Expert Deduction #15
00:00
The Case
A threatening email was sent to the CEO at 9:37 PM from inside the company network. The email originated from IP 10.4.12.88, which maps to the fourth-floor Wi-Fi access point. Five employees were in the building: Ines, Jun, Cora, Andre, and Sonja. Case file EXPERT-015.
Who sent the threatening email?
Evidence (9)
#1The email was sent at 9:37 PM from IP 10.4.12.88, mapped to the fourth-floor wireless access point.
#2VPN logs show zero remote connections at that time. The sender was physically in the building.
#3Badge records: Ines entered the fourth floor at 9:30 PM. No other fourth-floor badge entries between 9 and 10 PM.
#4Jun badged into the third floor at 9:15 PM and exited at 10:00 PM. Third floor has a different access point (10.3.x.x).
#5Cora's exit was logged at 8:45 PM. The door system shows no re-entry.
#6Parking garage camera shows Andre walking to his car from 9:30 to 9:45 PM.
#7Lobby camera shows Sonja waiting for a delivery from 9:20 to 9:50 PM.
#8Ines's laptop was the only device connected to the fourth-floor access point at 9:37 PM (DHCP log).
#9Ines was passed over for promotion in favor of the CEO's hire two weeks ago.