📸 Photo

KINGPIN

Full-disk encryption keeps the entire hard drive encrypted at all times: all the files, the file names, the operating system, the software, the directory structure—any clue to what the user has been doing. Without the decryption key, the disk might as well have been a Frisbee.

The key to cracking a full-disk encryption program is to get at it while it's still running on the computer. At that point, the disk is still fully encrypted, but the decryption key is stored in RAM, to allow the software to decrypt and encrypt the data from the hard drive on the fly.

The knock on Max's door had been intended to draw Max away from his machines; if he'd shut them down before the Secret Service got the cuffs on, there wouldn't have been much CERT could do—the contents of the RAM would have evaporated. But Max had been caught napping, and his servers were still running.

CERT had spent the last two weeks gaming out different scenarios for what they might encounter in Max's safe house. Now the team leader looked over the setup: Max's server was wired to half a dozen hard drives. Two had lost power when an agent tripped over an electrical cable snaking across the floor, but the server itself was still running, and that was what mattered.

While Secret Service flashbulbs bounced off the walls of Max's cluttered apartment, the forensics experts moved to the machines and began their work, using memory-acquisition software they'd brought with them to suck down the live data from the RAM onto an external storage device.

Down the hall, Max cooled his heels in the feds' apartment.

Two agents watched over him. Max would be questioned later—for now, the agents were just babysitting, chatting with one another. The Secret Service agent was from the local San Francisco field office; he asked his FBI counterpart where he worked.

“I'm from Pittsburgh,” Keith Mularski answered.

Max's head snapped to look at Master Splyntr. There was no doubt who had won the carder war.