Julian Vance went to his office that Saturday afternoon.

Between 2:40 and just after seven in the evening, according to the access logs and the forensic image taken eleven days later, the following happened on a company-issued laptop assigned to him:

A folder structure containing four hundred and sixty-one files was deleted.

A commercial file-wiping utility was downloaded, installed and run.

Two email archives were exported and then removed.

And a personal external drive was connected for thirty-one minutes.