So welcome everyone to our talk about implementing UAV based secure boot and over the air update for embedded arm devices So First of all, who are we? So my name is Jan Kiska. This is Christian storm. Let's start with the common part. We are both working for semen's technology We are embedded Linux consultant and developers targeting in-house means Not wherever but in quite a few cases where semen's is using a better Linux We are involved at various levels and trying to get things the right way done or a better way done We are also involved in the civil infrastructure platform project So Christian is a part of the CIP work group on software update I'm leading the the kernel work group and I'm also maintaining the either CIP core layer. What that is We talk a little bit about later We are both contributing to open source. Whatever. This is possible during our work I'm also maintaining. I'm doing some other stuff maintenance from time to time. So, yeah, it's all about open source here Regarding the topic of our talk. Well, if you've joined virtually at least The talk of us two years ago. There was something about secure boot and over the air update or something like this as well So again the same story Yeah, that was basically showing the concept and next 86 implementation Today we want to look further on that So where are we coming from? Well, the old story the old days were the wrong firm there Nowadays we do that More flexible. We've come a long way because well connectivity is everywhere security is standard Secure updates are well no longer discussable even mandated in some of our domains by standards and you obviously want to do these updates not by sitting besides of this and picking up the pieces after it went wrong, but you won't do it unattendedly and That also means you have to do it in a robust way When something really goes wrong and you're testing failed for whatever reason you want to roll back and you get all your Devices into a consistent state in the field so having all of that Integrated and also presented in form of a reference implementation via our CIP core layer that has been done in the past years And obviously also a couple of product projects before for x86 based on UAV and now as I said today It's about looking beyond that. What do we have to do on the arm side to come to something similar? So a recap where are we on x86? Well x86 it for practical reason means today you are booting from UAV firmware wherever that comes from You are booting into a bootloader, which is UAV based and if you want to do it securely obviously The firmware is validating your train of trust that the artifacts you are booting where UAV have been signed properly For the purpose of our embedded systems doing a B update We are running primarily with a bootloader which does the AB switching control You could rely on UAV for that But well, if you are more skeptical or if you're dealing with a lot of various implementation of UAV We better go with the known bootloader That also has the task of enabling a watchdog Which is essential if you want to do a rollback when some of pieces of your boot chain Got south and are no longer reacting that watchdog has to be started. That's not the service of UAV So that comes with our if you bootguard firmware for x86 Continuing the secure bootchain there What you normally do is booting assigned kernel image Well, if you only boot the kernel image that way you have a problem as we've learned before in other talks and with the Edit ID for example, you may also have a problem with the kernel command line Therefore the common practice is to use a unified kernel image to combining the kernel and the command line and possibly the unit ID Into one binary in one UAV binary sign that and then boot up from there And then you hand over to the operating system domain Where you want to obviously also validate That your file system you're booting from the root file system is as you shipped it So the read only part of it You may verify and as we learned this is a good choice with the invariate and And the persistent part that you want or have to change in the field You may have to encrypt and that's usually done with the encrypt So then you have all the pieces together. Well for the encrypt you also need a platform key and on x86 This is normally done with some form of TPM may it be physical or Implement with a firmware so to get some Platinum specific secret and decrypt this and well, then you basically have all the pieces for a common secure boot System together which can be also updated AB wise in the field So that's a situation x86. We've done it a couple of times. It works quite nicely No rocket science obviously a lot of pulling of pieces together now How can we benefit from this pattern also on on arm side? So if you look at arm Today, and I know there are other bootloaders as well, but the common piece you often get on the better side is Yeah, some you would enable meant Which can do quite a lot of things and basically can allow you to do the same thing just with different pattern here And with a lot of more custom engineering needed to get things done Well every sock vendor has a different way of validating the artifacts you are booting early to the firmware here You also have a different way of validating the OS images afterwards or the kernel image better Typically done with the fit image sign fit image here You can use your boot for quite a few things as one example you can also do there the AB switching There's a scripting inside it's possible that to do it that way. I think there's a talk these days also about this approach You can use you would obviously also as a driver for watchdogs And and start up your watchdog there, which is a good thing to do But yeah, they love customized engineer needed and furthermore you also needed for The getting out the spectrum secrets so managing the secrets to get in the end your description done So there's a situation today and while we could do it we were thinking about it But in the end the ideal case would to be reusing much more from the previously shown actually six side So and if you look at it how arm is evolving today, we are rather looking into also having you if you there as well You just think of system ready specification there So it's upcoming and with this inside but also with the motivation to unify Not just for secure but rather just for booting and the right side more Alex Raff quite a couple of years ago started the idea of having Mubut as an you if you provider and that was one of the kickoffs for also developing in that direction That we have more unified infrastructure there available still from that point to where we are today That has been a long way, but if we have it that way, what could be done now? So the pattern we see here basically if we have an abated you if you provider is that Everything after that provider basically can be the same as we have done before with x86 And we will look into further details on the right side later on what you also see if you look into the the infrastructure for Trusted platform or you will you have also some sanitization approaches there So with opti being around for more and more of the modern platforms and even some of the 30-bit platforms That's now an option to host the platform secrets and managed basically the platform specific Trusted storage there as well. So there's also option to optimize and to unify that on that area as well so The key element here is as I said then looking into who can provide you you a fee and for your embedded device So they're basically for an x86 two key providers right now on the market as far as we see on the open-source market Well, the standard one you do may come into minus a oil my gosh, and it a k2 You is it's you if a reference implementation and very commonly used or at least a common base on x86 firmware So even if you get a commercial one in the end, there's often indicate two bits included And it has half support for arm and arm 64 as well However It doesn't commonly is doesn't commonly supported by your sock vendor There are some exceptions for that But in the end you end up with something which is not yet directly fitting on your board in contrast to what you get We are the BSP for your board and there's also very limited driver support and upstream at least to what we've analyzed so far So also regarding how do I enable my watchdog now? Even if it's a simple task the infrastructure isn't there So this is something if you want to put it into you if you provide up. There's nothing like that On the other side as I said you would By now is well, it's the defect to standard for firmware if you look for your common Silicon vendors they will probably provide you some enablement for that or someone else with it in a nice way It's so it's vendor backed It's has plenty of drivers for all bits is that you may need also to bring up co-processor stuff like that Which may also in some scenarios be interesting for the features indeed for secure boot here That is all there What is maybe not that recognized? By anyone or by some people is that there is also fairly advanced UAV support by now The only issue is it's as I said not to take a nice. It's likely not broadly used yet So what do you do if you want to do or when you use you boot for you a fee and for secure booting secure a fee So one of the first well anecdote to say basically we were shipping an embedded board Which was booting from you were from you boot and was doing the classic distro boot so fit image booting And we're using default config of the vendor for that and after a while when we looked into our what's possible with your a fee I said oh, it's default on Let's just flip in our image the boot loading process with grab grab you ify and it just booted So we were accidentally basically shipping already UAV enabled system in the field Without knowing it's an open platform. It's nothing that you close down and configure to the minimum. So it was working as supposed and Yeah, at least non-secure booting was already working Now if you look at what is needed for booting securely, well, you need to continue your chain of trust Again, remember the the early stage the piece basically from the ROM loader to your u-boot Or whatever comes before you would on the middle of u-boot that is usually Remaining when a specific but this is what you get usually pre-integrated by your vendor and you can just build upon Now when you're talking further what u-boot wants to load or should load be at the UAV mechanism And should validate and you need some train of trust for that So you the easiest way to do that is to pre-compile the public keys into The u-boot binary so you have a static train of trust you could do the same with fit images Obviously, and this is now done with UAV. That's one way the other way It's also interesting but still under development and has dependency is doing this We are the ify variables and having the ify variables in the secure storage Then you can actually also update the keys in the field Without completely replacing your your firmware binary So that's it's one of the first step you have