By 8:15 the following morning, the basement document services room had been sealed off, with two Security officers stationed outside. The retired terminal stood where it had been left, its disconnected cables hanging behind the desk. The slim document case remained on the floor beside it, exactly where the employee had abandoned it the previous evening.Lucas arrived with Helen just before the forensic team. He'd slept badly, waking several times with the same images running through his head: the recovered instruction on the terminal screen, the temporary access card caught between someone's fingers, and the employee walking out of the basement without the case.The building had already settled into its morning routine. A trolley rattled along the corridor, its loose wheel knocking against the floor tiles. Somewhere upstairs, a receptionist was arguing with a delivery driver. Lucas found the ordinary noise irritating. A succession document had vanished from a restricted archive, and p

The investigator called at 8:17 the following morning.Lucas was already in the office. He had spent most of the night reviewing the four documents recovered from the migration backup. The coffee beside his laptop had gone cold, and his eyes ached from staring at the same lines until the words began to blur.Helen stood near the window, reading a message on her phone.“Tell me you found something useful,” Lucas said as he answered.“We found the account assignment history,” the investigator replied. “ES-RC-04 wasn't registered to an individual employee.”Lucas glanced at Helen.“Who was it registered to?”“Executive Coordination's restricted correspondence desk. It was a shared account. Three positions had permission to use it during the relevant period.”“Names?”“I've sent the access schedule to Legal. Two positions were held by people who have since left the company. The third belonged to the office of the Deputy Director of Executive Coordination.”Helen lowered her phone.“Does t

The former restricted correspondence officer arrived at 10:20 the following morning.Lucas watched through the glass partition as Legal's representative escorted him into the conference room. The man was in his early fifties, with thinning grey hair and a dark suit that hung loosely around his shoulders. He carried a worn leather folder and kept one hand pressed against its handle.Helen had arranged the relevant documents on the table. The original inventory recovered from the migration backup, the restricted register entry and the personnel archive access history were kept in separate folders.Lucas waited until the man sat down.“Mr. Grant, thank you for coming.”Grant placed his folder on the table. “I was told this concerned a handover declaration I signed before leaving the company.”“It does. We also have questions about restricted correspondence reference ER/77-D.”Grant's expression changed slightly.“I wondered when that would come up.”Lucas noticed the reaction but didn't

The records liaison arrived twelve minutes before the scheduled interview.Lucas watched her enter the conference room with a slim laptop tucked under one arm. She introduced herself as Claire Bennett, a Corporate Administration records officer responsible for maintaining departmental indexes and processing routine custody updates.Helen sat opposite Lucas, with the Legal representative beside her. A copy of the electronic register amendment lay on the table.“Ms. Bennett, we're reviewing a change made to the restricted custody record for ER/77-D,” Lucas began. “Your account appears in the submission history.”Claire placed her laptop down.“I was told this concerned an old administrative adjustment.”“It does. The item was originally recorded under Executive Coordination. Three weeks after the Deputy Director left, the custodian field changed to Corporate Administration.”“I remember processing a custody adjustment around that period.”“Do you remember this particular one?”“Not clea

The authentication history arrived shortly after ten the following morning.Helen was already in Lucas's office when the archive team sent the export. She checked the verification note, saved a copy to the investigation folder and opened the access report.“They've completed the forensic copy,” she said. “The original conversion folder and its available version history are preserved. This is the access record.”Lucas pulled his chair closer.The report contained the session reference, account identifier, workstation code, connection time and a list of recorded operations. Two days before the ER/77-D index entry was created, ES-RC-04 had accessed the conversion folder and requested its directory listing. There was no recorded event showing that an individual document had been opened.“Does that mean nobody opened the missing file?” Lucas asked.“No. It means this particular log doesn't show a document-opening event. The file may not have been present, or the system may not have capture