Chapter 45: The Missing Backup
The independent technology reviewer found a gap in our backup retention schedule.
A storage migration had left several months of access logs in an archive that normal administrators rarely opened.
Those logs could help establish who used particular systems before Marcus left.
The reviewer advised us to preserve the archive before investigating further.
We engaged a qualified forensic specialist to examine a protected copy.
The specialist explained that recovered timestamps could identify actions without proving the identity or intention of the person performing them.
I appreciated the caution even though it slowed our understanding.
The archive contained exports from several employee accounts.
Some were legitimate backups.
Others appeared to involve customer images outside normal job requirements.
Marcus’s account appeared repeatedly in the questionable activity.
A separate administrative account had also been used.
That discovery forced us to consider whether someone else knew about the exports.
The specialist recommended comparing the events with physical access records and verified employee schedules.
We followed the recommendation.
The results eventually helped investigators distinguish unauthorized activity from routine maintenance.
They also showed how close we had come to losing evidence simply because our archive procedure was poorly documented.
I added a line to the new technology policy requiring regular restoration tests.
A backup that could not be located when needed was little better than no backup at all.
Chapter 46: Leah’s Question
Leah asked me one evening whether I still enjoyed running Northline.
We were sitting on the back porch after Sophie went to bed.
The air was warm, and the neighborhood had finally become quiet.
I told her I enjoyed serving customers and working with our staff.
I did not enjoy reviewing legal invoices after midnight.
She nodded.
“Then stop making the case the center of your business,” she said.
I explained that the investigation affected everything we did.
She did not disagree.
She asked whether I had delegated enough work to the people I hired because I trusted them.
I realized that I had begun personally approving minor purchases and reviewing every customer complaint.
My employees were waiting for decisions I could have authorized them to make.
Leah said she understood why betrayal had made me cautious.
She also said caution could become its own form of damage if I refused to trust anyone again.
We talked for nearly an hour about responsibilities, limits, and the kind of home life we wanted.
The next morning, I restored ordinary decision-making authority to my managers under the revised safeguards.
I scheduled weekly review meetings instead of interrupting employees throughout the day.
The change improved the shop almost immediately.
It also allowed me to attend Sophie’s soccer practices without taking work calls from the sidelines.
Leah did not claim credit for the improvement.
She simply smiled when she saw me leave the phone in the car.