to do go one way or the other so Then look into hardening. Well, this is a general recommendation It doesn't only apply to your ify-based secure boot and many of the patterns are generic But anyway look into that. I didn't find anything like this described in that form so far There were some indications what to do in general But this actually is something that we compiled over the past years for actually practical doing it So one of the obvious thing is you have to make your boot chain Yeah, no longer interactive Lockdown any kind of interaction with the bootloader Because this usually opens up the door for doing something else than non-secure than security booting You have to or you should Limit your boot to the UEFI part. I mean if you're just keeping on the legacy boot That usually means that you don't boot securely anymore unless you've done special metal on that path as well But well, if you decide to go one way lock out the others so limit your boot procedure to UEFI Another general security recommendation or turn off feature you don't need That specifically is interesting regarding file system. So if the user can Yeah, or the attacker can replace some of the storage, which is one of the physical attack vectors and And place some nice file system on it and you would has an implementation But it's probably not that commonly used and may have some bugs. Yeah, you just opened up the door Obviously also network is something if you want to turn off you don't use network booting on that stage Another important things to remember Well either do a read-only environment because the environment keeps All the variables that could also be used for booting and booting in a different way So either make it read-only or if you have some variables that should be readable should be writable still for whatever reason There are mechanisms now in you boot Not that hand lead to describe but there are some reference that can point to you and to make only those variables Revital and nothing else. So there's been some work we done in the past years and to enable that scenario and Yeah, as I said, this is just a brief list on that if you want to look into some examples We compiled the generic ones But not completely secure ones in the ease us yet the core layer and there's also practical examples for a TI based Processor, this is from these id2050 device of us So I have a look there if you're interested in some examples So next step obviously is then to sign and lock the firmware artifacts. That is again the venus specific mechanism Don't forget to start the watchdog as I said That is in the end then taking over by Linux once it's running So that starting point should be in you boot and not later. Otherwise, you may have some black hole there Yeah, and another very important indication on that obviously test on trust the whole thing. I'm as I said This is still Fresh I'm not saying it's instable, but it can happen and it happened unfortunately There was some bug that we found during the testing recently. It's fixed by now So if you take the latest you would version you have it fixed but it's always good to at least these Basic mechanisms also checked by your system test intensively regarding if there are security holes remaining on that level so next step After you would basically there is the UAV payload starting and the UAV payload for us is our AB switching bootloader if you would got which is Quite easily or was quite easily enable both for for arm and arm 64 bills, but that's available checkpoint However, what is now the challenging part is or what turned to be a bit more challenging part was the unified kernel image So so far in x86 we used the pattern that system D was introducing a little kernel a little loader stop which Then forms together with the kernel and within it ID and a command line string and on arm also a device tree Blob that unified kernel image and that whole thing is being pulled together with object copy It's a PE binary So it's a windows binary an elf binary and an UAV binary in the end and the object copy tools You currently get from common toolchain releases you get via your distributions. They are not ready for that So you can work around obviously by taking the latest bootchain or latest toolchain if you're on yachto What an issue if you're on distribution based a build system that can be an issue There's hope as I said it's fixed But current situation was a little bit of problematic first from a from a handling perspective What turned out to be more problematic to our scenarios was this single device tree story So ideally the device tree comes in this system ready model from the firmware and it's perfectly fine describing all bits You want to have on your device Practically well, there is a life cycle of that piece of the firmware piece of the kernel From when you're having your device a longer time in the field you may start with a PSP kernel You may later on end up with a mainline kernel ideally. You may start with unofficial device tree binding You may up in the end starting or using official binding So there is a certain thing that you have to plan for at least we want to do a long-term update ability of your system in other words this kind of bundling option of the kernel and the device tree which is unfashionable But it's unavoidable practically still for a foreseeable future Now if you have one device tree for one device no problem checkpoint you can use this pattern However, if you have an image which supposed to have only minor variant of devices covered with one image You certainly have a problem. There's only one device tree and you want to address them all So we need support for multiple of those device trees some kind of matching mechanism That's what we did. Well, we first of all solved for us the unified kernel image generator problem by doing a Python based approach pulling this Python these sections together for the PE binary and then we simply implemented a mechanism to choose from the option of a list of device trees which were embedded in this embedded the unified kernel image Choose the one which matches what the firmware was providing before Pretty simple thing. Eventually we will also continue to system reboot That's basically the needed step for that the precondition for that to have this kind of device tree replacement is that the boot the firmware allows you to Forward transport certain dynamic information that the firmware plans into the device tree via a fix up protocol So there's a fix up you if your protocol being defined and implemented in you would You would is working just fine system reboot supports it if you boot got supports it I think that was but currently the situation Edk2 unfortunately does not support it yet It's ongoing work to get this into the EVPR specification So it's an open issue on that topic. So eventually maybe become standard and we become also available for other firmware providers So with that we basically leave the way if you domain and I would also hand over at the stage So now what do we have actually we do have cross architecture commodity in the if you domain Which means you do deploy the very same components across architectures Maybe with a bit of minor configuration for example enabling wash dogs or not Next is the US domain here on the right side and I want to focus on three things here First is how does a unified kernel image first find and then mount its root of s the second is how to integrate integrity protection to this process and The third one is obviously as the title of the dog says firmware update so starting with the firmware update on In modern times updateability is probably the most important product feature and commonly what we see is in a B scheme which means you do have two copies of your root file system and one is actually selected for being the current boot path So this is the currently running system while running your update the spare copy And when you're done You're just test booting into this if this has worked and the images booted up perfectly fine Then this becomes a default image and the this select switches over if not you get a rollback and again You have him we are one which was the initial one and can continue or report the failure or whatever to your bank and in terms of an OTA update This of course needs support from the boot loader as Jan just said which is Available for if you boot guard as well as for wood and for all the woodlands as well But it's a very deep integration in terms of arming the hardware watchdog Which you need for having the rollback in case you for example Deployed an x86 terminal and arm system won't boot. So we rely on the watchdog You need the AP switching and most probably other features as well This whole stuff in terms of using SW update here For example is the flow how it works is pre-integrated into sip core so you can just Clone it don't play with it. It's a free integration as said and What you can also do with this mechanism is once you have it available Means you have a general way of deploying artifacts whatever this means to a device So it must not always only be firmware in terms of for root for systems You can also use this mechanism to update packages or contain images or what else as you have one channel down to your So now having done an update on how does this unified call image find its actual root for system The assumption here is that a kernel and its root for system is one package that belongs together So meaning you have deployed a kernel and it belongs to exactly one of the two A or B root for systems Of course, there is a colonel option. You can simply specify root is death petition whatever But this doesn't unfortunately work in the AB update case Because you cannot know without asking the device in the field what its current boot part is So it has to be AB agnostic and in case of secure boot You're also at the problem that you don't want to feed untrusted information into the boot chain Which means you cannot rely on some configuration lying around somewhere So essentially there are a few options left. You can use the file system So in the inner problem of s while booting you scan the disk and search for the file system UID that matches your kernel because it's engraved and body it in the unit ID and then boot it Fine may work, but not all files system support this and so it's out of the game for a general solution Next one is you can use partition UIDs Works the same way, but it's awesome Always available and you have the the problem that you have to write the partition table on each update Which you should avoid which is not that good So in the end we came to the idea that we added custom tech image UID to the root file systems it is us release and then in the iterate over all file systems mount them look into the it is us release Look if it matches the image UID engraved in the unified colonel image If yes, we have found a root file system and we can continue booting so as the UID is engraved also in the unified colonel image means it's signed So both find a match and the UID is protected by secure boot in the unified colonel Now you have booted a root