Scope
Forensic snapshot of workstation RMEHT-CEO-DESK taken at time of initial scene examination (Friday 01:14). Captures active processes, open files, recycle bin contents, and browser cache as they existed at the point of imaging.
Active Files at Time of Imaging
| Filename | Application | Last Modified | Status |
|---|
| BoardPreso_FraudEvidence_FINAL_v3.pptx | Microsoft PowerPoint | Thursday 22:58:11 | Open — unsaved changes |
| IP_Audit_WorkingNotes.docx | Microsoft Word | Thursday 21:33:44 | Open — saved |
The primary presentation file was last modified at 22:58 — after which no further edits were recorded. At this time, Rohan Mehta's workstation shows no further user-initiated activity.
Recycle Bin — Items Present at Imaging
| Filename | Original Location | Deletion Timestamp |
|---|
| aro_nexusBridge_screengrab_annotated.png | Desktop\Evidence_Drafts\ | Thursday 22:31:04 |
A screenshot file — annotated by the user — was deleted from the victim's own machine at 22:31. The deletion timestamp falls within the period when another individual's keycard was logged on the same floor. The file has not been recovered; only the directory metadata persists.
Browser Cache — Search Activity — Thursday
| Time | Search Term (Reconstructed from Cache) |
|---|
| 09:11 | PaySpark quarterly API egress anomalies 2024 |
| 11:47 | how to file corporate fraud complaint SEBI India whistleblower |
| 14:03 | Alprazolam detection urine blood how long |
| 20:52 | [CACHE PURGE EVENT — all prior browser history cleared at this timestamp] |
The browser history purge at 20:52 was executed from the active session on this machine. At 20:52, the floor access log shows only one person on Floor 14. The search at 14:03 is anomalous relative to the fraud investigation context and has been flagged for review by the medical examiner's office.