The missing storage device was recovered on Tuesday afternoon.
It was found inside a locked equipment cabinet in an office used for technical maintenance. The cabinet had been opened during a scheduled inventory, and the device was discovered in a small envelope bearing a handwritten reference number.
The employee who found it immediately notified the records department.
No one attempted to connect the device to a workstation. It was photographed in place, sealed, and transferred to the authorized digital-evidence team.
Priya Shah confirmed that the device's inventory number matched the device assigned to the records unit earlier that month. The label had not been altered, although the checkout log still lacked a complete return entry.
The digital-evidence team created a verified forensic copy under documented procedures. Investigators then examined the copy rather than repeatedly accessing the original device.
The results revealed several files associated with the narcotics case, including the original evidence chronology, a copy of the incident report before the timestamp change, and a spreadsheet containing the supplemental evidence log.
The files had been created at different times. Their metadata showed that the original chronology had been exported on Tuesday evening and accessed again two days later.
But the most important discovery was not the existence of the files.
It was the difference between the versions.
The original chronology showed that the first recorded contact occurred at 9:47 p.m. The altered report listed 9:14 p.m. The supplemental log contained a collection time that could not be reconciled with the dispatch record or the contemporaneous notes from the second officer.
The evidence did not establish that every discrepancy was deliberate. One entry appeared to have been copied from a preliminary worksheet, while another had been changed without an explanation. Investigators would need to determine who made each alteration and whether the errors affected the legal validity of the case.
Captain Foster assembled the findings for Deputy Chief Bennett.
“The original record supports Mitchell's concern,” Foster explained. “The timeline was inconsistent, and Mercer changed one of the critical entries without verifying the source. The exported copy preserves the earlier version.”
“Who copied it?” Bennett asked.
“The device was assigned to the records unit. The export occurred while Sloane was in the room, but the workstation account was shared. We have corroborating evidence that he later accessed the file from the operations office. His involvement is strongly indicated, but we still need to establish precisely what he did and why.”
“Can we determine whether he changed the supplemental log?”
“The digital record identifies the account used for that edit, not the individual at the keyboard. We are comparing access records and witness statements.”
Bennett leaned back.
“Then we do not overstate the conclusion. What about the original narcotics case?”
“We have recommended that the prosecutor's office review the timeline and determine whether any evidence or court filing was affected. The department should not assume that the case remains unaffected simply because the underlying evidence may be genuine.”
Bennett approved the recommendation.
The department contacted the appropriate prosecutorial authority and provided the verified records. The prosecutor's office began an independent review of the case chronology, evidence handling, and any legal filings that relied on the disputed timestamps.
Sloane was summoned for another interview.
This time, investigators presented him with the verified device inventory, the access records, Natalie's statement, and the technical ticket from the operations office.
He initially maintained that he had not knowingly removed an active case file.
Foster asked him to explain why he had accessed the chronology after being informed that the report contained a discrepancy.
“I was trying to understand what the system showed,” Sloane replied.
“Were you authorized to investigate the substance of the narcotics case?”
“No.”
“Were you authorized to export the original chronology?”
“No.”
“Did you know Officer Mercer had changed the timestamp?”
Sloane paused.
“He told me there was a problem with the report.”
“Did he tell you that he had changed the time?”
“He said he had corrected an entry.”
“Did you verify that the correction was supported by the original dispatch record?”
“No.”
Foster allowed a moment of silence before asking the next question.
“Why did you access the file from Harold Bennett's workstation?”
Sloane looked toward his attorney.
After a brief consultation, he acknowledged that he had requested a technical comparison. He claimed that he wanted to determine whether the difference between the versions resulted from a system error.
“Why didn't you request formal authorization?” Foster asked.
“I believed the issue could be resolved quickly.”
“Why did you use a storage device rather than the approved case-review process?”
Sloane did not provide a clear answer.
The interview continued, but he declined to speculate about the supplemental log's altered entry. He maintained that he had not personally changed that record.
Investigators documented his response and continued examining the audit history.
Meanwhile, the prosecutor's office confirmed that the disputed timeline required further review before the narcotics case could proceed. Some evidence remained independently supported, but the reliability of the chronology could not be assumed.
For Andre, this was the most important development of all.
The investigation was no longer simply about his injury or Daniel's misconduct. It had become a formal examination of whether inaccurate records had affected a criminal case and whether unauthorized access had compromised the department's evidence-handling process.
On Wednesday evening, Deputy Chief Bennett called Andre into her office.
“We have recovered the original chronology,” she said. “Your concern about the timestamp was justified. The department is now reviewing the full chain of events.”
Andre nodded.
“Has the supplemental entry been explained?”
“Not completely.”
“Then I hope the review continues until it is.”
“It will.”
Bennett placed a copy of the preliminary findings on her desk.
“Your restraint during the restroom incident also matters. The evidence supports your account that you attempted to disengage and used a takedown to stop an ongoing attack. The final disciplinary decision has not been made, but your conduct is being assessed separately from the allegations against Mercer.”
Andre looked at the document without touching it.
“I appreciate that.”
As he left the office, he passed the restroom where the confrontation had occurred. The damaged dispenser had been replaced, the stall door repaired, and the floor cleaned.
The room looked ordinary again.
Yet Andre knew that the real damage had never been limited to broken fixtures or a cut lip. It had involved trust, professional responsibility, and the belief that an officer's uniform would mean something even when no supervisor was watching.
The audit trail had revealed the first part of the truth.
The remaining question was whether the department would act on what it had learned.