It was supported by physical evidence, original records, access logs, and witness statements.
At the Pentagon, the cybersecurity team completed its initial review.
The access attempt from Colonel Grant's account had originated from a workstation assigned to his office.
The account had also accessed the Redhaven inspection schedule several days earlier.
The team compared the login time with the email Patricia had provided.
The timing matched.
A technical officer prepared a report.
SPECIALIST: "Colonel Harris, we have a verified access history."
Harris read the summary.
"Was the schedule downloaded?"
"Yes. The system shows an export request three days before General Ellison's inspection."
"Who initiated it?"
"The account was assigned to Colonel Michael Grant."
Harris looked at the report.
"Can we establish whether he was physically at the workstation?"
"The workstation authentication indicates that the request came from his office terminal. We are still checking the device records."
Harris nodded.
"Preserve everything."
The specialist left.
Harris called the investigative director.
He explained the findings.
The director instructed him to ensure that Grant's access was restricted while the investigation continued.
Harris did not want to make a premature accusation.
But he also could not allow an account connected to the disputed transfer to remain unrestricted.
The access restriction was implemented.
At 10:42 p.m., Colonel Michael Grant received a notification that his account privileges had been temporarily suspended pending review.
He immediately called the logistics command.
COLONEL GRANT: "Why has my access been restricted?"
The duty officer answered.
"Colonel, the restriction was authorized by the investigative director."
GRANT: "On what basis?"
"An active review involving the Redhaven equipment transfer."
Grant paused.
"I have nothing to do with that transfer."
The duty officer remained neutral.
"You will be contacted through the appropriate channel."
Grant ended the call.
He sat in his office.
Then he opened his personal phone and searched for Charles Bennett's number.
He stared at the contact for several seconds.
Finally, he called.
The call went unanswered.
He tried again.
Nothing.
Grant placed the phone down.
For the first time, he realized that the people who had asked for his assistance might no longer be willing to protect him.
At 11:15 p.m., Thomas Bennett received confirmation that the remaining two containers had been located.
They were at a second storage facility.
The address matched the destination in the warehouse system.
The investigators obtained the necessary authorization and secured the location the following morning.
The two containers were still sealed.
Their serial numbers matched the original inventory.
All six containers were now accounted for.
The next stage was determining who had arranged the movement, who had approved the false paperwork, and whether anyone inside the federal logistics operation had knowingly assisted the contractor.
Marcus returned to Washington the following day.
He attended a formal briefing with Colonel Harris, the investigative director, and the senior logistics officers.
He was wearing his military uniform.
His three-star insignia was clearly visible.
But he did not use his rank to dominate the discussion.
He placed the evidence summary on the table.
MARCUS: "The immediate objective is complete. All six containers have been located and secured."
The investigative director nodded.
"Any equipment damage?"
"Two containers had been opened. The technical team is conducting a full inspection. We have not yet established whether any components are missing."
Harris displayed the access records.
COLONEL HARRIS: "We also have evidence that the Redhaven inspection schedule was accessed before the general's arrival."
Marcus looked at the screen.
"By Colonel Grant's account?"
Harris nodded.
"Yes."
Marcus remained quiet.
The director spoke.
"We have placed Grant's access privileges under temporary restriction. He will be interviewed as part of the investigation."
Marcus nodded.
"Then the process should be followed."
The director looked at him.
"General, do you have any personal concerns regarding the way the inspection was handled?"
Marcus thought for a moment.
"My concern is that the equipment was almost removed without proper authorization, and the person assigned to verify its location was detained before completing the inspection."
The director nodded.
"Understood."
Marcus continued.
"I also want the local law enforcement incident included in the review. The arrest report did not accurately describe the circumstances."
Harris looked toward him.
"We have the body-camera footage and dispatch records."
"Good. Preserve them."
The director closed the file.
"We'll include the local incident in the final findings."
The briefing continued for another hour.
The team reviewed the inventory discrepancies, the warehouse records, the contractor communications, and the possible internal access breach.
By the end of the meeting, the investigation had been divided into three parts.
The first concerned the unauthorized removal of government equipment.
The second concerned the use of false transfer documents and possible financial misconduct.
The third concerned the disclosure of confidential inspection information.
Each part would be examined separately.
Marcus left the room with a copy of the preliminary findings.
He knew the investigation would take time.
But he was satisfied that the evidence had finally been secured.
Over the following weeks, investigators interviewed employees from Redhaven Transportation Services.
Daniel Price, the warehouse employee Patricia had identified, eventually agreed to cooperate.
He explained that Charles Bennett had instructed him to prepare the truck and move the containers.
Price said he had been shown a document that appeared to authorize the transfer.