The anonymous message had reached Andre because someone believed he needed to know about the missing file. But the investigation team could not assume that the sender was a trustworthy witness.
Captain Foster arranged a controlled process for receiving additional information. Any person with relevant knowledge could contact professional standards directly, submit documents through the department's secure reporting channel, or request an interview without discussing the case with other employees.
The message itself contained no name, no explanation, and no evidence beyond the reference to Tuesday night's records-room access.
For two days, nothing further arrived.
Then, at 8:06 a.m. on Friday, a department email account received a short request for a confidential meeting.
The sender identified herself as Natalie Brooks, a records clerk who worked on the same floor as the operations office. She wrote that she had information about the exported file and wanted to speak to an investigator.
She also requested protection against retaliation.
Foster arranged the meeting in a private office with a second investigator present.
Natalie arrived carrying a notebook and a sealed envelope. She appeared nervous, repeatedly checking the corridor before entering.
“I don't want to make an accusation that I can't support,” she began. “But I think someone used the shared workstation to copy a case document, and I may have seen who did it.”
Foster asked her to explain what she had personally observed.
Natalie said she had been working late on Tuesday when she saw Victor Sloane leave the records room. He carried a briefcase in one hand and a small black storage device in the other. She had assumed it belonged to his security audit.
“Did you see him connect the device to a computer?” Foster asked.
“No. I only saw him carrying it.”
“Did you see him remove it from the cabinet?”
“No.”
“Did you see him enter the records room?”
“Yes. I saw him use his badge.”
Foster wrote down the details.
“What made you connect that observation to the narcotics file?”
Natalie opened her notebook.
“On Thursday, I was asked to help locate an older version of a case document. The request came from someone in operations. I searched the file directory and saw that the original chronology had been exported. I wasn't authorized to open the case contents, so I didn't. But I recognized the filename from a maintenance ticket I had seen earlier.”
“Who asked you to locate it?”
“Mr. Bennett's assistant. She said the operations manager wanted a copy for a technical review.”
“Did she explain why?”
“She said there was a discrepancy in the timestamps.”
Foster paused.
“Did you provide the file?”
“No. I told her I needed written authorization. She said she would get it, but she never returned.”
The account was significant, but it did not prove that Sloane had copied the file or that Harold Bennett had knowingly authorized access to it.
Foster asked Natalie whether she had any documentation.
Natalie slid the envelope across the desk. Inside were printed maintenance-ticket records showing the file's name, the time of the request, and the identity of the workstation involved. The documents did not contain the confidential case material itself.
Foster examined the pages.
“Where did these come from?”
“They were attached to a routine technical ticket. I printed the ticket because I thought the request needed formal authorization. I haven't altered anything.”
“Did you share these documents with anyone else?”
“No.”
“Did you send the anonymous message to Officer Mitchell?”
Natalie looked startled.
“I sent a message to someone, but I didn't know whether it reached him.”
“Who did you contact?”
“I used the department's reporting hotline. I described the records-room access and asked that the information be passed to the investigator handling the case. I didn't provide a name because I was afraid of being identified.”
Foster did not tell Natalie whether the message had been received by Andre. Instead, she asked the communications unit to compare the hotline record with the original message, following the department's privacy and evidence-handling procedures.
The comparison later established that Natalie's report was consistent with the timing and subject of the anonymous warning. It did not conclusively prove that she had sent the exact message Andre received, but it gave investigators a credible lead.
Deputy Chief Bennett authorized additional safeguards to prevent unauthorized access to the relevant records. Natalie was instructed not to approach Sloane, Mercer, or anyone else connected to the investigation.
When she left the office, she looked exhausted.
“I only want the department to get this right,” she said.
Foster answered carefully.
“Then continue telling us what you know, and be equally clear about what you don't know.”
Later that afternoon, Sloane was contacted for a second interview. He was informed that investigators had received information about a storage device and a file request made through the operations office.
His attorney accompanied him.
“Did you carry a storage device out of the records room on Tuesday evening?” Foster asked.
Sloane answered, “I regularly carry technical equipment. I don't remember which device I had on that particular evening.”
“Did you export the narcotics evidence chronology?”
“I have not knowingly removed evidence from the department.”
Foster placed the maintenance ticket on the table.
“Did you ask an operations employee to retrieve a copy of the file on Thursday?”
Sloane examined the document.
“I may have asked for a technical comparison. I would need to see the complete correspondence.”
“Did you tell the employee the file was connected to a discrepancy in the timestamps?”
“I don't recall the exact wording.”
His attorney requested a copy of the materials and a break to confer privately.
Foster granted the request.
The interview ended without an admission, but the investigation now had a second account supported by contemporaneous records.
For Andre, the development brought cautious relief. Price informed him that a witness had provided relevant information and that the department was following the lead. He did not reveal Natalie's identity or details that could compromise her safety.
“Does this mean they know who changed the report?” Andre asked.
“Not yet.”
“Do they know who copied the file?”
“We have evidence pointing toward a sequence of events, but we still need to establish who performed each action.”
Andre nodded.
He was learning that an investigation did not move forward through dramatic revelations alone. It moved through small, verified details that either supported or contradicted a theory.
That evening, Natalie received a call from an unknown number.
The caller said nothing.
After several seconds, the line went dead.
She immediately reported the incident.
The department could not determine who had called, but the timing raised concern. Bennett ordered a review of access to Natalie's personnel information and reminded the staff that intimidation of a witness would be treated seriously.
Somewhere inside the precinct, someone had realized that the missing file was no longer an isolated technical issue.
People were beginning to speak.
And the truth was becoming harder to contain.