Two employees were already working at separate terminals. One was reviewing the access logs, while the other examined the system's backup history.
Evelyn stood behind them.
EVELYN CARTER: "Before you restore anything, create a forensic copy of the current system state."
JAMES PORTER: "We can do that."
EVELYN CARTER: "I want the timestamps, file identifiers, user credentials, and transfer history preserved."
JAMES PORTER: "Yes, Colonel."
General Harrington looked toward the employees.
GENERAL MICHAEL HARRINGTON: "Has anyone else accessed the archive since the incident was reported?"
One technician shook his head.
TECHNICIAN: "The system has been restricted to the recovery team. No other account has been granted access."
GENERAL MICHAEL HARRINGTON: "Good. Keep it that way."
Evelyn moved closer to the main screen.
A list of folders appeared.
Some were labeled with procurement reference numbers. Others contained supplier communications, laboratory results, and internal approval documents.
The original assessment folder was marked as having been accessed at 2:41 p.m.
Beneath it, a second entry showed that the document had been moved.
EVELYN CARTER: "Who initiated the transfer?"
The technician enlarged the access record.
TECHNICIAN: "The request originated from terminal R-17."
EVELYN CARTER: "Where is that terminal?"
JAMES PORTER: "The regional director's private office."
GENERAL MICHAEL HARRINGTON: "Who was assigned to that office today?"
James checked his records.
JAMES PORTER: "Deputy Director Samuel Price."
Evelyn looked at the general.
EVELYN CARTER: "So Price was still accessing the system after leaving the building."
GENERAL MICHAEL HARRINGTON: "It appears that way."
JAMES PORTER: "There is one complication."
EVELYN CARTER: "What complication?"
JAMES PORTER: "The login credentials were used remotely after the physical access record showed Price had left the building."
Daniel Reeves, who had arrived with the investigative team, stepped closer.
DANIEL REEVES: "Are you saying someone else may have been using his account?"
JAMES PORTER: "Possibly. The account is authorized for remote access, and we have not yet established which device initiated the session."
EVELYN CARTER: "Then we need to identify the device."
JAMES PORTER: "We're working on it."
The technician opened another screen.
A second access record appeared.
It showed a connection from a device registered to an external network.
Evelyn read the entry carefully.
EVELYN CARTER: "Is this a company network?"
JAMES PORTER: "The address appears to be associated with a private logistics facility."
GENERAL MICHAEL HARRINGTON: "Which facility?"
James enlarged the information.
JAMES PORTER: "Meridian Storage and Logistics."
Daniel looked toward Evelyn.
DANIEL REEVES: "That name appears in the supplier correspondence."
EVELYN CARTER: "Show me."
James opened the supplier file.
Several messages appeared on the screen. Most were routine communications about equipment delivery dates, inspection schedules, and contract revisions.
But one message stood out.
It had been sent from a company account belonging to Lawson Strategic Technologies.
The subject line read:
FINAL DOCUMENT TRANSFER β APPROVAL CONFIRMATION.
Evelyn read the message.
It stated that the revised assessment had been approved and that the original laboratory report should be transferred to a separate storage location before the next procurement review.
The message had been sent by an employee named Gregory Shaw.
EVELYN CARTER: "Who is Gregory Shaw?"
JAMES PORTER: "He is listed as a compliance manager for Lawson Strategic Technologies."
GENERAL MICHAEL HARRINGTON: "Was he involved in the original testing?"
JAMES PORTER: "I don't know."
EVELYN CARTER: "Find out."
Daniel examined the message header.
DANIEL REEVES: "There is another recipient."
He pointed to the bottom of the screen.
The message had also been sent to an address belonging to the regional procurement office.
The account was registered to Samuel Price.
But another name appeared in the forwarding history.
Colonel Andrew Mitchell.
Evelyn stepped closer.
EVELYN CARTER: "The retired officer."
GENERAL MICHAEL HARRINGTON: "Yes."
The general read the message again.
GENERAL MICHAEL HARRINGTON: "It appears Mitchell received the correspondence."
DANIEL REEVES: "But his signature is on the revised assessment."
EVELYN CARTER: "We need to determine whether he actually signed it."
James opened the document's digital properties.
A verification panel appeared.
JAMES PORTER: "The signature image was inserted into the document. It does not appear to be a digitally authenticated signature."
Evelyn looked at him.
EVELYN CARTER: "Can you confirm whether the document was altered?"
JAMES PORTER: "I can compare the current file with the original submission and examine the document history."
GENERAL MICHAEL HARRINGTON: "Do it."
The technician began working.
For several minutes, the room remained quiet except for the sound of keyboards and the ventilation system.
Then the technician stopped.
TECHNICIAN: "Colonel, I think we have something."
Evelyn moved toward the screen.
The document history showed that the revised assessment had originally been created using a template from an earlier procurement report.
Several sections had been replaced.
The testing results had been changed.
The final approval page had been inserted separately.
And the signature attributed to Colonel Mitchell had been copied from an older document.
EVELYN CARTER: "Can you identify the source document?"
TECHNICIAN: "It appears to be a report from three years ago."
GENERAL MICHAEL HARRINGTON: "Then the signature was reused without authorization."
TECHNICIAN: "That is what the document history suggests."
Evelyn looked at the general.
EVELYN CARTER: "We need to contact Colonel Mitchell directly."
GENERAL MICHAEL HARRINGTON: "I'll have the investigative unit locate him."
Daniel pointed to another entry.
DANIEL REEVES: "There's more."
A file attached to the supplier correspondence contained a list of payments made to several consulting companies.
Some of the amounts were small.
Others were substantial.
The payments had been described as technical consulting fees, independent testing services, and administrative support.
However, the names of the recipients did not match the organizations listed in the official procurement records.
Evelyn studied the list.
EVELYN CARTER: "Who authorized these payments?"
James opened the accompanying spreadsheet.
JAMES PORTER: "The approval column lists three separate administrative accounts."