file system and this through first system is not protected against modification So it happens to satisfy our mechanism of finding the UID and it is US release But you are free to tinker with it and as long as you keep this mechanism in tech you can boot anything so what you want to have here is some kind of root file system integrity protection and for this you need Authenticity enforcement and most probably a read only root file system as we have heard from Jan you can integrate the emeriti here, which is kind of a layering approach you can use development before layering block devices and the emeriti gives you the Integrity protection in terms of mercury means if you modify the lower bits here The changes trickle up to the root hash and then you get a different root hash So what you do is you prepare your file system you calculate the root hash and then this root hash you actually Embody into the end ID which then gets put into the unified colonel image and while booting you again scan the disks and you scan the metadata of the file system of the demeriti block device and find a match between the Root hash embodied in the unified colonel image and the root hash in demeriti's metadata Well, congratulations. You found it and the bonus is that you don't have to Actually try to mount each file system you find along the way because you can read it out from the metadata So as you've seen there are many things here involved that you have to align proper In order to make this work. So in essence, it's not that big of a rocket science, but you have to bring those pieces in a line and Doing this upstream is kind of a codified description of the big shared picture It's shared knowledge you bring upstream so to not make this tribal knowledge bring it out to the open and as it happens to touch many of the Core concepts or working groups of the civil infrastructure platform It's a natural fit to bring this stuff up upstream first to the zip project Which we have done and you can find it in the ISA subcore layer. This is an implementation more or less Done with the help of the ISA meetable system, but the idea scripts contacts Configurations, whatever can just be copied over to any other meetable system doctor, whatever As had multiple times. So we do have a reference integration, which is is a subcore that you can find here There are pre integrations of those concepts presented along the line It's not fully integrated because for example Secure boot is on the technical side the realization on the box on the process side You have to do key management, whatever those things are obviously not to be found there But the box side the technical side of there you can just take it and hook it up into your Companies process and be done with it There's a demo available on chemo obviously for all architectures and one physical target and on top Of this in terms of eat your own dog food We prepared a layer meet IoT 2050 for the Zimatic IoT 2050 boxes and this is essentially the device specific difference between The ISA subcore and this one to get this box up and running. So there you can see What it takes to bring a new box or what the difference is how much work it would be to base on ISA subcore for a Final product. So in some This whole stuff combining secure boot and firmware update over the Arizona rocket science, but it's maybe too much for casual Friday If you don't want to ruin your weekend, so Take your time to implement it Most of the puzzle pieces are open source. So they are available. You just have to find them Qualify them and bring them in line And this is what we have done in terms of the civil infrastructure platform To give you blueprints Documentations or even free integrations. So documentation in terms of code which you can use and just run and The more important part here is the testing the long term maintenance So it's not just a one-shot that it's out there to be copied or to take inspiration from But instead it's meant to be a long-term thing that's tested and measured there So with this join us at the mailing list and let's make this stuff even more commodity than it is nowadays Thanks. Now we have time for questions. I guess Yep This one here So what we did here is we embedded this custom tech into the TCS res right and this UID is generated so it's some random UID and Why booting you iterate over all file systems mount them look into this when you have found it you have found your matching rule for a system of your kernel as you are now and This is essentially a shortcut of this mechanism So the root hash is actually kind of a UID and with this You don't need to mount a deambarity block device or prepare it open it and mount the file system It is US Reese instead. You can take the root hash as This UID and do the shortcut You can also use this mechanism with Deambarity, but then you have to open the block device or the root has just need to match When they don't you can open it so you go to the next one. This is also possible So it's kind of a shortcut an optimization. You can call it premature optimization It doesn't take long Yeah, the boot loader is just an if he binary Sitting on the ESP and of course you can update it So using SW update replacing it with the file a new boot loader and you if you boot guard But that's a sensible operation to do obviously if you crash the boot loader well, then No, there's no AB in the boot loader in this case not in the general concept here You need to have one core boot loader, which you don't touch On top of this you can chain boot for example if you boot girls to if you want to have to but Updating this call this single point is Then still the problem. So you don't solve it by putting two there You always have one single point of failure except for the case that you have Support in the AFI bios wherever to have two different ESP's or something, but this is not the general case So yeah, there are solutions, but not the general one not the one you buy from the typical end Yeah, this one here. So if you write to a petition a new update package, which is a petition image you may write a new you ID to this and In order to recognize this for example in the GPT you may modify the GPT depends on the implementation This is bad and except for apart from this. It's not always available if you don't feel GPT Formatted block device, then it's out of the game anyway Yeah, but if you ruin your partition table, then you again have a problem Right, you have to if it works. It's good. If not it crashes better. Don't touch it And with this mechanism here, you don't have to touch it Again So what we didn't tell is that if you boot guard also has two partitions where it holds this configuration and The the idea is that you don't touch under all circumstances You're currently known to work a boot path. So you always write to these pair other partition, right? And following this idea, you don't want to write GPT or something. So you simply don't want to touch single point of failure That's the idea Yeah, could be So we also Thought about having the configuration if he variables like system debut does We opted for not doing this because we do not know how reliable the backing storage for the variables are So we said, okay But I do it on disc if the disc has failed then it's broken anyway Don't rely on other things. You cannot influence. So it's kind of Doing it really hard The update will you just change the device? Yeah, if you do have the same root hashes in both images then both images are available So you can use both that's um, I said it here that a kernel plus a little systems one update package That depends on the wiring of your update procedure this works so for example, if you have kernel a and root file system a you have kernel b and root file system b and You now update kernel b and this one probes the discs and finds this root file system Although it should use this one Then you have x them This can be a problem too. That depends on how you wire up the update system But in terms of integrity protection, it doesn't matter because both root hashes are equal So both partitions are legible for being used Then you are leaving again the UEFI domain then you're back in the classic wood chain of your wood Yes, you can do that and it has this mechanism and it has these options But that's not the goal as I said we want to be on the on the UEFI side just the same and that's what we are achieving now Maybe even think beyond that arm you can think of risk five and things like this So it that's basically idea behind it having that standardized I mean it comes with a cost obviously you don't do this Submitted second boot time optimization this path it has to hurt complexity in it But that's also in our domain. It's not the primary driver We are more interested in having that path more commodity and more robust and more Unified than having it more optimized. So different problems to solve different sweet spot where you optimize And this is the basic it is a generalization optimization Essentially this mechanism works for example rock as well. You just have to implement it We have to choose SW update to implement it as the blueprint in SIP, but you can use anything else for that purpose So this is Quite agnostic. So you have this one here and The communication to the boot loader. So arming the watchdog a B switching this stuff So the update agent communicating with the boot loader. This has to be done This is perfectly fine integrated test W update if you have this in other or even proprietary update agents That's works as well. So there is nothing that binds you to SW update If you want to have the pre-integrated route in terms of the SIP core, then you get a SW update But you can of course swap it Then you have to re-implement the features But it's nothing that Locks you into this. So since the scheme doesn't use fit image So how do you support the use case of incorporating multiple device trees? The multiple device trees come into the unified kernel image This is kind of the new bits on that piece So the unified kernel image has a header stuff, which is a UAV binary Which loads finds out what artifacts are in this binary blob the kernel in it Rd and then a number of device trees and that it matches from that number of device trees The fitting one and boots that up the classic way So this is out of outside of the UAV domain already But as the whole thing the unified kernel which is the UAV binary we benefit from the firmware Validating that whole binary as being integral or not That's the story behind it So I think we have short question the last one as well Yeah, so the suggestion is to put everything into the kernel there are mechanisms for that Maybe we can evolve from that. I'm not sure how that then the kernel command is addressed So I'm not saying that this is the only way to go forward But it's one way that we're practicing the shoes right now And I'm happy to remove pieces from our chain obviously in the future also regarding the firmware So if our bootloader eventually becomes over superseded fine drop it do it simpler Can as well be implemented in the UAV firmware as well if it has support for it meaning extending the specification The watchdog enablement is currently done with the hardware watchdog We if he does have this software watchdog, which is essentially a timer If you would bring this to the specification Every system would have it and we are happy to ditch if he would got on this one You can now do the same very same thing in terms of writing DX ease so We if he drivers that do the job, but those tend to be specific to the way if he implementation you get for report so You better off load this to some some special thing Which we can't do with if you boot God, but eventually we love to get rid of this It's just for the transition But for this you obviously have the need and do need this Not yet. Yep, internally, but it's not yet published. So the dmcrypt part will come definitely But current not yet The problem is not so much on the technical side the problems on the process side As I said, how do you hook up your whole signature management key management? Whatever into this process So doing it on the technical side is Solved but having the integration and doing this as a blueprint or pre integration is the hard part So it's not a question of is it possible? But instead, how do you? Prepare it for being upstreamed in a way that's reusable for others In terms of not imposing our solutions to the old world, so to say Okay Think we are out of time. So thank you for your attention. We are around still


