Under "Scheduled Backups," there was a custom script: 3am_backup.sh . Its last run: 3:14 AM, the night of his death. The backup destination: a hidden FTP server.
But the filenames were wrong.
Rohan’s reply: "I already posted the real images. Off-campus. It’ll auto-publish in 12 hours if I don’t disable it. Let’s call that insurance." ALTERED IMAGES - DU Blogspot POST.rar
Maya connected to that server using credentials Rohan had embedded in the script. Inside: scanned receipts, encrypted chat logs, and a single video file: DEAN_MEETING_3_14_AM.mp4 . Under "Scheduled Backups," there was a custom script: