# Death cases of computer technician

Police found the body of a computer technician in front of his computer, with a belly wound. There was a possibility of the victim bleeding to death after being stabbed with a sharp object. There were no signs of damage on the windows or doors, which indicated that the killer was someone close to the victim. The dead body was found holding the keyboard and mouse. The monitor displayed the explorer and command prompt. On the user folder of his computer (Windows 8), police found one image file with the name img.gif. They also found blood on the following keyboard keys:

Enter Shift Space Alt F7 = / . A B C E F G I L M O P R U Y

The bold keys indicates that the key has more blood than others, and here is the image (img.gif):

The questions is, who killed the technician?

• the layout of the keyboard was QWERTY
• the command prompt was open, but without any text; apparently the victim just deleted the history by Alt+F7
• there is a possibility that the victim or someone else deleted some files
• the culprit's name is on the list
• the keys are not in sequence

Transcript of image:

Aisyah P       08085733163110
Putut H        085648887714
Nur Komaroh    72346874
Rossa Riasa    085733265290
Ullah Prihasti 08563146198
Sela-ajah      083857251129 / 085857311079
Fonisah S      083857921353
Febrina H      085733224890
Sriong Putri K 71488407


please, only open the spoiler text if you think this riddle is kinda difficult

clue 1:

by solving what was written by the technician, it will be easier to solve this puzzle, but you need a little knowledge of computers for this, if you do not have it, you could just try to find out what is contained in this picture.

clue 2:

steganography

more spoiler text will come...

• The technician should've been fired for saving a photo in gif format anyway. Maybe that's the reason he's dead. – Sergey Telshevsky Nov 21 '14 at 10:05
• The setup of him holding the mouse and keyboard is highly unlikely... – warspyking Nov 21 '14 at 10:40
• Do not take this too seriously, this is not real case, it just depicting that he use mouse and keyboard to make the his death message. – nyongrand Nov 21 '14 at 10:47
• @nyongrand I have edited your question and fixed the grammar mistakes. I hope I didnt remove or misrepresent something. If I have please feel free to change it back – stackErr Nov 21 '14 at 14:13
• @nyongrand can you provide a transcript of the image? Its hard to read some of the characters in the image. – stackErr Nov 21 '14 at 19:40

I assume that bold keys pressed two times, so we have:

Enter Shift Space Space Alt F7 = / . . A B C C E F G G I I L M O P R R U Y


First, I substract the image name from the key list, IMG.GIF, and ALT F7 (command to clear cmd history), now we have:

Enter Shift Space Space = / . A B C C E L O P R R U Y


because command prompt windows is open, I assume the victim write some cmd command, then by looking at this page http://ss64.com/nt/ as refference, there is 3 possible command written by the victim

ARP : Address Resolution Protocol
CLS : Clear the scree
COPY: Copy one or more files to another location


the ARP and CLS is unlikely, so my best bet is COPY, now we have:

Enter Shift Space Space = / . A B C E L R R U


Then, because / key is also there, I asssume the victim use COPY command with options, by looking at the COPY command refference, http://ss64.com/nt/copy.html, there is three possible options used by the victim:

/A:  ASCII text file (default)
/B:  Binary file copy - will copy extended characters.
/L:  If source is a symbolic link copy the link to the target instead of the actual file the source link points to.


/A is unlikely, /L is unlikely too I think, my best bet is /B now we have

Enter Shift Space Space = . A C E L R R U


I do not have any clue after this, but by writting the command together, I have:

COPY IMG.GIF + [. A C E L R R U] /B


hey [. A C E L R R U] must be some filename too, maybe its CLUE.RAR

COPY IMG.GIF + CLUE.RAR /B


Now I have complete command, I google for copy /b image the first result take me here http://www.wikihow.com/Store-a-Rar-or-Zip-in-an-Image-File

if you read the page, you will know that this command store archive in image file, this is some kind of steganography.

I download the image, then rename it to CLUE.RAR, then open it, BANG... it's open, the archive contain one file clue.wav` I extract it, and open it with music player, there you can hear someone says "the answer is inside this file" with background sound which not clear, this is backmasking technique, if you reverse playback this sound, you will hear "killer is febrina", and that is, the killer is "FEBRINA H"

• Nice analysis, congratulations you managed to solve this puzzle. – nyongrand Nov 29 '14 at 0:18
• Brilliant answer. – Farhan Hafeez Feb 5 '16 at 9:49

If I would have to decided on a prime suspect, it would be

Ullah Prihasti

This is currently based on some rather loose clues and not strong facts, though. My reasoning is:

Assumption #1:

More blood should potentially indicated later in typing, but also, that the victim is obviously already closer to death than to life. As a result, there is a higher chance of mistyping those letters. Assuming that he is "slumping to ground", I'd guess the likelihood for the "true" key being one row above the actually hit one is higher, but one shouldn't rule out other close-bye keys. So, chances are that C should be D/F, G should be R/T/Y, I should be 8/9 and R should 4/5.

Assumption #2:

Another fact is the number of keys. Leaving aside space and others, there have been at least 14 characters been typed. Now, assuming that a dying man is not wasting his time on complex riddles, the guess would be that he tries typing a name. This narrows the list of suspects to those with longer names, in particular "Ullah Prihasti" and "Sriong Putri K".

And drawn conclusion:

Both have less than 14 characters in their name, so the telephone numbers possibly count. (Although it's odd that a dying man tries to identify his murdere by his number.) Only the keys "I" and "R" are close to the numbers, and most likely 89 or 45. Of the two mentions above, Sriong's number starts with 714... while Ullah's starts with 085... which is by far the better match. Hence he's my top-suspect.

While I have a strong suspicion, clearly more detective work needs to be done for an arrest! Am I on the right track at least?

• You forget some details, The victim is computer technician, the victim know computer more than most people, also why command prompt is opened, not notepad maybe, by the way, if you solve this riddle, you will get the exact name of the culprit. – nyongrand Nov 25 '14 at 8:32
• Can be assumed that a dying man is not at full capacity of his geekyness and wit and that his intention would be to most easily point a finger? If so - and if he hasn't - can be assumed that there has to be a REASON why he made things hard for the police? (Do we have to find/know it?) – BmyGuest Nov 25 '14 at 8:38
• Maybe he does not want someone else, including the culprit, know this riddle easily and then destroy the message, as the culprit is close to the victim, anyway the image it self is not created after the incident, but long before the incident, but the riddle is created after the incident, so we can assume that the victim use already created image. – nyongrand Nov 25 '14 at 10:44
• "by the way, if you solve this riddle, you will get the exact name of the culprit" - you should add this to the bullet points of your original post as an edit. Maybe also the information on the image-file (file-created time stamp?). – BmyGuest Nov 25 '14 at 10:52
• Do I need to be an IT expert as well to be able to solve this? I.e. Do I need to know some special IT tricks which I simply might not? – BmyGuest Nov 25 '14 at 22:13