Chapter 17: Before Midnight
Daphne's WMG authorization reached Marcus with twenty-six minutes left on the retention clock.
The timestamp appeared at 5:34 p.m. on the video wall in Dana's office, beside a countdown Marcus had opened from WMG's records room.
Daphne occupied the center window. Grant joined from headquarters; Marcus kept both hands above his keyboard while the authorization loaded.
“Stop,” Grant said. “Priya Nanduri is a WCT director. She cannot direct WMG information technology.”
“Correct,” Dana said before I could answer.
Priya had identified the risk and the proper company official, not issued the command on Marcus's screen.
Daphne was WMG's lead independent director, and the signature block belonged only to her corporate office.
The distinction cost us three minutes and saved the preservation from beginning under the wrong authority.
“My authorization covers capture, encryption, hashing, and independent custody of the identified logs,” Daphne said. “It does not authorize content review tonight.”
Grant reserved his objection to her emergency power.
Daphne directed the corporate secretary to record it.
The countdown reached twenty-one minutes.
Marcus read the scope back: the January 11 calendar events, the specified email-gateway transactions, badge-access records, and board-portal activity tied to the notices and named records.
No employee narrative, privileged legal folder, or unrelated board material belonged in the capture.
The vendor platform could preserve only the portal activity available through WMG's own account before rotation; Marcus could not reach beyond that account into a third party's systems.
“That is the boundary,” Daphne said. “Proceed.”
Marcus selected the signed authorization and started the custodian workflow.
I saw directory names, not contents.
One line turned from scheduled deletion to preservation pending.
Then another.
Grant asked who would pay for the emergency forensic time if the board later narrowed the dispute.
Daphne said WMG had not approved an open-ended vendor engagement.
The question landed on me because the logs would disappear before a budget vote could finish.
Northline finance had warned that the procurement pause threatened our reserve. I could fund a defined capture, not WMG's investigation.
“Northline will guarantee the reasonable cost of tonight's limited capture and transfer,” I said. “No review, no expansion, and no access rights for me.”
Dana entered those limits in writing while I spoke.
Grant demanded a ceiling.
I named one that would postpone two Northline contractor payments I had planned to authorize Monday without touching payroll.
That was a business loss I could measure, not proof of anyone's motive.
The countdown showed thirteen minutes.
Marcus generated the calendar snapshot first and sealed it read-only.
The gateway export followed, limited to transaction records already named in L03 and the preservation notice.
Badge-access events entered a separate encrypted container.
The portal activity took longest because the vendor interface warned that its nightly rotation could not be reversed after the batch began.
At six minutes, the progress bar stopped at ninety-two percent.
No one filled the silence with a theory.
Marcus opened the error detail, confirmed one duplicate event, and restarted only the failed segment.
Daphne refused Grant's suggestion to abandon the portal row and preserve the accepted systems alone.
“The disputed exclusion is exactly why the directory must show what was captured and what was not,” she said.
With two minutes remaining, the final container closed.
Marcus generated a hash value for each read-only snapshot and a master hash for the directory.
He transferred the encrypted set to the independent custody account named in Daphne's authorization.
WMG retained the custodian receipt. Daphne received the directory and hash list.
Dana received only a copy of that directory, the matching hash values, and the signed cost limitation.
Nothing on our screen opened the captured content.
Pride would have been another form of carelessness.
We had preserved the chance to ask lawful questions later; we had not won the answers.
At 6:02, Marcus's rotation panel showed the normal batch completing around the preserved containers.
Daphne placed the snapshot directory on the emergency meeting agenda for that evening, where WMG would have to acknowledge the January 11 meeting and explain the preservation scope in writing.