“Good. Mark what you know, what you can reproduce, and what remains uncertain.”
Noah pointed to a photograph.
“This was taken on Tuesday afternoon. You can see the calibration table in the background.”
The image was slightly blurry, but several rows remained readable.
Grace opened another photograph on her laptop. It showed the workshop's whiteboard, covered in equations, test conditions, and a list of planned changes.
“That's Wednesday,” she said. “The newest software build was running then.”
Marcus studied the image.
“Can you establish the time?”
“The camera metadata says 3:16 p.m. The workshop calendar says we were testing from three until four.”
“Keep both records. Don't treat either as proof of something it doesn't establish.”
Olivia nodded.
For a moment, Marcus felt the familiar satisfaction of a technical problem becoming clearer. The students were rebuilding a reliable account from separate pieces of evidence, refusing to fill gaps with convenient assumptions.
Then Olivia pointed to a line in the timeline.
“There's something else. On Wednesday morning, someone requested a copy of our project summary.”
“Who?”
“The request came through the initiative's internal review form. We thought it was part of the normal process, because projects sometimes get selected for presentations.”
“Did you approve it?”
“No. The form said the request was still under review. We never received a follow-up.”
Marcus looked at her.
“Did you save a copy?”
Olivia opened a folder and showed him a PDF.
The request was brief. It asked for a technical overview of ClearCurrent, a summary of the calibration approach, and a description of the team's testing results.
The stated purpose was external technical review and potential partnership assessment.
At the bottom was a field labeled Project Sponsor Approval. It was blank.
“Who submitted this?” Marcus asked.
“That field is blank too.”
The form carried an automatically generated reference number, but no visible name.
Marcus felt the mystery tighten around them.
The recovered email draft had been created three days before the files disappeared. The review request had been submitted during the same period. Both records concerned ClearCurrent, and neither clearly identified the person responsible.
But there was a crucial difference.
The request had not asked for the full project files. It had asked for a summary.
“Did anyone tell you an outside company wanted to review your project?” he asked.
“No,” Olivia replied. “We only found this because I searched the archived submissions.”
“Then we need to determine whether the request was ever approved, whether anyone acted on it, and whether the document was sent anywhere.”
Noah closed the laptop.
“What if somebody was preparing to use our work before the files disappeared?”
“That's a possibility,” Marcus said. “It's not yet a conclusion.”
Olivia looked frustrated.
“You keep saying that.”
“Because I don't want anyone to take your work away twice. First by making decisions without you, and then by using uncertainty to tell you what happened.”
She fell silent.
Marcus continued.
“We'll follow the records. If someone accessed your files, we'll try to establish who and how. If someone shared your work, we'll find the transmission. If the evidence doesn't answer a question, we'll say so.”
Olivia looked down at the request form.
“Fine. But I want a copy of every record about our project.”
“That's reasonable. Andrea can arrange it.”
“And no one gets to negotiate a partnership using our names unless we agree.”
Marcus nodded. “I'll make sure that requirement is documented.”
For the first time that morning, Olivia returned to her workbench.
She didn't look reassured.
She looked determined.
And Marcus knew that, for the moment, determination would have to be enough.
By noon, Andrea had arranged a meeting with Priya Shah, the independent IT specialist investigating the missing files.
Priya had spent the previous day examining the archived email data and the access logs. She arrived with a laptop containing verified copies of the recovered records and a written explanation of what the evidence could and could not establish.
Richard Caldwell joined the meeting, along with Rachel Morgan and Patricia Cole.
Priya began with the email draft.
“The recovered archive contains a draft with the subject line shown in the screenshot. The message references a proposed technical review of ClearCurrent. However, the sender field is incomplete, and the draft does not contain a verified recipient list.”
“Was it sent?” Richard asked.
“We have not found evidence that this particular draft was sent. It may have remained a draft, been copied into another system, or been used as a template for a separate message. We need more records to distinguish those possibilities.”
“And the review request?” Andrea asked.
“That is a separate record. It was submitted through the initiative's internal form. The request exists, but the approval field is blank, and the form's audit history is incomplete.”
“Can we identify the account that submitted it?”
“We can identify the internal service account that processed the form. We cannot yet identify the person who initiated it.”
Marcus leaned forward.
“What about the missing files?”
Priya opened a table.
“Three events matter. First, the files were available in the shared project folder. Second, a user session accessed the folder shortly before the team reported the disappearance. Third, the account associated with that session was Marcus's.”
Richard looked at Marcus.
Marcus kept his expression neutral.
“Does that mean I deleted them?”
“No,” Priya answered. “It means the session was associated with your account. It does not establish who was physically using the device, whether the session was active or left open, or whether another process acted under the account.”
“Can you tell what happened during the session?”
“Some records indicate file changes, but the logs are incomplete. We can establish that several files became unavailable during the relevant period. We cannot yet establish whether they were deliberately deleted, moved, overwritten, or affected by a synchronization issue.”
Rachel looked alarmed.
“Could the system have done it automatically?”
“It's possible, but we have no evidence yet that an automated process caused this specific event.”
Priya moved to another screen.
“There is one useful finding. The account activity associated with the missing files is not the same as the account activity associated with the review request.”
“So two separate events,” Richard said.
“Two separate records, yes. Whether they were initiated by the same person is unknown.”
Marcus stared at the table.
Someone could have submitted the request and someone else could have removed the files. Or one person could have done both using different processes. Or the two events might be unrelated.
The available evidence did not permit a choice.