Forensic examination of Lula Landry's laptop

The forensic examination of Lula Landry’s laptop turns a seemingly erased file into a traceable piece of her recent life. With help from computer specialist Spanner, Cormoran Strike recovers photographs deleted after Lula’s death and finds signs that she had been researching Professor J. P. Agyeman and African history. The results do not immediately solve the case, but they sharpen two distinct lines of inquiry: Lula’s search into her origins and the handling of her personal files after her death.

Examination and Recovery

Spanner returns to the office on Friday with the Dell computer he had taken away for analysis. Strike asks him to report only the important findings. The first is the laptop’s password: “Agyeman,” reset five days before Lula died. Spanner recognizes it as a Ghanaian surname and explains that the computer’s bookmarks include the homepage of SOAS, the School of Oriental and African Studies. The password is not just a security detail; its timing and subject matter place a potentially significant name in Lula’s private digital life shortly before her death.

The examination of the browsing history gives that name context. Lula had saved a version of the SOAS page featuring the obituary of Professor J. P. Agyeman, an emeritus professor of African politics. In the month before she died, she had also browsed Amazon for his books and looked at a number of books on African history and politics. There is no evidence on the laptop that she applied to SOAS, so the record supports an active interest and investigation, not a claim that she enrolled or took a particular next step. Taken together, the password, saved page, and searches make the computer a record of a sustained inquiry rather than an isolated visit to a website.

Deleted Photographs

Spanner’s other finding is a large photo file deleted on March 17. He explains that ordinary deletion does not necessarily remove data from a hard drive: specialist software can recover files that a user may believe are gone. He has restored the photographs and gives Strike a memory stick, rather than putting them back on Lula’s laptop. Strike rules out the police as the likely source of the deletion, making the fact of removal a question for the investigation without, by itself, identifying who deleted the file or why.

After Spanner leaves, Strike moves into the outer office and takes Robin’s place so that he can open the recovered material. Robin watches with anticipation and briefly fears that the hidden pictures will show evidence of criminality or abuse. Instead, after several minutes, Strike identifies them as social snaps. The discovery therefore produces a meaningful reversal: the photographs had been concealed from view, but their contents are ordinary. Their recovery supplies no sensational evidence against anyone; its value lies in restoring material that had been removed and clarifying what the file did—and did not—contain.

Investigative Significance

The laptop examination works as a check on assumptions as much as a source of leads. A deleted file invites suspicion, but the recovered images do not justify the darkest interpretation Robin initially imagines. Conversely, the computer’s less dramatic traces—the changed password, bookmarked obituary, and book searches—form a coherent pattern of research that is more revealing about Lula’s recent concerns. The distinction between what a digital record can establish and what it cannot is central: the data points toward her search for a possible family connection, but does not establish the outcome of that search.

The recovered photographs also matter because the deletion occurred after Lula’s death and was not the result of an unrecoverable wipe. Strike’s conclusion that the police did not remove them leaves the act open to investigation, while the restored file permits him to distinguish the fact of deletion from the content of the images. The examination thus contributes two different kinds of evidence: positive traces of Lula’s interests and a negative finding that the hidden photographs are merely social snapshots. Its importance lies not in a single dramatic revelation but in making the laptop’s absence, contents, and limits available for scrutiny.