete, you need to press the ‘rewind’ button on your chimp brain and put everything back exactly where it was - right down to the dust bunnies and dead flies. Remember what happened at that Spanish wholesale foods company?” I said excitedly.

Scrap pondered my request for a few moments. “Oh, yeah! Wow, you really messed up that time.”

I was shooting Scrap a look of death, but at the same time remembering a serious mistake that I had made at a client location.

[Flashback] _We had been brought in several years earlier to image the workstation of an executive at a Spanish wholesale foods company. The job had encountered several technical challenges that made the job last almost eight hours. I was fatigued and not thinking clearly. During the imaging of the executive’s workstation, I had adjusted the backrest of his chair to accommodate my frequent stretching. Unfortunately for this monkey, I forgot to adjust the backrest to its previous location. When the executive returned to his locked office the following morning and sat in his chair, he knew someone had been in his office. He became suspicious and confronted the other members of management that had initiated the engagement. Not a pretty sight. _ [/flashback]

The blood was rushing from my brain to my stomach, and I knew that I was one doomed monkey. Unfortunately for me, I wanted to make a first pass run through the image of Dana’s workstation before the next day.

Time to hit Starbucks.

An hour later I was seated in my lab at my secret jungle lair and examining a copy of Dana’s workstation image. The original image (in addition to yet another copy of the image) was safely wrapped in an anti-static bag, tucked away inside a chain of custody bag. AccessData’s Forensic Toolkit was making short work of the data on the image and soon greeted me with a plethora of data adventures to begin.

The workstation had two user accounts: Administrator and Accounting. A cursory inspection of Administrator’s home directory showed nothing of interest. The account had not been used to log into the machine in over a year.

Accounting’s home directory was where the action was.

I knew that MMM used a popular accounting package and Microsoft Office documents to manage the finances. I knew that this accounting package had a proprietary database structure and that I would have to install the accounting software on a test machine to look at the data. Lucky for me I had grabbed the retail box of this software while at MMM for just that purpose.

After an installation procedure that never seemed to end and a quick database restore, I double-clicked the accounting software’s launch icon and was greeted by a login screen.

“Hmmm.” I thought to myself. I hadn’t had the foresight to remember to ask Susan for authentication information for the accounting software.

I knew that the default administrator user in the software was ‘admin’, and according to the documentation in the software’s retail box, the default password was ‘password’.

No way it could be this easy.

A-d-m-i-n. P-a-s-s-w-o-r-d.

I was in.

A quick scan of available user accounts showed several users: Admin, suze, mmm and dana. There was user information provided for ‘suze’ and ‘dana’ linking those accounts to Susan and Dana. The Admin info fields were factory default. The user ‘mmm’ appeared to have been created by Mike shortly after the software was installed. I made meticulous notes of these facts on my notepad.

I stumbled through option screen after option screen until I came to something that looked promising. Under a tab marked “History” I found an option labeled “Transaction History”. I ran a transaction history report, but unfortunately no user information was assigned to each transaction.

How was I going to know which user put in which transaction?

A quick (and expensive) call to the software’s help desk proved futile. Nobody had ever asked for such a feature. Great.

It was getting late and my eyes were starting to close on their own. The coffee pot was empty. I was not happy.

My monkey butt was three inches off of the surface of my office chair when an idea popped into my head.

Could FTK read the proprietary database format?

After a few mouse clicks, FTK revealed a startling fact to me. The database format appeared to be some sort of fixed-length plain-text hack. FTK screamed through the database. After several searches on the ‘questionable’ vendor names that Barbara had noted in her report, I noticed a pattern immediately.

All of the entries were entered by ‘mmm’.

78447-060516-701607-49 Rate content: https://web.archive.org/web/20140910120818/http://numly.com/numly/verify.asp?id=7844706051670160749&rate=yes https://web.archive.org/web/20140910120818/http://numly.com/numly/verify.asp?id=7844706051670160749&rate=no

Source: archived original

Part XII · May 23, 2006

Twenty thousand cymbals were being smashed by twenty thousand hammers. Or, I might have added just a touch too much Captain Morgan to my nightcap. The sound permeating my brain was Scrap ringing my doorbell incessantly.

Why was Scrap here?

I rolled over and realized that I had dozed off on the couch, a mere ten feet from the door of my home-based forensics laboratory. A quick glance at the clock revealed that it was almost 11:00 hours. No wonder Scrap was ringing my doorbell.

It was almost lunchtime.

I wiped the sleep from my eyes and opened the door to find a strangely energetic Scrap with a hot cup of Starbucks brain food in his hand.

“Dude, this cup is burning my paw. Take it already!” Scrap whined as he thrust the familiar green logo cup towards me.

I wasn’t going to argue.

