Death cases of computer technician

Question

Police found the body of a computer technician in front of his computer, with a belly wound. There was a possibility of the victim bleeding to death after being stabbed with a sharp object. There were no signs of damage on the windows or doors, which indicated that the killer was someone close to the victim. The dead body was found holding the keyboard and mouse. The monitor displayed the explorer and command prompt. On the user folder of his computer (Windows 8), police found one image file with the name img.gif. They also found blood on the following keyboard keys:

Enter Shift Space Alt F7 = / . A B C E F G I L M O P R U Y

The bold keys indicates that the key has more blood than others, and here is the image (img.gif):

The questions is, who killed the technician?

• the layout of the keyboard was QWERTY
• the command prompt was open, but without any text; apparently the victim just deleted the history by Alt+F7
• there is a possibility that the victim or someone else deleted some files
• the culprit's name is on the list
• the keys are not in sequence

Transcript of image:

Aisyah P       08085733163110 
Putut H        085648887714 
Nur Komaroh    72346874 
Rossa Riasa    085733265290 
Ullah Prihasti 08563146198 
Sela-ajah      083857251129 / 085857311079 
Fonisah S      083857921353 
Febrina H      085733224890 
Sriong Putri K 71488407 

please, only open the spoiler text if you think this riddle is kinda difficult

clue 1:

by solving what was written by the technician, it will be easier to solve this puzzle, but you need a little knowledge of computers for this, if you do not have it, you could just try to find out what is contained in this picture.

clue 2:

steganography

more spoiler text will come...

Answer 1

I assume that bold keys pressed two times, so we have:

Enter Shift Space Space Alt F7 = / . . A B C C E F G G I I L M O P R R U Y

First, I substract the image name from the key list, IMG.GIF, and ALT F7 (command to clear cmd history), now we have:

Enter Shift Space Space = / . A B C C E L O P R R U Y

because command prompt windows is open, I assume the victim write some cmd command, then by looking at this page http://ss64.com/nt/ as refference, there is 3 possible command written by the victim

ARP : Address Resolution Protocol
CLS : Clear the scree
COPY: Copy one or more files to another location`

the ARP and CLS is unlikely, so my best bet is COPY, now we have:

Enter Shift Space Space = / . A B C E L R R U

Then, because / key is also there, I asssume the victim use COPY command with options, by looking at the COPY command refference, http://ss64.com/nt/copy.html, there is three possible options used by the victim:

/A:  ASCII text file (default)
/B:  Binary file copy - will copy extended characters.
/L:  If source is a symbolic link copy the link to the target instead of the actual file the source link points to.

/A is unlikely, /L is unlikely too I think, my best bet is /B now we have

Enter Shift Space Space = . A C E L R R U

I do not have any clue after this, but by writting the command together, I have:

COPY IMG.GIF + [. A C E L R R U] /B

hey [. A C E L R R U] must be some filename too, maybe its CLUE.RAR

COPY IMG.GIF + CLUE.RAR /B

Now I have complete command, I google for copy /b image the first result take me here http://www.wikihow.com/Store-a-Rar-or-Zip-in-an-Image-File

if you read the page, you will know that this command store archive in image file, this is some kind of steganography.

I download the image, then rename it to CLUE.RAR, then open it, BANG... it's open, the archive contain one file clue.wav I extract it, and open it with music player, there you can hear someone says "the answer is inside this file" with background sound which not clear, this is backmasking technique, if you reverse playback this sound, you will hear "killer is febrina", and that is, the killer is "FEBRINA H"

Answer 2

If I would have to decided on a prime suspect, it would be

Ullah Prihasti

This is currently based on some rather loose clues and not strong facts, though. My reasoning is:

Assumption #1:

More blood should potentially indicated later in typing, but also, that the victim is obviously already closer to death than to life. As a result, there is a higher chance of mistyping those letters. Assuming that he is "slumping to ground", I'd guess the likelihood for the "true" key being one row above the actually hit one is higher, but one shouldn't rule out other close-bye keys. So, chances are that C should be D/F, G should be R/T/Y, I should be 8/9 and R should 4/5.

Assumption #2:

Another fact is the number of keys. Leaving aside space and others, there have been at least 14 characters been typed. Now, assuming that a dying man is not wasting his time on complex riddles, the guess would be that he tries typing a name. This narrows the list of suspects to those with longer names, in particular "Ullah Prihasti" and "Sriong Putri K".

And drawn conclusion:

Both have less than 14 characters in their name, so the telephone numbers possibly count. (Although it's odd that a dying man tries to identify his murdere by his number.) Only the keys "I" and "R" are close to the numbers, and most likely 89 or 45. Of the two mentions above, Sriong's number starts with 714... while Ullah's starts with 085... which is by far the better match. Hence he's my top-suspect.

While I have a strong suspicion, clearly more detective work needs to be done for an arrest! Am I on the right track at least?