In early 1911, Peruggia began planning the theft. The timeline of his planning is not fully established from the documented record. What is known is that by the morning of Monday, August 21, 1911, he was inside the Louvre with a plan.
He entered the museum on Sunday, August 20, while it was still open to workers and personnel. Some accounts say he hid in a supply closet overnight. Other accounts suggest a less dramatic entry early on the Monday morning when workers arrived. The Tuesday theft-discovery date, combined with the Monday morning timing most sources converge on, is consistent with either version. What is established is that by the early morning hours of August 21, he was in the museum wearing a white worker’s smock of the kind worn by maintenance staff throughout the building.
He went to the Salon Carré.
He lifted the Mona Lisa off its four iron hooks.
He took it to a service stairway, where he removed it from its glass protective case and its frame. The case and frame were found later in that stairway. He wrapped the wooden panel under his smock or coat.
At some point during his attempt to exit, he found a door locked — a service exit he had intended to use. A plumber working in the museum that morning, whose name appears in the record as Sauvet, opened the locked door when Peruggia indicated he needed to get through. The plumber later confirmed this in the police investigation. He had no reason to suspect anything unusual about a worker in a smock at a service door on a maintenance morning.