The steps involved in carrying out a forensic examination of a computer are fairly standard. Unless it’s unavoidable, the technicians will not work on the original machine at all, but on a cloned version, a byte by byte copy, of the computer’s hard drive. That preserves the original intact and allows multiple copies of it to be made in case the clone becomes corrupted or unusable due to some internal security feature or protection the user has built in.
Initially, the parameters of the disk will be noted, making sure that the visible size of the hard drive corresponds to its stated capacity, a step that can reveal the existence of one or more hidden partitions. When the analysis begins, the technician will not boot from the cloned drive but from a known and safe external source to avoid any possibility of a hidden subroutine being triggered to wipe the drive or corrupt its contents. That also bypasses the user’s password, if enabled, and allows direct access to the directory structure.
Once inside the system, a variety of tools can be used to search for specific information if the subject of the search is already known. This will generate a list of documents containing whatever keywords have been input and is a fast and effective way of identifying documents for individual study. The problem the MI5 technicians at Millbank faced was that they had almost no idea what they were looking for on the laptop computer recovered from Charles Vernon’s house. A series of general searches including obvious words like ‘Porton Down’, ‘Dstl’, ‘chemical’, ‘biochemical’, ‘bioweapon’ and the like generated hundreds of results, none of which helped at all.
Vernon corresponded frequently with professional colleagues, and almost every email that he sent or received, and virtually every document on his computer contained unclassified information about his work. Or at least, information that appeared to be unclassified as far as the MI5 investigators could tell. The reality was that it would take a scientist who specialised in the same field as Vernon a considerable length of time to read and analyse the documents and correspondence they had found in order to determine whether or not they contained any classified information. And knowing whether or not Vernon had inadvertently – or even deliberately – breached the Official Secrets Act was in any case completely irrelevant: what they needed to do was find him.
He appeared to have little in the way of a social life. Virtually all of his contacts were professional colleagues, people he had worked with either at Dstl or at other scientific establishments in the United Kingdom and, in a few cases, scientists working in the same fields in America and Germany. Vernon communicated almost exclusively by email, as far as they could tell, and they could find no trace of any social media account in his name. He really did appear to live for his work and to have almost no life outside it.
The only other conclusion they were able to draw was that Vernon was neither a cook nor a gourmet. About the only non-professional contact details on his computer were the addresses and telephone numbers of a handful of restaurants and takeaways in and around Warminster, and access to his telephone records proved that he ordered in food about three or four times a week on average. Presumably he existed for the rest of the time on microwave food, ready meals and sandwiches, this conclusion also being based upon the sparse contents of his pantry and refrigerator, and on the boxes, cartons and tins they found inside the grey wheelie bin outside his back door, a couple of black bags of rubbish inside it.
And at least the biohazard threat had proved to be completely non-existent. The HazMat team that had been scrambled to Vernon’s house the previous Friday afternoon had been told by Simpson what Richter had discovered at Porton Down. So instead of taking the plastic box for examination in a BSL4 laboratory somewhere, two of the team had suited up completely, taken the box to the furthest point in the garden away from the house and their colleagues and the neighbouring properties and had cautiously pried open one corner of the lid.
Inside, the edges curling upwards as the bread had dried out, they found exactly what Richard Simpson had told them they would find: a week-old roast beef and horseradish sauce sandwich.
The sandwich went into a rubbish bag and the biohazard box went back into Vernon’s fridge.
The search of the house had revealed nothing else of any interest or relevance to the situation. There were clothes in the wardrobe, a couple of suitcases in a spare bedroom and a selection of soaps, deodorants, razors and an electric beard trimmer in the en suite bathroom, but without knowing how many suitcases and trousers and jackets and soaps and deodorants and razors and beard trimmers and all the rest that Vernon owned, it was impossible to tell from what was left whether or not he had taken a suitcase or a carry-on with him when he left the house.
The cameras at Heathrow then confirmed that he had taken a small weekend case with him, which was actually what would have been expected, if for no other reason that passengers who turn up to fly from one country to another invariably have at least some luggage with them. Anyone who doesn’t will immediately attract attention.
The recorded images from the airport also confirmed that Vernon’s carry-on had been passed through the scanner at the security checkpoint, and also produced the additional piece of information that, according to the member of the security staff there who’d been manning the luggage scanner, inside his weekend case Vernon had another laptop computer, which he had been told to remove so that it could be scanned separately, as usual.
That almost immediately rendered the search of the laptop they had seized pointless, because if the renegade scientist had any classified or compromising information in his possession, it would obviously be on the computer that he had taken with him, and not on the one that he had left behind.
Movement and progress are never the same thing: the MI5 team had moved around quite a lot, visiting and thoroughly searching Vernon’s house, and seizing and analysing the contents of the hard disk of his computer, but what they hadn’t done was make any discernible progress.
They still had no idea at all why Vernon had left the country, where his ultimate destination was or what he intended to do when he got there.