____________Raiden______________
The config files you scan appear to have been edited and re-edited repeatedly, and as ryu crossmatches the documents for you, you can see there is a pattern beginning to emerge.
There is an <<Admin 121>> connection from <<Unknown Node>> a few minutes before the camera configuration file is changed for both devices. Once the camera configuration has been changed, a minute or so after that, the lift controller is activated.
Some time after this, the lift controller is activated once more, and the camera control process is then restarted, and the config file reverted to its original settings.
This pattern runs for weeks, and at least one event like this has been recorded every week.
They've clearly made an effort to conceal their data trail, but the date and timestamps on each file definitely create a pattern.
Some good rolling there ;-)