Medium Deduction #6
00:00
The Case
A company's backup server was wiped between 10 PM and 10:30 PM. The wipe required physical access to the server room and admin-level credentials. Four employees were still in the building: Aisha (engineering), Derek (security), Tomoko (system admin), and Raj (sales). Case file MEDIUM-006.
Who wiped the server?
Evidence (6)
#1Only Aisha and Tomoko have admin-level server credentials.
#2Aisha was on a recorded video call with a client from 9:45 PM to 10:20 PM. Her screen was shared the entire time.
#3Derek was stationed at the lobby front desk. Lobby camera footage confirms he didn't leave until 10:35 PM.
#4Raj claims he was in the parking garage, but the garage key-card log shows no entry between 9 PM and 11 PM.
#5Tomoko says she was in the third-floor break room. The break room is next door to the server room.
#6The server room door requires a key card. Only admin-credentialed employees have server room access.