The gap begins before the session started.
This is the first thing a good trace analyst learns to check.
Abena had run the second pull at 7:14 AM, the way she ran everything — methodically, without expecting anything she hadn't already prepared for. The first pull had returned three missing events. The second pull confirmed them missing. A third pull would confirm the same thing, and she had learned, over six years at Meridian Forensics, that running a third confirmation was the most expensive thing a trace analyst could do: expensive in time, expensive in credibility if the client found out, expensive in the particular way that doing unnecessary work becomes a habit that eventually catches you.
She ran the third pull anyway.
The three events were still not there.
The session in question was case 7-Theta: a contested attribution claim from a small exhibition in the Circuit Mile, filed by an artist named Lim who alleged that another artist — name withheld per Meridian's pending-investigation policy — had used a process sleeve derived from Lim's uncertified recordings without authorization. The claim had come to Meridian because the Felt certification board didn't have jurisdiction over uncertified recordings, which meant the only way to contest the attribution was through a private forensics firm with access to the raw exchange data.
Abena was the analyst assigned to trace the derivation chain. Three missing events was a problem because the derivation model required a complete event sequence to reconstruct causality. You couldn't say this recording came from that one without knowing what happened at every step. Gaps were not neutral; gaps were arguments — someone could use them to contest any finding she produced.
She pulled up the session metadata and looked at the timestamps again.
The official start timestamp for the case session was 14:32:07. The three missing events fell between 14:31:44 and 14:32:05 — twenty-three seconds that existed before the session officially began, in a window she would not have thought to check if the gap hadn't forced her backward.
She opened the raw sensor logs request form. Not the standard trace log request — the raw sensors, the pre-processed data stream that existed before the event parser had done its work. The form had a field labeled Justification for Pre-Start-Timestamp Access, which implied that other people had needed to do this before her, which was either reassuring or concerning, and she chose to treat it as reassuring.
She wrote: Three events missing from case trace. Gap falls in 14:31:44–14:32:05 window, before official session timestamp. Requesting raw sensor data for 14:30:00–14:32:30 to determine whether events were never written or were written and dropped during ingestion.
She submitted the form and noted the timestamp: 07:41 AM.
At 11:06 AM the raw sensor data came back.
Abena had spent the intervening hours on two other cases — a straightforward provenance trace for a gallery acquisition, and a more complicated one involving an exchange platform that had changed its indexing protocol midway through the relevant period, which meant the event sequence existed but the timestamps had shifted in a way that required manual realignment. She had done the realignment and documented the method, because if you didn't document the method it didn't exist, and if it didn't exist you couldn't defend it, and if you couldn't defend it the finding was worthless.
The raw sensor data for 7-Theta was 847 kilobytes. She opened it in the trace environment and searched for the fourteen-minute window around the session start.
The three events were there.
Not missing — present in the raw stream, complete, with valid timestamps and checksums. They had been written. They had simply never made it into the event parser. The gap was not in the data; the gap was in the ingestion step, somewhere between the raw capture and the session log.
This was a different problem than she had expected. A missing event might mean it never happened — the recording session had a moment that went unrecorded, and you were left with a genuine evidentiary gap. An event that existed in the raw stream but not in the log was a system failure, not an evidentiary one. The events happened. The system lost them. This was, in one sense, better: she could reconstruct the sequence from the raw data and proceed with the derivation trace. In another sense, it was worse: it meant the chain of custody for the case evidence had a documented break in it, and the opposing party's attorney, if there was one, would know how to use a chain-of-custody break.
She pulled the three events out of the raw stream and annotated each with the discrepancy documentation: raw timestamp, log timestamp (absent), checksum, data integrity status (intact), recovery method (direct extraction from pre-processed stream).
Then she wrote a case note:
Events R7T-001, R7T-002, R7T-003 recovered from raw sensor stream. Events present and intact in raw capture but absent from session log, indicating ingestion failure at event parser layer. Recovery method documented above. Chain-of-custody notation: events reconstructed rather than directly logged; documentation attached. Derivation trace can proceed on reconstructed sequence subject to opposing party's right to contest reconstruction methodology.
She flagged the case note for the supervising analyst, Kwame, who would need to decide whether to disclose the reconstruction to Lim's attorney before proceeding. This was not her decision. She had found the events, documented the gap, explained the recovery. The question of what to do with a recoverable but reconstructed evidence chain was above her pay grade in a specific and appropriate way.
