Chapter 14 - ARCHIVE C
I bought Covenant Trace for its engineers.
Not its old files.
The company was small.
Eight employees.
Excellent forensic tools.
Its founder, Charles Mercer, died from a stroke during acquisition negotiations.
His estate completed sale.
Legal hold data moved into my company’s cold archive.
I never opened most.
Archive C existed because one client dispute remained potentially discoverable.
Twelve years earlier, Covenant Trace investigated suspicious access at several defense suppliers.
Project name:
Patriot Continuity.
Not necessarily Margaret’s nonprofit.
Could be coincidence.
Then metadata:
Client contact, Margaret Sloan.
No coincidence.
Margaret had hired Covenant Trace.
Why?
Her foundation claimed one of its donor systems was breached.
Covenant discovered something else.
Foundation servers contained copies of procurement contact lists that should never have been there.
Charles Mercer prepared report.
Margaret disputed.
Threatened litigation.
Case settled confidentially.
Final report sealed.
Covenant retained forensic image under legal hold.
When I bought company, I inherited custody.
Margaret knew?
Likely.
She may have watched acquisition.
Five years ago.
Before baton.
Before Ryan’s discharge.
Before Evelyn’s demands.
That changed everything.
Why had she not simply ask for deletion?
Legal hold prevented.
Why target me through Ryan years later?
Because my company controlled archive and I was married to someone she could reach socially.
Maybe she waited for opportunity.
Then Archive C access required:
Executive authorization.
Legal approval.
Legacy archive token.
My secured phone could satisfy executive authorization.
So the “master token” plan was really about Archive C.
Current procurement data was bonus.
The baton provided leverage and a way to manipulate Ryan.
The old certificate story gave technical cover.
Margaret had built a layered plan around removing one old forensic report.
What was in it?
With counsel approval, investigators reviewed.
Covenant’s report found no evidence Margaret herself stole data.
Important.
Instead, a contractor account uploaded procurement contact lists into foundation server.
Account owner:
Nolan Trent.
Lucas Trent’s father.
He died seven years ago.
Lucas may have inherited problem.
Then another user:
Gavin Cole.
Twelve years ago, Gavin had already worked with Patriot Continuity as IT contractor.
This network predated Fort Cavazos project.
Gavin later entered Army modernization contract.
Used access.
Same methods.
Margaret’s foundation became meeting ground.
Did Margaret know stolen data existed?
Covenant report:
Likely yes after internal warning.
Did she report?
No.
She ordered deletion.
Covenant preserved copies.
Why?
Legal duty.
That was Archive C.
Then one email from Margaret twelve years ago:
Destroy every duplicate before this becomes a federal matter.
There.
Not proof she created theft.
Proof she wanted evidence gone.
Then:
Charles Mercer:
I will not destroy forensic material.
Margaret:
Then I will destroy your company.
Months later, Covenant lost major clients.
Was that Margaret?
Unknown.
Charles survived another seven years.
Then sold to me.
Maybe he intentionally chose my company because of my reputation.
His acquisition letter contained a personal note I had never read.
Lisa,
If you ever open Archive C, it means someone finally came back for it.
My hands went cold.
He expected.
Then:
Do not trust the charity names. Follow the contractors.
Good advice.
Contractors:
Gavin Cole.
Nolan Trent.
Later Lucas Trent.
Several others.
One current name:
Peter Lawson.
The escrow adviser.
He had performed security work for Patriot Continuity eleven years ago.
Lawson had not disclosed.
When confronted, he admitted.
“I forgot.”
Maybe.
His role was minor.
But Margaret knew him long before she asked about my certificates.
Again, she was recruiting familiar people.
Then Charles’s note:
One contractor is not in my report because I could never prove his identity.
Alias:
R.W.
My stomach dropped.
Ryan Walker?
Impossible.
Twelve years ago Ryan was young active duty.
Could be.
But initials common.
Archive login showed R.W. accessing donor system from Fort Hood era network.
Ryan was stationed elsewhere then.
Not him likely.
Good.
Do not force.
Then a recovered voice memo from Charles:
“R.W. is probably not Walker. Stop making names fit initials.”
I almost laughed.
The dead man corrected us.
Then full alias:
Raven White.
A contractor handle.
Unknown real identity.
That person uploaded first procurement list into Patriot Continuity server.
Before Gavin.
Before Lucas.
The origin.
Charles could not identify.
Then current baton files contained one reference:
RW SOURCE STILL ACTIVE.
Not Ryan Walker.
Raven White.
Gavin had reused RW abbreviation.
We had misread some notes.
Suddenly RW WILL HOLD ITEM UNTIL DEBT CLEARED?
That was Ryan, context showed.
But other RW references may belong Raven White.
This case had been hiding behind initials.
Then the final Archive C file:
RAVEN_WHITE_CONTACT_2024.
Recent.
Someone had contacted Covenant archive system two years ago.
After acquisition.
From inside my company.
User:
LISA.GRANT.
My account.
I had not done it.
May you like
Someone inside Grant Secure had been impersonating me long before Ryan ever opened my safe.
Continue to the next part: Archive logs show Lisa’s identity was used to search for “Raven White” years before Ryan began stealing her credentials.
