Chapter 5 - The USB gets a warrant
The police did not open the USB the first night.
A detective named Hannah Brooks took over.
She explained that the drive might contain:
Personal family material.
Financial data.
Medical records.
Anything.
The fact it fell from Mara’s teddy bear while Vanessa appeared frightened did not automatically give the state unlimited authority to inspect everything.
They sought consent from me as executor of Mara’s estate? Mara’s estate had closed, and ownership of the teddy had passed to Noah. Yet digital files could implicate privacy interests. My attorney recommended a limited forensic process with investigators focusing first on metadata and directory structure under warrant/consent.
I consented as Noah’s parent to preservation.
Police obtained legal authority tied to the child-endangerment investigation after additional evidence emerged.
The first directory listing showed seven folders.
FAMILY PHOTOS.
NOAH.
HOUSE.
CARE ACCOUNT.
VANESSA.
ESTATE.
RYAN - READ THIS.
My stomach dropped when Hannah told me.
“Can I see it?”
“Not yet.”
“Why?”
“Because we’re imaging the drive first.”
“How long?”
“Ryan.”
I knew.
Processes.
I hated processes.
She continued:
“We need to know the original data stays intact.”
“Was it modified recently?”
“Preliminary metadata suggests most files are around two years old, but we’re not making conclusions until forensics finishes.”
That was important.
The USB had apparently been inside the bear since around Mara’s death.
Vanessa had not created it.
Mara had.
Then Hannah asked:
“Did Mara ever tell you she used offline backups?”
“Yes.”
That surprised me as I said it.
Mara hated cloud-only storage.
She kept tax records on encrypted external drives.
Our wedding photos existed in four places because she thought people who trust one backup:
“deserve the emotional lesson they’re eventually going to receive.”
“Did she hide drives in toys?”
“No.”
At least not that I knew.
“Could the USB have been placed there by someone else?”
“Yes.”
Anything was possible.
Forensics needed to connect contents to Mara.
The folder names alone were not enough.
I wanted certainty.
May you like
Hannah offered procedure.
Again.