At 1:30 PM Kwame stopped by her station.
He was the kind of supervisor who appeared in person for things he could have sent by message, which Abena had initially interpreted as inefficiency and later understood as intentional. Things that arrived in person were things you couldn't ignore or defer. You had to respond immediately, in real time, without the option to draft and revise.
"The 7-Theta reconstruction," he said. "Tell me the methodology."
She told him. Raw sensor request, pre-start-timestamp window, direct extraction, checksum verification, documentation. He listened without interrupting, which was either a good sign or a sign that he was preparing a difficult question.
"The opposing party's going to say you could have put anything in those twenty-three seconds," he said.
"Yes."
"What's your answer to that?"
"The checksums are consistent with the session's other events. The data format matches. The timestamps fall in a range that makes physical sense for the activities being recorded. I didn't choose what to extract — I extracted everything in the window and documented all of it, including events that weren't relevant to the derivation trace." She paused. "The opposing party can say I could have put anything there. The documentation says what I actually put there and why. That's the distinction."
Kwame nodded. Not approval, exactly — more like acknowledgment that she had said the thing that needed to be said and said it clearly.
"I'll disclose to Lim's attorney before we proceed," he said. "You'll need to be available to explain the methodology if it gets contested."
"I know."
He left. She turned back to the derivation trace, which now had a complete event sequence and a documented chain-of-custody gap and a supervising analyst who knew about both. The case was more complicated than it had been at 7:14 AM. It was also, now, on solid ground — or as solid as ground got when three events had to be pulled out of a raw sensor stream because the ingestion layer had lost them somewhere between capture and log.
She opened the derivation model and began the trace from the beginning, with the reconstructed events in their proper place in the sequence.
The work was the same as it would have been without the gap. You found the chain, you documented the chain, you explained what you found and how you found it and why the explanation was trustworthy. The gap was part of the documentation now. It was not an absence; it was a piece of evidence about how the evidence had been gathered.
She had learned this slowly, over six years: that the methodology was not separate from the finding. The methodology was the finding. A result you couldn't reconstruct was not a result. A gap you couldn't explain was not a gap — it was a fabrication waiting to be named.
The three events sat in the reconstructed sequence. She checked the checksums one more time and began.
The derivation trace for case 7-Theta took four hours.
Abena had expected two. The recovered events changed the picture in a way she hadn't anticipated: they weren't incidental to the derivation chain, they were the derivation chain. The three events in the pre-start window contained the transfer signature — the moment when the uncertified recording from Lim's session had moved into the space where the disputed sleeve was created. Without them, the trace went nowhere. With them, it went exactly where Lim said it went.
She documented this finding carefully. The derivation is established by events R7T-001 through R7T-003, recovered from raw sensor stream as documented in case note filed 07:41 AM. She did not write: The case is clear. She did not write: The other artist took Lim's recording. She wrote what the evidence supported and stopped there, which was the whole job.
At 5:47 PM she flagged the completed trace for Kwame's review and closed the case file.
She sat at her station for a moment after closing it. The Circuit Mile was visible from the Meridian Forensics building, three blocks south — not the exhibition where the attribution dispute had started, but the street itself, the long corridor of galleries and exchange storefronts and the occasional uncertified session space operating without a certification seal. She could see it from her desk if she turned her chair. She usually didn't turn her chair.
The other artist had taken Lim's recording. The evidence was clear enough that she could see the shape of it even through the careful language of the case note. A certified process sleeve derived from an uncertified recording, the transfer happening in twenty-three seconds that the session log had lost and the raw sensor stream had kept. Someone had banked on the session log being the record of record. They had been almost right.
Almost was the operative word in forensic trace work. The whole field existed in the space between almost and not quite: recordings that almost covered their tracks, systems that almost captured everything, analysts who almost missed the pre-start-timestamp window. Abena had almost not run the third pull. She had almost filed the second-pull result as confirmation and moved on. She had almost treated the absence as an evidentiary gap rather than a recovery problem.
The difference between almost and not quite was the methodology. You documented the method because the method was what stood between your finding and someone's ability to say you had invented it. In a field where the evidence was recorded experience — what someone felt, what a sleeve claimed to carry — the stakes of fabrication were particular. Not just professional or legal. Personal. Lim's uncertified recording was Lim's process. The claim was that someone had taken it and sold it as a derivative product, which meant someone had taken the phenomenological signature of Lim's creative experience and monetized it without permission. That was the allegation. The trace confirmed it.
