Chapter 5: A Clean Record
For several seconds, nobody in the corridor moved.
The little light inside the evidence pouch blinked again.
Daniel watched it through the clear plastic. The device was sealed, logged, and in security custody. Still, whatever it was doing had not stopped when the boardroom’s wired connection was cut.
“Keep the room closed,” he said. “No one goes in. No one touches the device. And preserve every record related to it—the access logs, camera-system logs, maintenance ticket, and the network trace.”
The security lead nodded and began entering the instructions on his tablet.
“Make a read-only copy of the ticket and its available audit data,” Daniel continued. “Then document who accesses the originals from this point forward.”
Grant folded his arms. “That sounds like a full investigation before we’ve established that anything happened.”
“It sounds like preserving evidence before it changes again.”
A door opened down the corridor. One of the company’s lawyers stepped out, glanced at Daniel, and stopped when she saw the pouch. Daniel motioned for her to wait. He wanted the evidence preserved before more people came close enough to talk about it.
He pulled out his phone.
“Who are you calling?” Grant asked.
“An independent examiner.”
“We have an internal security team.”
“We have a live device and an upload we haven’t verified. I want someone who isn’t employed by either department involved.”
Grant’s expression tightened. “You’re inviting an outsider into a confidential matter.”
“I’m asking for a forensic consultation. They’ll receive only what’s necessary to advise us. We’ll document it.”
Daniel stepped a few feet away and made the call. The specialist’s office had been recommended to the company before, but Daniel had never needed its services. He gave no names beyond his own and the company’s. He described a sealed electronic device in security custody, a connection that continued after the room’s network was isolated, and an apparent event associated with the meeting’s start.
He asked her to review the network information remotely before anyone examined the device itself.
“Do not open the pouch or change its power state,” she told him. “Preserve the trace exactly as it is. I’ll come in and review the collection process with your security lead.”
Daniel looked at the pouch.
“Can the device be stopped from transmitting?”
“Not without knowing what it is and how it’s communicating. A rushed attempt could destroy information or alter the evidence. Let me see the trace first.”
He glanced toward Grant. The CFO stood several yards away, listening without pretending otherwise.
“Understood,” Daniel said. “We won’t alter it.”
When the call ended, Daniel relayed the instructions to the security lead. The lead confirmed that the device remained sealed, the wired isolation was documented, and the trace data was being preserved separately.
Grant checked his watch.
“How long are you going to keep the directors waiting?”
“Until I can tell them something accurate.”
“They can vote without a technical examination.”
“They can. They’re not going to do it without an update from me.”
Grant turned to Ruth Chen, who had just joined them from the elevator. The board chair’s face was composed, but her eyes moved from the sealed pouch to the open maintenance records on the security lead’s tablet.
“Is the meeting still on hold?” she asked.
“Yes,” Daniel said. “We’re preserving the logs and asking an outside specialist to verify the trace. I can’t tell you yet whether the device recorded anything or where it’s communicating.”
“Then don’t tell me more than you know,” Ruth said. “But keep me informed.”
She went back toward the directors’ waiting area. Grant followed her for a few paces, then stopped when Daniel called Eli’s name.
“Eli, I’d like to look at the maintenance ticket with you. You don’t have to explain it alone.”
Eli’s eyes flicked to Grant, then to Annie. She was still holding his hand. Her untied sneaker had crept loose at the heel, and her purple backpack rested against one leg.
“I can show you the work log,” Eli said. “But I want a copy of whatever record you’re looking at.”
“You’ll have one,” Daniel said.
Grant gave a small, impatient laugh. “We’re treating a routine maintenance ticket like it’s evidence in a criminal case.”
“It may be relevant to what happened,” Daniel replied. “That’s why we’re preserving it.”
The security lead brought up the ticket on a separate tablet and angled the screen toward Eli. Daniel stood beside him. Grant remained near enough to hear every word.
Eli read the entry once, then leaned closer.
“That’s not what I entered.”
“What part?” Daniel asked.
“The service code.”
Eli pointed to a short code in the work-order field. He tapped the screen without touching it.
“I don’t use that code. It’s for a standard audio-console check. I reported that I’d found an unregistered network device. I couldn’t verify who authorized it.”
Daniel looked at the ticket. The description was brief, stripped of the detail Eli had given him earlier. Beside the entry was Eli’s employee account.
“Did you submit this version?” Daniel asked.
“No.”
“Can you tell when it changed?”
Eli scrolled through the available record. There was a creation time, but no useful revision history.
“That’s what was missing when I checked it before,” he said. “There should be a record of an edit. It isn’t here.”
The security lead studied his own screen.
“The ticket is associated with Mr. Carter’s credentials,” he said. “I can’t tell from this view who was at the keyboard or whether the account was used by someone else.”
“So this makes it look like Eli authorized the work,” Daniel said.
“It makes it look like his account was associated with this ticket,” the security lead corrected. “That isn’t the same thing as proving he changed it.”
“Good,” Daniel said. “Keep that distinction in the record.”
Eli looked at him, still guarded.
“I reported it because there was no approved device on the equipment list,” he said. “I didn’t install it. I didn’t sign off on it.”
“I believe that’s what you told me,” Daniel said. “And we’re not going to turn a credential entry into proof that you did something you say you didn’t do.”
Grant stepped closer.
“Be careful, Daniel. If an employee’s credentials were used to submit the ticket, maintenance has to be part of the inquiry.”
“Maintenance can be part of the inquiry. Eli won’t be left to defend himself against a record we already know is incomplete.”
Eli’s jaw tightened. “I followed the process. I reported what I found, and then I was told to close the ticket.”
No one answered immediately.
Annie pressed closer to her father’s side. Daniel noticed the way Eli’s hand closed around hers—not to silence her, but to reassure her he was there.
The security lead saved a copy of the ticket and confirmed that the original would remain untouched. The missing audit history, he said, would have to be checked against the system logs. Daniel told him to preserve those logs, too, before any routine cleanup could erase them.
A woman in a dark blue coat arrived at the far end of the corridor, carrying a slim case. She introduced herself as the independent forensic examiner Daniel had called. She showed her credentials to the security lead, asked who had handled the pouch, and reviewed the chain-of-custody notes before going anywhere near it.
She did not touch the evidence.
Instead, she examined the preserved network trace on the security lead’s tablet and asked him to confirm the time of the meeting, the moment the wired connection had been isolated, and the time the apparent upload event appeared.
The lead answered carefully. He could confirm what the system had logged, he said, but not yet what the event contained or whether the schedule was accurate.
The examiner’s face remained neutral as she reviewed the data.
“Is the upload queued for the meeting’s start?” Daniel asked.
“The trace is consistent with that,” she said. “But I need to validate the source and the clock before I can confirm the timing.”
“And can you tell where it’s going?”
“Not from this view alone.”
Grant exhaled through his nose.
“So we still have no proof of a recording, no verified destination, and no identified person who installed the device.”
“That’s correct,” Daniel said.
May you like
The examiner looked up from the tablet.
“But there is something you need to consider,” she said. “The event may not be waiting for the meeting to begin. The upload could already be in progress—or the data may already have reached an outside server.”
