Chapter 8 - The Recovery File
Gabriel North had discovered abuse of Node Four before anyone else.
Forensic team found hidden recovery partition.
Not malware.
Audit backup.
North configured system to retain immutable copy of every administrative change whenever emergency credentials were used.
Harbor executives didn't know.
Or most didn't.
That meant original records survived.
Raven Four were never truly erased from source data.
Altered versions propagated to downstream systems.
North preserved before-and-after states.
He also preserved user-session telemetry.
Not enough identify person immediately.
But enough prove manipulation deliberate.
At 02:14 after explosion, someone logged into command trailer using Mason smart card.
At 02:17 Shaw override requested.
At 02:18 Vane root approved.
At 02:21 four Raven personnel were flagged:
TEMPORARY EXTERNAL WITNESS HOLD.
That label itself legitimate.
At 03:04 somebody changed it to:
NOT ASSIGNED — DATA CORRECTION.
That was fraudulent step.
At 03:11 Rachel’s participation status changed:
PENDING MEDICAL INTERVIEW.
At 05:42:
DECLINED.
Rachel was unconscious at 05:42.
There was proof.
Then user opened procurement manifests Raven Twelve had questioned.
Three equipment shipments were reclassified.
Total disputed value:
$2.8 million.
Not massive secret fortune.
Enough to destroy careers.
The money had not vanished into private account.
It shifted between government-funded contract categories, allowing Harbor Response to bill equipment replacement twice after emergency redeployment.
Later internal settlement quietly refunded $1.9 million after auditors challenged.
Remaining difference disputed.
So motive was corporate liability and reputational protection.
Who benefited personally?
Possibly executives through performance bonuses.
Shaw received bonus that year.
Vane did too.
But neither alone explained credential session.
Then recovery file contained typed note from North:
IF YOU ARE READING THIS, DO NOT ASSUME PERSON USING ROOT IS VANE. ROOT TOKEN IS STORED IN RED SAFE, FIELD OFFICE B.
Who accessed safe?
Camera destroyed during depot blast.
Access log paper.
Rachel remembered red safe.
It sat in Harbor field office beside medical coordination room.
She had seen Mason open it.
Mason admitted.
“Why?”
“Backup radios were stored beneath it.”
“Did you know root token was inside?”
“No.”
Brooks asked who else knew combination.
Mason.
North.
Vane.
And field operations deputy:
COLONEL PETER SLOAN.
Rachel went still.
Sloan had been Raven Twelve’s military administrative supervisor.
He retired in 2020.
He was also man who personally informed Rachel that four teammates had transferred.
Current residence:
Arlington, Virginia.
Investigators arrived.
Sloan opened door calmly.
He denied everything.
Then Brooks showed Node Four logs.
His confidence held.
“Those logs identify credentials, not human being.”
True.
Rachel asked:
“Did you remove our names?”
“No.”
“Did you tell me they transferred?”
“Yes.”
“Why?”
“Because that's what I was told.”
“By whom?”
Sloan paused.
“Mason.”
Mason exploded when confronted.
“I never gave that order.”
Two senior officers now accused each other.
Then North recovery partition yielded scanned paper.
A handwritten note authorizing witness separation.
Signature:
MASON REED.
Forensic handwriting expert gave preliminary opinion:
likely genuine.
Rachel looked at Mason.
He stared at signature for a long time.
Then whispered:
“I signed something that night.”
“What?”
“A medical evacuation authorization.”
May you like
His eyes widened.
“It had a second page.”