I motioned for Scrap to sit down on the couch and threw my notepad into his lap.

“Do you smell that?” I asked.

Scrap grimaced.

“Sorry man, McDonalds was the only thing open this morning and I was craving a sausage egg mcmuffin…”

I slurped on my coffee loudly.

“No, fool. Look at my notes from last night. It turns out that there was a way to figure out which user of the accounting software put in the questionable entries. This was their ‘big mystery’.”

Scrap looked over my notes and squinted his eyes during a deep thought process. Smoke appeared to bellow from his ears.

“So, the next step is to put a person in front of the computer. This person would be logging in as ‘mmm’ and guilty as hell?”

I slurped the last of my coffee with satisfaction.

“Correct. We need to get back into the office today and inspect our surveillance tape.”

[Aside] It is worth noting that at this point in the case, we had not made it obvious to anyone in the office that we had installed surveillance cameras, only that we were conducting an inspection. Depending on my gut feeling and the security policy in place at the facility, I may or may not make the client aware that a location is being taped. [/Aside]

Scrap and I spent the early afternoon going over the image of Dana’s workstation with the finest granularity we could muster. Nothing significant was found beyond the usage of the accounting software.

We scurried back to the office later the following evening and let ourselves into the office with a key provided by Susan.

We would have returned an entire day earlier, however Susan advised us that part of their suite was being repainted and recommended that we not go in unless we were wearing some sort of air filtration system. This was unexpected, but enabled us to perform additional lab research on the accounting files and usage habits of the users on Dana’s computer.

“Creepy.” Scrap said as he looked around for a light switch using the emergency lighting as a guide. “Found it!”

The interior lights of the office came on and nearly blinded me.

Scrap unlocked the wiring closet and removed the ladder so that we could both fit inside to rewind and view our tape. With our timeline screwed up by the painting, we would only have the first twelve hours after camera set up to view.

We had to keep remembering that the events we were watching happened two days ago.

Dana appeared on the tape briefly. The date and time stamp on the tape showed that it was merely minutes after we left the office that day and discovered that Scrap had forgotten to replace Dana’s mouse. Dana entered her cube with her back turned to both cameras. She quickly shuffled some items around in a desk drawer, talked to Susan and left the same way she came in.

“Interesting.” I said as I held my head with my paw.

Scrap fast-forwarded the tape to the very end.

Nothing. Aside from Susan looking up a few invoices while talking on her cell phone, there were only a few busy custodians and a curious fly disturbing Dana’s cube.

“Well, back to square one. Let’s get a fresh tape in there and image this fricking workstation.” I mumbled as I watched Scrap swap out the tape.

Scrap masterfully disassembled the cover of the workstation once again and we got to work.

For the second time in a row, my Encase boot disk was the star of the show. It would be days until we received a replacement power supply for Roscoe.

“Holy long nights, Batman! Three hours to go on that capture. Maybe one of us should go get some chow and coffee?” Scrap inquired.

“You know, that’s not a bad…” I began.

I was interrupted by the sound of keys being inserted into the lock on the front door.

I glanced at Scrap, and Scrap returned my worried gaze.

I slowly raised myself up enough that I could see over the cubicle wall.

Dana was entering the office, with what appeared to be her boyfriend in tow.

The boyfriend reminded me of an older, heavier version of the homeless guy that wandered through a neighborhood I once called home.

As Dana and company moved closer, my eyes were focusing the boyfriend’s arm.

It was placed neatly across his abdomen, resting on another object.

A handgun.

_Note From The Chief: now would be a really good idea to go back and read the following entries: ++ Case Of The Lucrative Lure - PART ONE ++ Case Of The Lucrative Lure - PART THREE

What is going on? Why IS Dana coming back to the office? And why does Scrap eat junk food for breakfast?_

82440-060523-999581-78 Rate content: https://web.archive.org/web/20140910153805/http://numly.com/numly/verify.asp?id=8244006052399958178&rate=yes https://web.archive.org/web/20140910153805/http://numly.com/numly/verify.asp?id=8244006052399958178&rate=no

Source: archived original

Part XIII · May 30, 2006

“Mommy, I’m scared.” Scrap whispered in my direction.

Leave it to Scrap to never lose the sense of humor, even in the most potentially dangerous situations.I slowly raised my head over the cubicle wall and glanced towards our new visitors again. The boyfriend closed the door behind him and appeared to either be really tired, or really stoned. Or both.

“How long is this going to take? I want to go to the bar.” he said after a few cigarette-induced coughs.

“Maybe I’d have a motorcycle to match my lovely piece of crap Nissan pickup if someone would pay me?” Nevits said sarcastically.

Motorcycles? Money? Dopehead?