Chapter 5. Trottles Report. The curious events related in these pages would, many of them, most likely never have happened if a person named Trottle had not presumed, contrary to his usual custom, to think for himself. The subject on which the person in question had ventured, for the first time in his life, to form an opinion purely and entirely his own, was one which had already excited the interest of his respected mistress in a very extraordinary degree, or to put it in plainer terms still, the subject was no other than the mystery of the empty house. Feeling no sort of objection to set a success of his own, if possible, side by side with a failure of Mr. Jarbers, Trottle made up his mind one Monday evening to try what he could do on his own account towards clearing up the mystery of the empty house. Carefully dismissing from his mind all nonsensical notions of former tenants and their histories, and keeping the one point in view steadily before him, he started to reach it in the shortest way by walking straight up to the house, and bringing himself face to face with the first person in it who opened the door to him. It was getting towards dark on Monday evening, the thirteenth of the month, when Trottle first set foot on the steps of the house. When he knocked at the door, he knew nothing of the matter which he was about to investigate, except that the landlord was an elderly widower of good fortune and that his name was Fawley, a small beginning enough for a man to start from, certainly. On dropping the knocker, his first proceeding was to look down cautiously, out of the corner of his right eye, for any results which might show themselves at the kitchen window. There appeared at it immediately the figure of a woman, who looked up inquisitively at the stranger on the steps, left the window in a hurry, and came back to it with an open letter in her hand, which she held up to the fading light. After looking over the letter hastily for a moment or so, the woman disappeared once more. Trottle next heard footsteps shuffling and scraping along the bare hall of the house. On a sudden they ceased, and the sound of two voices, a shrill persuading voice and a gruff resisting voice, confusedly reached his ears. After a while the voices left off speaking.  "'Wish you good evening, sir,' says the woman, in such a sudden way, and in such a cracked voice, that it was quite startling to hear her. "'Chilly weather, ain't it, sir? Pleased to walk in. You come from good Mr. Fawley, don't you, sir?' "'Don't you, sir?' chimes in the man hoarsely, making a sort of gruff echo of himself, and chuckling after it, as if he thought he had made a joke. If Trottle had said no, the door would have been probably closed in his face. Therefore he took circumstances as he found them, and boldly ran all the risk, whatever it might be, of saying, "'Yes.'" "'Quite right, sir,' says the woman, "'Good Mr. Fawley's letter told us his particular friend would be here to represent him at dusk on Monday the 13th, or if not on Monday the 13th, then on Monday the 20th, at the same time, without fail. And here you are on Monday the 13th. Thank you, sir. Mr. Fawley's particular friend, and dressed all in black, quite right, sir. Pleased to step into the dining-room. It always kept scoured and clean against Mr. Fawley comes here, and I'll fetch a candle in half a minute. It gets so dark in the evenings now you hardly know where you are, do you, sir? And how is good Mr. Fawley in his health? We trust he is better, Benjamin, don't we? We are so sorry not to see him as usual, Benjamin, ain't we?' In half a minute, sir, if you don't mind waiting, I'll be back with a candle. Come along, Benjamin." "'Come along, Benjamin,' chimes in the echo, and chuckles again, as if he thought he had made another joke." Left alone in the empty front parlor, Trottell wondered what was coming next, as he heard the shuffling, scraping footsteps go slowly down the kitchen stairs. The front door had been carefully chained up and bolted behind him on his entrance, and there was not the least chance of his being able to open it to effect his escape without betraying himself by making a noise. Not being of the jarber sought luckily for himself, he took his situation quietly as he found it, and turned his time while alone to account, by summing up in his own mind, the few particulars which he had discovered thus far. He had found out first that Mr. Fawley was in the habit of visiting the house regularly. Second, that Mr. Fawley being prevented by illness from seeing the people put in charge as usual, had appointed a friend to represent him, and had written to say so. Third, that the friend had a choice of two Mondays at a particular time in the evening for doing his errand, and that Trottell had accidentally hit on this time and on the first of the Mondays for beginning his own investigations. Fourth, that the similarity between Trottell's black dress as servant out of livery and the dress of the messenger, whoever he might be, had helped the error by which Trottell was profiting, so far so good. But what was the messenger's errand, and what chance was there that he might not come up and knock at the door himself, from minute to minute on that very evening? While Trottell was turning over this last consideration in his mind, he heard the shuffling footsteps coming up the stairs again, with a flash of candle-light going before them. He waited for the woman's coming in with some little anxiety, for the twilight had been too dim on his getting into the house to allow him to see either her face or the man's face at all clearly. The woman came in first, with the man she called Benjamin at her heels, and set the candle on the mantelpiece.   The sort of old woman, as Trottell thinks, who ought to have lived in the dark ages and been ducked in a horse pond, instead of flourishing in the nineteenth century and taking charge of a Christian house. You'll please to excuse my son Benjamin, won't you, sir? says this witch without a broomstick pointing to the man behind her, propped against the bare wall of the dining room, exactly as he had been propped against the bare wall of the passage. He's got his inside dreadful bad again as my son Benjamin, and he won't get a bed, and he will follow me about the house, upstairs and downstairs, and in my lady's chamber, as the song says, you know. It's his indisgestion, poor dear, that sours his temper and makes him so aggravating, and indisgestion is a wearing thing to the best of us. Ain't it, sir? Ain't it, sir? chimes in aggravating Benjamin, winking at the candlelight like an owl at the sunshine. Trottell examined the man curiously, while his horrid old mother was speaking of him. He found my son Benjamin to be little and lean, and buttoned up slovenly in a frowsy old greatcoat that fell down to his ragged carpet slippers. His eyes were very watery, his cheeks very pale, and his lips very red.    Drawing this conclusion easily enough, after a moment's observation of the man, Trottell found himself nevertheless keeping his eyes fixed much longer than was necessary on the ugly drunken face rolling about in the monstrous big coat collar, and looking at it with a curiosity that he could hardly account for at first. Was there something familiar to him in the man's features? He turned away from them for an instant, and then turned back to him again. After that second look the notion forced itself into his mind that he had certainly seen a face somewhere, of which that sott's face appeared like a kind of slovenly copy. Where, thinks he to himself, where did I last see the man whom this aggravating Benjamin here so very strongly reminds me of? It was no time just then, with the cheerful old woman's eyes searching him all over, and the cheerful old woman's tongue talking at him nineteen to the dozen, for Trottell to be ransacking his memory for small matters that had got into wrong corners of it. He put by in his mind that very curious circumstance respecting Benjamin's face, to be taken up again when a fit opportunity offered itself, and kept his wits about him in prime order for present necessities. You wouldn't like to go down into the kitchen, would you? says the witch without the broomstick, as familiar as if she had been Trottell's mother, instead of Benjamin's. There's a bit of fire in the grate, and the sink in the back kitchen don't smell to matter much to-day, and it's uncommon chilly up here when a person's flesh don't hardly cover a person's bones. But you don't look cold, sir, do you? And then why, Lord bless my soul, our little bit of business is so very, very little, it's hardly worthwhile to go downstairs about it, after all. Quite a game at business, ain't it, sir? Give and take, that's what I call it, give and take. With that, her wicked old eyes settled hungrily on the region round about Trottell's waistcoat pocket, and she began to chuckle like her son, holding out one of her skinny hands, and tapping cheerfully in the palm with the knuckles of the other. Aggravating Benjamin, seeing what she was about, roused up a little, chuckled, and tapped in imitation of her, got an idea of his own into his muddled head all of a sudden, and bolted it out charitably for the benefit of Trottell. I say," says Benjamin, settling himself against the wall, and nodding his head viciously at his cheerful old mother. I say, look out, she'll skin you!" Assisted by these signs and warnings, Trottell found no difficulty in understanding that the business referred to was the giving and taking of money, and that he was expected to be the giver. It was at this stage of the proceedings that he first felt decidedly uncomfortable, and more than half inclined