Securing a copy of the Dark Glider program was a big win for Nigel. Now he might have a chance of getting Jake off his back. Nigel’s thoughts drifted back to the evidence on his mother’s computer. He decided to multitask and set up Dark Glider to run while he was busy investigating the image.

Nigel inspected the contents of the imaged drive using open-source forensic software. Performing the inspection on the imaged copy of the drive reduced the risk of damaging the original contents.

Nigel ran a script that reconstructed all activity for a given time period on the machine. It was like running a time machine to go back and recover certain system activity, such as networks, internet browser histories, and what programs were being run. Nigel was hoping that he would be able to piece the clues together to at least construct a timeline of events.

If you come across this story on Amazon, be aware that it has been stolen from Royal Road. Please report it.

Several hours later, Nigel found clear evidence of malicious activity on the computer. The hacker did a good job of cleaning up after harvesting his mother’s information, but left one important breadcrumb for Nigel: an IP address to a MORP relay server.

Using an enhanced IP address tracker, Nigel was able to determine the attacker was operating out of Grozny, Chechnya—or at least the relay was—but he needed more information.