The thieves then went to work.
The motion detection system inside the museum recorded their movements on a printout, giving investigators a detailed timeline of where they went and when. This evidence, which survived because the thieves took the video surveillance footage but not the motion sensor log, became one of the foundational documents of the investigation.
The printout showed that the two men spent most of their time on the second floor, primarily in the Dutch Room and the Short Gallery. They worked efficiently. Large canvases—*The Storm on the Sea of Galilee* and *A Lady and Gentleman in Black*—were cut from their stretchers, a method that would allow the large paintings to be rolled or folded for transport but that also carried real risk of damaging the paint surface and canvas. *The Concert* was also cut free. The Flinck came off the wall. The Degas pieces came out of the cabinets. The Chinese bronze beaker was taken from its position in the Dutch Room.
One brief anomaly: the thieves removed a Rembrandt self-portrait—not the tiny etching, but a larger painted version—and then, apparently, set it down and left it. It was found on the floor afterward. Why they took it and changed their minds is not known.
After the Dutch Room and the Short Gallery, one of the thieves went to the first floor for *Chez Tortoni*. Then they gathered what they had and left. The motion sensor log places their departure at approximately 2:45 a.m. They had been inside for 81 minutes.