to wish he was on the street side of the house door again. He was still cudgling his brains for an excuse to save his pocket, when the silence was suddenly interrupted by a sound in the upper part of the house. It was not at all loud. It was a quiet, still scraping sound, so faint that it could hardly have reached the quickest ears except in an empty house. "'Do you hear that, Benjamin?' says the old woman. "'He's at it again, even in the dark, ain't he? Perhaps you'd like to see him, sir?' says she, turning on Trottell, and poking her grinning face close to him. "'Only name it. Only say if you'd like to see him before we do our little bit of business, and I'll show good foley's friend upstairs, just as if he was good Mr. Foley himself. "'My legs are all right, whatever Benjamins may be. "'I get younger and younger, and stronger and stronger, and jollier and jollier every day, that's what I do. "'Don't mind the stairs on my account, sir, if you'd like to see him.'" Him! Trottell wondered whether him meant a man, or a boy, or a domestic animal of the male species. Whatever it meant, here was a chance of putting off that uncomfortable give-and-take business, and, better still, a chance, perhaps, of finding out one of the secrets of the mysterious house. Several spirits began to rise again, and he said, yes, directly, with the confidence of a man who knew all about it. Benjamin's mother took the candle at once, and lighted Trottell briskly to the stairs, and Benjamin himself tried to follow as usual, but getting up several flights of stairs, even helped by the Bannisters, was more with his particular complaint, than he seemed to feel himself inclined to venture on.  "'Bound sit there, dear,' says his affectionate mother, stopping to snuff the candle on the first landing. "'I shall sit here,' says Benjamin, aggravating to the last, till the milk comes in the morning." The cheerful old woman went on nimbly up the stairs to the first floor, and Trottell followed with his eyes and ears wide open. He had seen nothing out of the common in the front parlor or up the staircase so far. The house was dirty and dreary and close-smelling, but there was nothing about it to excite the least curiosity, except the faint scraping sound, which was now beginning to get a little clearer, though still not at all loud, as Trottell followed his leader up the stairs to the second floor. Nothing on the second floor landing but cobwebs above and bits of broken plaster below cracked off from the ceiling. Benjamin's mother was not a bit out of breath and looked all ready to go to the top of the monument if necessary. The faint scraping sound had got a little clearer still, but Trottell was no nearer to guessing what it might be than when he first heard it in the parlor downstairs. On the third and last floor there were two doors, one which was shut, leading into the front garret, and one which was a jar leading into the back garret. There was a loft in the ceiling above the landing, but the cobwebs all over it vowed sufficiently for its not having been open for some little time. The scraping noise, plainer than ever here, sounded on the other side of the back garret door, and to Trottell's great relief that was precisely the door which the cheerful old woman now pushed open. Trottell followed her in, and, for once in his life at any rate, was struck dumb with amazement at the sight which the inside of the room revealed to him. The garret was absolutely empty of everything in the shape of furniture. It must have been used at one time or other by somebody engaged in a profession or a trade which required for the practice of it a great deal of light, for the one window in the room which looked out on a wide open space at the back of the house was three or four times as large every way as a garret window usually is. Close under this window, kneeling on the bare boards with his face to the door, there appeared of all the creatures in the world to see alone at such a place and at such a time a mere might of a child, a little lonely, wizened, strangely clad boy who could not at the most have been more than five years old. He had a greasy old blue shawl crossed over his breast and rolled up to keep the ends from the ground into a great big lump on his back.   But there was something to see even more extraordinary than the clothes the child was swaddled up in and that was the game which he was playing at all by himself and which moreover explained in the most unexpected manner the faint scraping noise that had found its way downstairs through the half-open door in the silence of the empty house. It has been mentioned that the child was on his knees in the garret when Trottell first saw him. He was not saying his prayers and not crouching down in terror at being alone in the dark. He was odd and unaccountable as it may appear, doing nothing more or less than playing at a charwoman's or housemaid's business of scouring the floor. Both his little hands had tight hold of a mangy old blacking brush with hardly any bristles left in it which he was rubbing backwards and forwards on the boards as gravely and steadily as if he had been at scouring work for years and had got a large family to keep by it. The coming in of Trottell and the old woman did not startle or disturb him in the least. He just looked up for a minute at the candle with a pair of very bright sharp eyes and then went on with his work again as if nothing had happened. On one side of him was a battered pined saucepan without a handle which was his make-believe pale and on the other a morsel of slate coloured cotton rag which stood for his flannel to wipe up with. After scrubbing bravely for a minute or two he took the bit of rag and mocked up and then squeezed make-believe water out into his make-believe pale as grave as any judge that ever sat on a bench. By the time he thought he had got the floor pretty dry he raised himself upright on his knees and blew out a good long breath and set his little red arms a Kimbo and nodded at Trottell. There! says the child, knitting his little downy eyebrows into a frown. Drap the dirt! I've cleaned up. Where's my beer? Benjamin's mother chuckled till Trottell thought she would have choked herself. Lord have mercy on us, says she. Just hear the imp! You would never think he was only five years old, would you, sir? Pleased to tell goodness to Fawley you saw him going on as nicely as ever, playing at being me, scouring the parlour floor and calling for my beer afterwards. That's his regular game, morning, noon and night. He's never tired of it. Only look how snug we've been and dressed him.  He's snug and happy if ever an imp was yet. Where's my beer? Say it again, little dear, say it again. If Trottell had seen the boy with a light and a fire in the room, closed like other children and playing naturally with a top, or a box of soldiers, or a bouncing big India rubber ball, he might have been as cheerful under the circumstances as Benjamin's mother herself. But seeing the child reduced, as he could not help suspecting, for want of proper toys and proper child's company, to take up with the mocking of an old woman at her scouring work, for something to stand in the place of a game, Trottell, though not a family man, nevertheless felt the sight before him to be in its way one of the saddest and the most pitiable that he had ever witnessed. Why, my man, says he, you're the boldest little chap in all England. You don't seem a bit afraid of being up here all by yourself in the dark. The big winder, says the child, pointing up to it, sees in the dark, and I see with the big winder. He stops a bit and gets up on his legs and looks hard at Benjamin's mother. I'm a gooden, says he. Ain't I? I save candle. Trottell wondered what else the forlorn little creature had been brought up to do without, besides candle-light, and risked putting a question as to whether he ever got a run in the open air to cheer him up a bit. Oh, yes, he had a run now and then, out of doors, to say nothing of his runs about the house, the lively little cricket, a run according to good Mr. Forley's instructions, which were followed out carefully, as good Mr. Forley's friend would be glad to hear, to the very letter. As Trottell could only have made one reply to this, namely that good Mr. Forley's instructions were, in his opinion, the instructions of an infernal scamp, and as he felt that such an answer would naturally prove the death blow to all further discoveries on his part, he gulped down his feelings before they got too many for him, and held his tongue, and looked round towards the window again to see what the forlorn little boy was going to amuse himself with next. The child had gathered up his blacking brush and bit of rag, and had put them into the old tin saucepan, and was now working his way, as well as his clothes would let him, with his make-believe pale hugged up in his arms, towards a door of communication, which led from the back to the front garret. I'll say, says he, looking round sharply over his shoulder. What are you two stopping here for? I'm going to bed now, and so I'll tell you. With that he opened the door and walked into the front room. Seeing Trottell take a step or two to follow him, Benjamin's mother opened her wicked old eyes in a state of great astonishment. Mercy on us, says she. Haven't you seen enough of him yet? No, says Trottell. I should like to see him go to bed.  To think of good Mr. Forley's friend taking ten times more trouble about the imp than good Mr. Forley himself. Such a joke as that, Benjamin's mother had not often met with in the course of her life, and she begged to be excused if she took the liberty of having a laugh at it. Leaving her to laugh as much as she pleased, and coming to a pretty positive conclusion after what he had just heard, that Mr. Forley's interest in the child was not of the fondest possible kind, Trottell walked into the front room, and Benjamin's mother, enjoying herself immensely, followed with the candle. There were two pieces of furniture in the front garret, one an old stool of the sort that is used to stand a cask of beer on, and the other a great big rickety straddling old truckle bedstead. In the middle of this bedstead, surrounded by a dim brown waist of sacking, was a kind of little island of poor bedding, an old bolster with nearly all the feathers out of it doubled in three for a pillow, a mere shred of patchwork counterpane, and a blanket. And under that, and peeping out a little on either side beyond the loose clothes, two faded chair cushions of horsehair laid along together for a sort of makeshift mattress. When Trottell got into the room the lonely little boy had scrambled up on the bedstead with the help of the beer stool, and was kneeling on the outer rim of sacking with the shred of counterpane in his hands, just making ready to tuck it in for himself under the chair cushions. I'll tuck you up, my man, says Trottell, jump into bed and let me try. I mean to tuck myself up, says the poor forlorn child, and I don't mean to jump, I mean to crawl, I do, and so I tell you. With that he set to work, tucking in the clothes tight all down the sides of the cushions, but leaving them open at the foot. Then, getting up on his knees and looking hard at Trottell, as much as to say, What do you mean by offering to help such a handy little chap as me? He began to untie the big shawl for himself, and did it, too, in less than half a minute. Then, doubling the shawl up loose over the foot of the bed, he says, I'll say, look here! And ducks under the clothes head first, warming his way up and up softly under the blanket and counterpane, till Trottell saw the top of the large nightcap slowly peep out on the bolster. This oversized headgear of the child's had so shoved itself down in the course of his journey to the pillow under the clothes, that when he got his face fairly out on the bolster, he was all nightcap down to his mouth. He soon freed himself, however, from this slight encumbrance, by turning the ends of the cap up gravely to their old place over his eyebrows, looked at Trottell, said, Snug, ain't it? Goodbye! popped his face under the clothes again, and left nothing to be seen of him but the empty peak of the big nightcap, standing up sturdily on end in the middle of the bolster. What a young limmy he is, ain't it? says Benjamin's mother, giving Trottell a cheerful dig with her elbow.   