He shrugged, sipped his coffee black, eyes widening briefly at the dark roast. “Five or six years. I was a detective before that, but being a geek at heart, had a tendency to focus on the technology aspects of the cases. Given that everyone from a drug dealer to a crime lord is using computers, cell phones, or PDAs these days, demand for my technical skills grew. So I completed the eighty-hour course to become a CFCE—Certified Forensic Computer Examiner—and switched over to the Computer Lab.”

“You like it?”

“I do. Hard drives are like piñatas. Every treasure you ever wanted is stored in there somewhere. You just gotta know how to break it open.”

The food had arrived. Scrambled eggs with a side of grilled pancetta for both of them. The smells were rich and savory. D.D. dug in.

“How do you investigate hardware?” she asked, her mouth full.

Wayne had forked up a pile of eggs; he regarded her thoughtfully, as if trying to gauge the seriousness of her interest. He had deep hazel eyes with specks of green, so she made sure she looked interested.

“Take the rule of five-twelve. That’s the magic number in forensic computer analysis. See, inside a hard drive are round platters that spin around to read and write data. These platters contain chunks of five hundred and twelve bytes of data, and they’re constantly whirling under the seeker head. The seeker head, then, must divide all information into five hundred and twelve byte chunks in order to store the data onto the platters.”

“Okay.” D.D. went to work slicing up her pancetta.

“Now, say you’re saving a file to your hard drive that doesn’t divide neatly into five hundred and twelve byte chunks. It’s not one thousand and twenty-four bytes of data, it’s eight hundred bytes. The computer will fill one whole data chunk, then half of another available chunk. Then what? The computer doesn’t pick up where it left off, mid-data chunk. Instead, a new file will start with a fresh five-twelve byte space, meaning the previous file has excess storage capacity, or what we call ‘slack space,’ in the existing data chunk. Often, old data gets left in that slack space. Say you called up that file, made some changes, then resaved it. The overwrite might not go exactly on top of the old data the way most people assume. Instead it might be tucked somewhere else inside the same data chunk. Then a guy like me can search that five-twelve chunk. In the slack space I might find the old document where you wrote the original letter asking your lover to murder your spouse, as well as the revised doc, where you deleted that particular paragraph. And voila, one guilty conviction is born.”

“I don’t have a spouse,” D.D. volunteered, having another bite of eggs, “though I’m now deeply suspicious of my computer.”