“Of all the cases that we’ve worked, we’ve really picked a doozy this time!” I muttered quietly to Scrap.

Scrap took a deep breath. “I should be chatting with hotties on IRC right now, man. How we playing this one? Stoner boy has a gun!”

I had to think fast, and without the added stimulation of a finely brewed cup of coffee. This could go really, really bad.

“I have plan. Follow my lead. Try not to say too much.” I whispered.

I gave Scrap a hand motion to follow me as I crawled towards the wiring closet. The closet wasn’t viewable from the front of the office, and had a clear shot of the back door for a quick escape.

We both ascended to our feet and quietly dusted off our pants.

“You ready for this?” I whispered.

“No.” Scrap replied.

“Shut it.” I muttered as I cleared my throat, put a smile on my face, and wandered around the corner.

“Hello?” I said as I faced our visitors.

Dana let out a quick scream.

“OH MY GOD! Who are you? What are you doing here? You about scared the crap out of me!” Dana yelled. Nevits hand massaged the gun in his waistband.

“Look, I really need to get on this computer. How long is this going to take?” the suspect asked.

Dana was looking frustrated and glaring at Nevits.

“A few HOURS? Boy, I don’t have a few HOURS. I need to get some work done RIGHT NOW. You better put that thing together and plug all that crap back in because I need to work! This is so typical of the brothers. I suppose you two work cheap at night or something.” Dana whined as she threw her hands up in the air.

Almost on cue, Scrap walked around the corner with a screwdriver and a battery-powered drill in each paw.

“Listen to me, this is my computer - in my cubicle - and it has MY work on it. Put it together NOW!” Dana said angrily.

Nevits apparently woke from his stupor coma and walked up behind Dana.

“Yeah, man. You need to fix that thing now. We got things to do.” said Nevits as he uncrossed his arms to expose the handgun shoved in his pants.

Scrap knew what I wanted: a distraction. Scrap, the master of inane chatter and miscellaneous conversation immediately delved into a mindless tirade of useless banter on food and beer.

I knelt down next to the machine and carefully removed my cell phone from my pocket.

“Seriously! They kicked me out. And I hadn’t even had a single drink. Can y’all believe it?” Scrap rambled on.

Dana and Nevits were actually enjoying Scrap’s infamous story of being thrown out of a strip club face-first into the street.

The number on the other end of my cell phone was ringing.

“Hello?”

I breathed a sigh of relief.

“It’s Chief. How fast can you get down here to MMM?” I asked.

“I’m eating at a place right around the corner. What’s up?” asked the voice.

“Dana is here. I think you two should have a conversation.” I whispered.

“You have got to be… oh crap. Right. On my way.” said the voice as the call ended.

I slipped my cell phone back into my pocket and stood up. Dana was standing inches behind me, nodding her head like she was listening to one of Scrap’s famous “What happens in Vegas” stories.

Seconds after the not-so-climatic ending to Scrap’s story, Dana turned her head and stared in my direction.

“I heard you.” Dana said in a serious tone.

“Beg your pardon?” I responded.

“I heard you on the phone.” Dana said. “Who were you talking to? What are you really doing here? How did you know my name?” Dana inquired as she nudged Nevits.

I was on the spot, but saved when a familiar voice came from the front door.

“Because I told him.” Mark said as he closed the door behind him.

I hadn’t even heard the door open. Apparently Mark is a speedy eater.

“Mark? What are you… oh, I get it. This just completes the picture, right? I thought you were smarter than this, Mark.” Dana said as she sat on the corner of her desk.

“Actually, Dana… I think Chief has put together a much more clearer picture than you think.” Mark replied as he adjusted the toothpick in his mouth. “Chief?”

“Dana, my name is Chief and Mr. Entertainer here is my associate Scrap. We’re information security investigators, and I’d like to ask you some questions.” I said.

Dana was staring off into space.

“Dana, why did you come into the office tonight?” I asked.

Dana turned around and unlocked a drawer in her desk.

What she pulled out put a look of satisfaction on my face.

41863-060530-335762-12 Rate content: https://web.archive.org/web/20140910153812/http://numly.com/numly/verify.asp?id=4186306053033576212&rate=yes https://web.archive.org/web/20140910153812/http://numly.com/numly/verify.asp?id=4186306053033576212&rate=no

Source: archived original

Conclusion · Jun 6, 2006

You’ve all waited patiently for the climatic ending of this case file, and here it is!

Grab a coffee, and enjoy the conclusion to The Case Of The Lucrative Lure.

It was so quiet in the office that I could hear my own pulse.

Creepy.

Dana was standing in front of her desk with her hands outstretched. Laying perfectly center across her palms was a single black VHS videotape.

“I came in here with Nevits to retrieve this, and get the hell out of here.” Dana said with a quick glance at her companion.