If Trottell had not been by this time positively resolved to follow the wicked secret which accident had mixed him up with through all its turnings and windings right on to the end, he would have probably snatched the boy up then and there, and carried him off from his garret prison, bed clothes and all. As it was, he put a strong check on himself, kept his eye on future possibilities, and allowed Benjamin's mother to lead him downstairs again. My then top bannisters, says she, as Trottell laid his hand on them, they're as rotten as meddle as every one of them. When people come to see the premises, says Trottell, trying to feel his way a little farther into the mystery of the house, you don't bring many of them up here, do you? Bless your art alive, says she, nobody ever comes now. The outside of the house is quite enough to warn them off. More so pity as I say, used to keep me in spirits, staggering them all one after another with the frightful eye-rent, especially the women, Dratum. What's the rent of this house? Hundred and twenty pound a year. Hundred and twenty? Why, they're into housing as street as lets for more than eighty. Lightly enough, ma'am, other landlords may lower their rents if they please, but this ear landlord sticks to his rights, and means to have as much for his house as his father had before him. But the neighbourhood's gone off since then. Hundred and twenty pound, ma'am. The landlord must be mad. Hundred and twenty pound, ma'am. Open the door, you impertinent woman. Lord, what happiness it was to see him bounce out with that awful rent a-ringing in their ears all down the street. She stopped on the second floor landing to treat herself to another chuckle, while Trottell privately posted up in his memory what he had just heard. Two points made out, he sought to himself. The house is kept empty on purpose, and the way it's done is to ask a rent that nobody will pay. Ah, dearie me, says Benjamin's mother, changing the subject on a sudden, and twisting back with a horrid, greedy quickness to those awkward money matters which she had broached down in the parlour. What we've done one way and another for Mr Fawley, it isn't in words to tell that nice little bit of business of ours ought to be a bigger bit of business, considering the trouble we take, Benjamin and me, to make the imp upstairs as happy as the day is long. If good Mr Fawley would only please to think a little more of what a deal he owes to Benjamin and me. That's just it, says Trottell, catching her up short in desperation and seeing his way by the help of those last words of hers to slipping cleverly through her fingers. What should you say if I told you that Mr Fawley was nothing like so far from thinking about that little matter as you fancy? You would be disappointed now if I told you that I had come to-day without the money? Her lank old jaw fell and her villainous old eyes glared in a perfect state of panic at that. But what should you say if I told you that Mr Fawley was only waiting for my report to send me here next Monday at dusk with a bigger bit of business for us two to do together than ever you think for? What should you say to that? The old wretch came so near to Trottell before she answered and jammed him up confidentially so close into the corner of the landing that his throat in a manner rose at her. Can you count it off, do you think, on more than that? says she, holding up her four skinny fingers and her long crooked thumb all of a tremble right before his face. What do you say to two hands instead of one? says he, pushing past her and getting downstairs as fast as he could. What she said, Trottell thinks it best not to report, seeing that the old hypocrite getting next door to light headed at the golden prospect before her, took such liberties with unearthly names and persons which ought never to have approached her lips, and rained down such an awful shower of blessings on Trottell's head that his hair almost stood on end to hear her. He went on downstairs as fast as his feet would carry him till he was brought up all standing, as the sailors say, on the last flight, by aggravating Benjamin, lying right across the stair and fallen off as might have been expected into a heavy drunken sleep. The sight of him instantly reminded Trottell of the curious half-likeness which he had already detected between the face of Benjamin and the face of another man whom he had seen at a past time in very different circumstances. He determined before leaving the house to have one more look at the wretched muddled creature, and accordingly shook him up smartly and propped him against the staircase wall before his mother could interfere. Leave him to me, I'll freshen him up, says Trottell to the old woman, looking hard in Benjamin's face while he spoke. The frightened surprise of being suddenly woke up seemed for about a quarter of a minute to sober the creature. When he first opened his eyes there was a new look in them for a moment which struck home to Trottell's memory, as quick and as clear as a flash of light. The old maudlin sleepy expression came back again in another instant and blurred out all further signs and tokens of the past, but Trottell had seen enough in the moment before it came, and he troubled Benjamin's face with no more inquiries. Next Monday at dusk, says he, cutting short some more of the old woman's palaver about Benjamin's indisgestion. I've got no more time to spare-marm to-night. Please, to let me out. With a last few blessings, a few last dutiful messages to good Mr. Fawley, and a few last friendly hints not to forget next Monday at dusk, Trottell contrived to struggle through the sickening business of leave-taking to get the door opened and to find himself to his own indescribable relief, once more on the outer side of the house-to-let. CHAPTER VI. LET AT LAST THEIR MOM," said Trottell, folding up the manuscript from which he had been reading, and setting it down with a smart tap of triumph on the table. May I venture to ask what you think of that plain statement as a guess on my part, and not on Mr. Jabba's, at the riddle of the empty house? For a minute or two I was unable to say a word. When I recovered a little, my first question referred to the poor for lawn, little boy. Today is Monday the twentieth, I said. Surely you have not let a whole week go by, without trying to find out something more? Except at bedtime and meals, Mom," answered Trottell, I have not let an hour go by. Pleased to understand that I have only come to an end of what I have written, and not to an end of what I have done. I wrote down those first particulars, Mom, because they are of great importance, and also because I was determined to come forward with my written documents, seeing that Mr. Jabba chose to come forward in the first instance with his. I am now ready to go on with the second part of my story, as shortly and plainly as possible, by word of mouth. The first thing I must clear up, if you please, is the matter of Mr. Forley's family affairs. I have heard you speak of the Mom at various times, and I have understood that Mr. Forley had two children only, by his deceased wife, both daughters. The eldest daughter married to her father's entire satisfaction, one Mr. Bain, a rich man holding a high government situation in Canada. She is now living there with her husband and her only child, a little girl of eight or nine years old. Right so far, I think, Mom? Quite right, I said. The second daughter, Trottle went on, and Mr. Forley's favourite, set her father's wishes and the opinions of the world at flat defiance, by running away with a man of low origin, a mate of a merchant vessel, named Kirkland. Mr. Forley not only never forgave that marriage, but vowed that he would visit the scandal of it heavily in the future on husband and wife. Both escaped his vengeance, whatever he meant it to be. The husband was drowned on his first voyage after his marriage, and the wife died in child's bed. Right again, I believe, Mom? Again, quite right! Having got the family matter all right, we will now go back, Mom, to me and my doings. Last Monday I asked you for leave of absence for two days. I employed the time in clearing up the matter of Benjamin's face. Last Saturday I was out of the way when you wanted me. I played truant, Mom, on that occasion, in company with a friend of mine, who is managing Clark in a lawyer's office, and we both spent the morning at Doctor's Commons over the last will and testament of Mr. Forley's father. Leaving the will business for a moment, please to follow me first, if you have no objection, into the ugly subject of Benjamin's face. About six or seven years ago, thanks to your kindness, I had a week's holiday with some friends of mine who live in the town of Pendlebury. One of those friends, the only one now left in the place, kept a chemist's shop, and in that shop I was made acquainted with one of the two doctors in the town, named Barsham. This Barsham was a first-rate surgeon, and might have got to the top of his profession if he had not been a first-rate blaggard. As it was he both drank and gambled, nobody would have anything to do with him in Pendlebury, and at the time when I was made known to him in the chemist's shop, the other doctor, Mr. Dix, who was not to be compared with him for surgical skill, but who was a respectable man, had got all the practice. And Barsham and his old mother were living together in such a condition of utter poverty, that it was a marvel to everybody how they kept out of the parish work-house. Benjamin and Benjamin's mother! Exactly mom. Last Thursday morning, thanks to your kindness again, I went to Pendlebury to my friend the chemist to ask a few questions about Barsham and his mother. I was told that they had both left the town about five years since. When I inquired into the circumstances, some