This walkthrough gives the answer away on purpose. Read it once to learn how the evidence works, then play a fresh case for real.
Ardent Marine Engineering
Engineering change orders were quietly altered, then the originals were exfiltrated to an overseas distributor.
CLUE 1
How you surface it: Pull endpoint software inventory and compare against approved builds.
Why it points at the insider: Shadow IT on managed endpoints is a standing exfiltration channel; inventory is a detection tool.
CLUE 2
How you surface it: Reconcile the document register against the actual document set.
Why it points at the insider: Tampering leaves holes. Integrity checks catch what content inspection misses.
CLUE 3
How you surface it: Review network egress volume per host over time.
Why it points at the insider: Steady, low-and-slow egress beats bursty theft at hiding — unless you baseline volume.
CLUE 4
How you surface it: HR-supported review of policy-permitted records, with legal guidance.
Why it points at the insider: Relationships explain motive. Gather them lawfully or you lose the case.
Rosalind Ferrer is the insider. Motive: Loyalty to a mentor pushed out in last year's layoffs. Method: A personal cloud sync folder mirroring the document-control share.
Timeline: Day -120 mentor terminated; Day -75 sync client installed during a laptop refresh; Day -60 onward continuous mirror; Day -20 change orders edited to hide a revision gap; Day 0 distributor surfaces the originals.