I cleared my throat. “Dana, can I ask who Nevits is and why he’s here?”

“I’m a PI.” Nevits said, beating Dana to the punch.

“He’s a mathematical symbol?” Scrap joked under his breath, making fun of Nevit’s mispronunciation.

“Okay, you’re a private investigator. Why are you here with Dana?” I queried as I sat down on a nearby desk.

“Dana here had a little problem with her boss, so I snuck in here with her last week and rigged up a camera.” Nevits said as he pointed to the ceiling. “We came in tonight to yank the tape.”

Mark walked towards me and sat next to me on the desk. “Dana, from the beginning… let’s hear your story.”

Dana seemed very uncomfortable, but replayed her story nonetheless. “This whole mess started right after I started working here. Mike took a liking to me right away and asked me out. I know it’s not a smart idea to go out on dates with your boss, but he was very charming.”

Mark was cringing and rolling his eyes.

Dana continued. “Mike and I were dating for quite a while, and became very comfortable with each other. One day during a reconciliation I noticed some strange transactions in the accounting software. I hadn’t entered them, and neither had Susan. I asked Mike about them and he told me not to worry about them and just make things balance. When I told him that I needed the invoices for the entries, he got upset at me. The next day, invoices magically appeared on my desk. This went on for quite a while… me having to remind Mike about missing invoices and such. Then, things got very complicated.”

I was taking notes so fast that my paw was aching. I made a mental note to bring my digital voice recorder next time.

“Dana, what do you mean ’things got very complicated’?” Mark asked.

“I discovered that I was pregnant. I wanted the baby, Mike did not and was very adamant about me terminating my pregnancy. I couldn’t do it! Mike became very angry with me and started to threaten me and my job. It got so bad that I had to take a leave of absence… and then they didn’t want to pay me my vacation. While on my sick leave I told Mike during a few late night phone calls that I wasn’t coming back to work and I wasn’t terminating my pregnancy. It was then that he threatened to call the police because he had evidence that I had been stealing thousands of dollars from the company. I almost died! I knew that Mike had been paying fake invoices for quite a while, but I was afraid to say anything. I’m sorry Mark. I thought you were in on it too.” Dana lamented.

Mark was very quiet. I knew that silence well. It was like showing up at Starbucks two minutes after closing time.

“Chief, let’s see what’s on that tape.” Scrap suggested as he reached for the video tape in Dana’s hand.

I nodded, and Scrap walked back towards the wiring closet with the tape in his paw. A few seconds later, Scrap and I watched a pixelated video of Mike entering transactions into the accounting software and then printing checks. The video was time and date stamped, and the logo on the invoices was easy to make out. I flipped back to my notes from the examination of Dana’s workstation and looked at the FTK dump of the accounting system’s database. The times matched.

“It’s all there.” I said to Mark as I walked back towards Dana’s cube.

Mark sighed. “Dana, I’m really sorry about this. I want you to know that nobody is going to call the police on you. I’m going to deal with Mike personally, and I’m going to call you tomorrow to work out a severance package that is fair. Will that work?”

Dana had tears swelling up in her eyes, and exhaled loudly like a huge burden had been taken from her.

“That would be great Mark. I’m really tired and I think I need to rest.” Dana said as she reached into her purse and retrieved a small white envelope. The contents were quickly examined, and the envelope handed to Nevits who repeated the examination.

Looks like Nevits was getting paid for his work.

Nevits escorted Dana from the office leaving Scrap, Mark and myself staring at each other.

“Chief, Scrap, I can’t thank you enough for helping me out on this. I just knew that you’d figure this out. I guess I need to start preparing myself for a very painful discussion with my brother tomorrow.” Mark said.

“With your brother controlling the funds around here, we’re still getting paid, right?” I joked.

Mark chuckled. “Of course. Man, this story is right out of a daytime drama show. I’m pretty sure after I talk to my brother tomorrow that MMM will be history. "

“If previous cases have taught me anything, it would be that your intuition is right on the money (no pun intended).” I said. “When you see your brother tomorrow and he asks how the investigation is going, tell him one thing for me, will you?”

“Anything.” Mark said. “What?”

I slowly removed my chimp behind from the desk that I had been sitting on and looked Mark in the eyes.

“Tell him that the case was a slam dunk.”

_ Questions:

What was the ’lucrative lure’?

How did I know early on that Mike was the center of the entire investigation?

Post your comments/questions!

Chief_

52052-060606-437660-22 Rate content: https://web.archive.org/web/20140910153815/http://numly.com/numly/verify.asp?id=5205206060643766022&rate=yes https://web.archive.org/web/20140910153815/http://numly.com/numly/verify.asp?id=5205206060643766022&rate=no

Source: archived original