strange particulars came out in the course of the chemist's answer. You know, I have no doubt, mom, that poor Mrs. Kirkland was confined while her husband was at sea in lodgings at a village called Flatfield, and that she died and was buried there. But what you may not know is that Flatfield is only three miles from Pendlebury, that the doctor who attended on Mrs. Kirkland was Barsham, that the nurse who took care of her was Barsham's mother, and that the person who called them both in was Mr. Foley. Whether his daughter wrote to him, or whether he heard of it in some other way, I don't know, but he was with her, though he had sworn never to see her again when she married, a month or more before her confinement, and was backwards and forwards a good deal between Flatfield and Pendlebury. How he managed matters with the Barshams cannot at present be discovered, but it is a fact that he contrived to keep the drunken doctor sober to everybody's amazement. It is a fact that Barsham went to the poor woman with all his wits about him. It is a fact that he and his mother came back from Flatfield after Mrs. Kirkland's death, packed up what few things they had, and left the town mysteriously by night. And lastly it is also a fact that the other doctor, Mr. Dix, was not called in to help till a week after the birth and burial of the child, when the mother was sinking from exhaustion. Exhaustion to give the vagabond Barsham his due, not produced, in Mr. Dix's opinion, by improper medical treatment, but by the bodily weakness of the poor woman herself. Burial of the child, I interrupted, trembling all over. Trottle, you spoke that word burial in a very strange way. You are fixing your eyes on me now with a very strange look. Trottle leaned over close to me and pointed through the window to the empty house. The child's death is registered at Pendlebury, he said, on Barsham's certificate, under the head of male infant stillborn. The child's coffin lies in the mother's grave in Flatfield churchyard. The child himself, as surely as I live and breathe, is living and breathing now a castaway and a prisoner in that villainous house. I sank back in my chair. It's guesswork so far, but it is borne in on my mind for all that as truth. Rouse yourself, Mum, and think a little. The last I hear of Barsham he is attending Mr. Folly's disobedient daughter. The next I see of Barsham he is in Mr. Folly's house, trusted with a secret.  Wait! Please, to wait! I have not done yet. The will left by Mr. Folly's father strengthens the suspicion. The friend I took with me to Doctor's Commons made himself master of the contents of that will, and when he had done so I put these two questions to him. Can Mr. Folly leave his money at his own discretion to anybody he pleases? No, my friend says. His father has left him with only a life interest in it. Suppose one of Mr. Folly's marriage daughters has a girl and the other a boy, how would the money go? It would all go, my friend says, to the boy, and it would be charged with the payment of a certain annual income to his female cousin. After her death it would go back to the male descendant and to his heirs. Consider that, ma'am.  There was good, too good reason why that child of Mrs. Kirkland's should be registered stillborn. And if, as I believe, the register is founded on a false certificate, there is better, still better, reason why the existence of the child should be hidden and all trace of his parentage blotted out in the garret of that empty house. He stopped and pointed for the second time to the dim, dust-covered garret windows opposite. As he did so I was startled, a very slight matter suffice to frighten me now, by a knock at the door of the room in which we were sitting. My maid came in with a letter in her hand. I took it from her. The morning card, which was all the envelope enclosed, dropped from my hands. George Folly was no more. He had departed this life three days since, on the evening of Friday. Did our last chance of discovering the truth, I asked, rest with him? Has it died with his death? Courage, Mom, I think not. Our chance rests on our power to make Barsham and his mother confess. And Mr. Folly's death, by leaving them helpless, seems to put that power into our hands. With your permission I will not wait till dusk to-day, as I at first intended, but will make sure of those two people at once. With a policeman in plain clothes to watch the house, in case they try to leave it, with this card to vouch for the fact of Mr. Folly's death, and with a bold acknowledgement on my part of having got possession of their secret and of being ready to use it against them in case of need, I think there is little doubt of bringing Barsham and his mother to terms. In case I find it impossible to get back here before dusk, please to sit near the window-marm, and watch the house a little before they light the street-lamps. If you see the front door open and close again, will you be good enough to put on your bonnet and come across to me immediately? Mr. Folly's death may or may not prevent his messenger from coming as arranged, but if the person does come, it is of importance that you, as a relative of Mr. Folly's, should be present to see him, and to have that proper influence over him, which I cannot pretend to exercise. The only words I could say to Trottle as he opened the door and left me, were words charging him to take care that no harm happened to the poor, full-lawn little boy. Left alone, I drew my chair to the window, and looked out with a beating heart at the guilty house. I waited and waited through what appeared to me to be an endless time, until I heard the wheels of a cab stop at the end of the street. I looked in that direction and saw Trottle get out of the cab alone, walk up to the house, and knock at the door. He was let in by Barsham's mother. A minute or two later a decently dressed man sauntered past the house, looked up at it for a moment, and sauntered on to the corner of the street close by. Here he lent against the post and lighted a cigar, and stopped there smoking in an idle way, but keeping his face always turned in the direction of the house door. I waited and waited still. I waited and waited with my eyes riveted to the door of the house. At last I thought I saw it open in the dusk, and then felt sure I heard it shut again, softly. Though I tried hard to compose myself, I trembled so that I was obliged to call for Peggy to help me on with my bonnet and cloak, and was forced to take her arm to lean on in crossing the street. Trottle opened the door to us before we could knock. Peggy went back and I went in. He had a lighted candle in his hand. It has happened, ma'am, as I thought it would, he whispered, leading me into the bare, comfortless empty parlour. Barsham and his mother have consulted their own interests, and have come to terms. My guesswork is guesswork no longer. It is now what I felt it was—truth. Something strange to me, something which women who are mothers must often know, trembled suddenly in my heart, and brought the warm tears of my youthful days thronging back into my eyes. I took my faithful old servant by the hand, and asked him to let me see Mrs. Kirkland's child for his mother's sake. If you desire it, ma'am, said Trottle, with a gentleness of manner that I had never noticed in him before. But pray, don't think me wanting in duty and right feeling, if I beg you to try and wait a little. You are agitated already, and a first meeting with the child will not help to make you so calm as you would wish to be if Mr. Fawley's messenger comes. The little boy is safe upstairs. Pray, think first of trying to compose yourself for a meeting with a stranger, and believe me, you shall not leave the house afterwards without the child. I felt that Trottle was right, and sat down as patiently as I could in a chair he had thoughtfully placed ready for me. I was so horrified at the discovery of my own relation's wickedness, that when Trottle proposed to make me acquainted with the confession rung from Barsham and his mother, I begged him to spare me all details, and only to tell me what was necessary about George Fawley. All that can be said for Mr. Fawley, ma'am, is that he was just scrupulous enough to hide the child's existence, and blot out its parentage here, instead of consenting at the first to its death or afterwards when the boy grew up, to turning him adrift absolutely helpless in the world. The fraud has been managed, ma'am, with the cunning of Satan himself. Mr. Fawley had the hold over the Barshams that they had helped him in his villainy, and that they were dependent on him for the bread they eat. He had brought them up to London to keep them securely under his own eye. He put them into this empty house, taking it out of the agent's hands previously on pretense that he meant to manage the letting of it himself, and by keeping the house empty made it the surest of all hiding places for the child. Here Mr. Fawley could come whenever he pleased to see that the poor lonely child was not absolutely starved, sure that his visits would only appear like looking after his own property. Here the child was to have been trained to believe himself Barshams' child, till he should be old enough to be provided for in some situation as low and as poor as Mr. Fawley's uneasy conscience would let him pick out. He may have thought of atonement on his deathbed, but not before. I am only too certain of it, not before. A low double-knock startled us. The messenger said trottle under his breath. He went out instantly to answer the knock, and returned, leading in a respectable-looking elderly man, dressed like trottle all in black, with a white cravat, but otherwise not at all resembling him. I am afraid I have made some mistake, said the stranger. Trottle, considerably taking the office of explanation into his own hands, assured the gentleman that there was no mistake, mentioned to him who I was, and asked him if he had not come on business connected with the late Mr. Fawley. Looking greatly astonished, the gentleman answered, Yes! There was an awkward moment of silence after that. The stranger seemed to be not only startled and amazed, but rather distrustful and fearful of committing himself as well. Noticing this, I thought it best to request trottle to put an end to further embarrassment by stating all particulars truthfully as he had stated them to me, and I begged the gentleman to listen patiently for the late Mr. Fawley's sake. He bowed to me very respectfully, and said he was prepared to listen with the greatest interest. It was evident to me, and I could see to trottle also, that we were not dealing to say the least with a dishonest man. Before I offer any opinion on what I have heard, he said earnestly and anxiously after trottle had done, I must be allowed injustice to myself to explain my own apparent connection with this very strange and very shocking business. I was the confidential legal advisor of the late Mr. Fawley, and I am left his executor. Rather more than a fortnight back, when Mr. Fawley was confined to his room by illness, he sent for me, and charged