“Because Sandra herself had visited lots of different websites preparing assignments for her class. All of those sites should have shown up in the browser history, but none of them did. That meant someone was clearing the cache file, then purposefully building a false history by clicking on the same three websites when he was done. That was sheer laziness,” Wayne murmured now, probably more to himself than her. “Like all criminals, even the techies sooner or later do something stupid to give themselves away.”

“Wait a minute, back up: Why would someone create a false browser history?”

They’d reached the waterfront, walking along the docks toward the aquarium. It was still drizzling out, making the docks much less crowded than usual. Wayne made his way toward the railing, then turned to face her. “Exactly. Why would someone create a false browser history? That’s the million-dollar question. Ethan had already recommended a downloadable forensic computer tool, but that hadn’t been powerful enough. He suspected that Sandra’s husband was employing something called a shredder, or scrubber software, to cover his tracks. So Ethan gave me a call, bringing in the big guns, so to speak.”

D.D. blinked at him. “Could you help her?”

“I was trying to. This was December, mind you, so only a few months ago, and given that she suspected her husband, we had to proceed carefully. She and Ethan had already run Pasco on her computer, but Pasco can only find what you tell it to find. It’s not nearly as powerful as, say, EnCase, the software we employ in the lab. EnCase can mine deep into a hard drive, inventorying the slack space, analyzing unallocated clusters, all sorts of good stuff. Better yet, given Sandra’s concerns, EnCase has an image carver tool that will dig out any images on the hard drive, spitting out literally hundreds of thousands of photos. Finally, EnCase also has the ability to pull out Internet browser histories—”

“So you ran EnCase on Sandra’s computer?”

“Don’t I wish.” He rolled his hazel eyes. “First off, you never work on the source. Bad forensic protocol. Secondly, Sandra needed to be discreet, and running EnCase on the family desktop for three to four days was bound to be noticed. Searching and seizing a computer is easy. Ripping one apart on the sly, however …”

“So what did you do?”

“I was working with Sandra to make a forensically sound copy of the family hard drive. I gave her instructions on what kind of blank hard drive to purchase, then how to attach it to the family computer and transfer over the data. Unfortunately, Jason had recently purchased a new five-hundred-gigabyte hard drive, and the copying time alone was over six hours. She’d made several attempts at it, but couldn’t get the job done before he returned from work.”

“Sandra Jones has spent the past three months basically plotting against her husband?” D.D. asked.