Abena turned her chair toward the window for thirty seconds. Then she turned it back.
She checked her other two cases before leaving.
The gallery acquisition trace was straightforward — provenance clean through six ownership transfers, no gaps, no reconstruction required. She filed the finding and closed the case.
The exchange-platform realignment was messier. The timestamp shift had propagated further than she'd initially mapped, which meant three more events needed manual alignment and documentation. She worked through them methodically, each one requiring the same steps: identify the shift, calculate the offset, apply the correction, verify the correction against the surrounding context, document the method.
By 6:30 PM she had two of the three additional events realigned. The third was more complex — the timestamp shift changed direction mid-sequence, which was unusual and meant the indexing protocol change had happened mid-session rather than between sessions. She made a note: Protocol change occurred during active session. Timestamp offset non-uniform. Additional analysis required to establish alignment confidence interval. She flagged it for the next morning rather than staying to finish it now.
She logged out of the trace environment and collected her things.
On the way out she passed Kwame's office. His door was open. He was still at his desk, which was not unusual — he stayed late most evenings, for reasons she had never asked about.
"7-Theta looks solid," he said, without looking up from his screen.
"Thank you."
"The opposing party's attorney is going to push back on the reconstruction methodology. You know that."
"I know."
"When they do, the answer is exactly what you told me this afternoon. The checksums, the data format, the complete extraction with documentation. Don't elaborate beyond what's in the case note."
She had already known this. The instruction was not new information. But Kwame gave it anyway, in person, which meant he had decided it was the kind of thing that needed to be said rather than assumed. She had learned to trust this instinct even when the content was redundant.
"I'll be prepared," she said.
He nodded. She left.
The bus home crossed the Circuit Mile at 6:47 PM.
Abena looked out the window as it passed. The galleries were closing — not all of them, but the certified ones that kept standard hours. The exchange storefronts were staying open, which was their nature. You could trade process recordings at midnight if you wanted to, in the unlicensed spaces that operated without certification seals or duration caps.
Somewhere in the Circuit Mile — she didn't know which space, the case note hadn't specified — twenty-three seconds of Lim's creative process had moved from one recording to another without authorization. The transfer had happened in a pre-start window that the session log had lost. The raw sensors had caught it anyway, because raw sensors caught everything before the event parser made decisions about what to keep.
The system that lost the events was the same system that had caught them. Abena thought about this for most of the bus ride.
The event parser was designed to filter noise — to take the raw sensor stream, which captured everything the hardware could register, and produce a clean log of meaningful events. Meaningful was a parameter someone had set. The pre-start window had been defined as noise: events that occurred before the session's official start timestamp were, by design, not part of the session record. The parser had done its job. It had filtered out the three events because the three events were in the wrong time window.
The filter was correct and the filter was wrong simultaneously. Correct because the pre-start window was genuinely not the session. Wrong because the three events had been genuine evidentiary content that the session's official timestamp had failed to contain. The system had made a structural decision about what counted, and the decision had been almost right — right enough that if Abena hadn't run a third pull, if she hadn't noticed that the gap started before the session rather than inside it, if she hadn't thought to request the raw sensor data for a window before the official start, the events would have stayed lost.
Almost right was how most failures happened. Not through malice. Not through obvious error. Through a reasonable decision that turned out to be slightly wrong in a situation where slightly wrong was enough.
She got off the bus at her stop and walked the two blocks home. The evening was cold and clear. The Circuit Mile was behind her now, out of sight.
In the morning, the 7-Theta case would go to Kwame for final review. The three recovered events would sit in their annotated positions in the reconstructed sequence. The chain-of-custody documentation would be attached. The opposing party's attorney would receive disclosure and have the opportunity to contest the reconstruction methodology, and Abena would be prepared to explain the checksums and the data format and the complete extraction with documentation, in exactly the language she had used with Kwame that afternoon.
The finding would be what it was. She had traced what the evidence showed and stopped there.
The gap had been the way in. She had not gone looking for it — it had found her, backward through the trace, forcing her into the pre-start window where the three events were sitting in the raw stream, intact, waiting for someone with enough patience to look in the right place.
She unlocked her door and went inside. The case file was closed. The methodology was documented.
The trace was done.