me to call and pay a certain sum of money here, to a man and woman whom I should find taking charge of the house. He said he had reasons for wishing the affair to be kept a secret. He begged me so to arrange my engagements that I could call at this place either on Monday last or to-day at dusk, and he mentioned that he would write to warn the people of my coming without mentioning my name. Dolcott is my name, as he did not wish to expose me to any future importunities on the part of the man and woman. I need hardly tell you that this commission struck me as being a strange one, but in my position with Mr. Fawley I had no resource but to accept it without asking questions, or to break off my long and friendly connection with my client. I chose the first alternative. Business prevented me from doing my errand on Monday last, and if I am here to-day, notwithstanding Mr. Fawley's unexpected death, it is emphatically because I understood nothing of the matter on knocking at this door, and therefore felt myself bound as executor to clear it up. That, on my word of honour, is the whole truth so far as I am personally concerned. I feel quite sure of it, sir, I answered. You mentioned Mr. Fawley's death just now as unexpected. May I inquire if you were present, and if he has left any last instructions? Three hours before Mr. Fawley's death, said Mr. Dolcott, his medical attendant left him apparently in a fair way of recovery. The change for the worse took place so suddenly, and was accompanied by such severe suffering to prevent him from communicating his last wishes to any one. When I reached his house he was insensible. I have since examined his papers not one of them refers to the present time, or to the serious matter which now occupies us. In the absence of instructions I must act cautiously on what you have told me, but I will be rigidly fair and just at the same time. The first thing to be done, he continued, addressing himself to trottle, is to hear what the man and woman downstairs have to say. If you can supply me with writing materials, I will take their declaration separately on the spot, in your presence, and in the presence of the policeman who is watching the house. Tomorrow I will send copies of those declarations, accompanied by a full statement of the case, to Mr. and Mrs. Bain in Canada, both of whom know me well as the late Mr. Fawley's legal adviser. And I will suspend all proceedings on my part, until I hear from them or from their solicitor in London. In the present posture of affairs this is all I can safely do. We could do no less than agree with him, and thank him for his frank and honest manner of meeting us. It was arranged that I should send over the writing materials from my lodgings, and, to my unutterable joy and relief, it was also readily acknowledged that the poor little orphan boy could find no fitter refuge than my old arms were longing to offer him, and no safer protection for the night than my roof could give. Trottle hastened away upstairs, as actively as if he had been a young man, to fetch the child down. And he brought him down to me without another moment of delay, and I went on my knees before the poor little might, and embraced him, and asked him if he would go with me to where I lived.  Then he clung close to me all at once and said, I'm a-going along with you, I am, and so I tell you. For inspiring the poor neglected child with this trust in my old self, I thanked heaven then, with all my heart and soul, and I thank it now. I bundled the poor darling up in my own cloak, and I carried him in my own arms across the road.    The forlorn baby came to this refuge through you, and he will help you on your way to heaven. Trottle answered that I was his dear mistress, and immediately went and put his head out at an open window on the landing, and looked into the back street for a quarter of an hour. That very night as I sat thinking of the poor child, and of another poor child, who is never to be thought about enough at Christmas time, the idea came into my mind which I have lived to execute, and in the realisation of which I am the happiest of women this day. The executor will sell that house, Trottle, said I. Not a doubt of it, ma'am, if he can find a purchaser. I'll buy it. I have often seen Trottle pleased, but I never saw him so perfectly enchanted as he was when I confided to him, which I did then and there, the purpose that I had in view. To make short of a long story, and what story would not be long coming from the lips of an old woman like me unless it was made short by main force, I bought the house. Mrs. Bain had her father's blood in her. She evaded the opportunity of forgiving and generous reparation that was offered her, and disowned the child. But I was prepared for that, and loved him all the more for having no one in the world to look to, but me. I am getting into a flurry by being over-pleased, and I dare say I am as incoherent as need be. I bought the house, and I altered it from the basement to the roof, and I turned it into a hospital for sick children. Never mind by what degrees my little adopted boy came to the knowledge of all the sights and sounds in the streets, so familiar to other children, and so strange to him. Never mind by what degrees he came to be pretty, and childish, and winning, and companionable, and to have pictures and toys about him, and suitable playmates. As I write, I look across the road to my hospital, and there is the darling, who has gone over to play, nodding at me out of one of the once lonely windows, with his dear chubby face backed up by Trottle's waistcoat, as he lifts my pet for Grandma to see. Many an eye I see in that house now, but it is never in solitude, never in neglect. Many an eye I see in that house now, that is more and more radiant every day with the light of returning health. As my precious darling has changed beyond description for the brighter and the better, so do the not less precious darlings of poor women change in that house every day in the year, for which I humbly thank that gracious being whom the restorer of the widow's son and of the ruler's daughter instructed all mankind to call their father.


Well, hey guys, this is Alex Alex a bb I'm still living in hotel rooms, and I don't have my tripod so you get the unfortunately shaky Video of my cell phone, but I hadn't published a video in a little while And I wanted to make sure that everyone knew I was still alive, so I thought I'd talk about a new toy I got That camera would focus Doesn't look so good doesn't know there we go. So anyway, what I have here is a little kit from a company called Buster You should be able to see made in Germany Right there It came in this beautiful box. I got it from off of eBay a couple weeks ago before I moved and This is a type of kit that a doctor might have in his like travel or hit or traveling Medical kit and You guys probably recognize this tool if you've been to the you've ever been to the doctor. This is called an ophthalmoscope It it's basically used for examining the inside of the eye But it has some Use for us in in locksport and probably any other kind of mechanical endeavor So what you basically have here is If I can focus On this thing There we go You have a little eyepiece and if I turn it on you can see on the back. There's a You may not be able to see there you go a light The light has different a couple different colors and patterns and stuff that it can do For for looking at different types of things. I don't know what they're all called turn it back off and Then so you shine the light at your target And you set the color or whatever you want and then it has this little ring and I don't know if you can see the Turn I can't turn the damn light off, but You can see here The there's a little Window and in if you could see it inside the window is a number It's basically a magnification factor and so as you turn this outer dial It you can see this little lenses moving by at the top there These are changing the magnification that you get and so what you can do is you can stick this thing right on the end or right on the in your key way for example and Turn this little dial and it will sort of zoom in And Focus at different like a millimeter at a time down inside the key way so if you're looking for weird maybe weird bottom pins or You know defects in the key way or funny little extra set pins that sort of thing You can you can find them that way and that's kind of neat and you can see what's going on inside there I found that very useful on a number of things this one also comes with What is called an autoscope? and This is this one's made out of plastic, so I don't know if it's original to this particular kit because everything else in here Is nice metal let me see if I can Pop it on there. It's got like a little fixture sorry there we go and How well you can see this but it also has a light and there's a little window and I don't know if the camera's gonna Do this justice, but So the stupid lamp in there, but But you can see that it has a magnification there and you can sort of stare down at stuff and get a pretty good The pretty good view in there, and that's actually pretty useful as well This one comes with an extra magnifier.  That's kind of cool This was about a hundred bucks on eBay.  I was looking at pins or something like that Actually shot through this thing not great for home photography, but Really kind of cool if you want to look inside small dark places or You know play doctor at home or whatever you like So if if I were buying any one of these things like I said this is kind of fun to play with to try out the optics are not great the light sources all right decent color But batteries don't last very long time and it seems to break pretty easily if you can get your hands on something With one of these on it even if it's not a fancy German one But if you get one with a good with a working light and Ahead like this. This is just amazing for looking inside of locks and other things Even just looking at metal up close You can see the the quality of the metal the finish the grain structure of steel things like that It's a great little magnifying device and again It has the advantage that you can hold it at a set distance and then change this little dial For everything from zero magnification up to like 20x or 50x and kind of zoom in on the on the target and look further or Deeper shallower in the in into a keyway or some hole or whatever you want to look at So if you can find one of these for good price, you got a little extra cash. I think you're pretty cool Or you know, you know doctor friend maybe sneak over their office and play with it But you might want to just get one of these I think I got this says brokage on it I think I got this from south order or something like that They may have been someone of these on UK locksport. I can't remember but um, yeah, so a little toy Hopefully I'll have some picking videos out soon. I got a few cool things from Bosnian bill when I was up north and Yeah, so anyway, make sure you have fun and Keep it legal. Thanks for watching and we'll talk to you soon. Cheers