In the replacement file, an additional payment appeared on September 12.
The amount was $420,000.
The entry carried Eleanor Vale's employee identification number in the authorization field.
Rebecca leaned closer.
“Is that the payment the prosecution used to connect her to the alleged transfer?”
“Yes,” Helen replied. “The payment is cited in the prosecution's financial summary as evidence that Eleanor authorized a final transfer shortly before Adrian Cole's death.”
“Was it present in the original file?”
“No.”
“Can we determine when it was added?”
“The file history indicates that the row was inserted during the administrative session at 12:46 a.m. The original spreadsheet was last saved on September 10. The replacement was generated overnight, and the altered row was assigned an authorization code that did not exist in the original register.”
Rebecca studied the entry.
“Who created the authorization code?”
“We're still tracing that. But it wasn't generated by Meridian's ordinary finance system. It appears to have been entered manually.”
“Can you establish whether the payment actually occurred?”
Helen opened another file.
The transaction had been listed in the replacement spreadsheet, but the bank records contained no corresponding transfer to Northbridge Advisory on September 12.
Instead, the $420,000 had been sent to a different company three weeks earlier.
That company was Marlow Consulting Group.
The payment had been approved by a senior executive, not by Eleanor.
Rebecca exhaled slowly.
“So the prosecution's version combines a real amount with a false date, a false recipient, and a false authorization field.”
“That's what the records show.”
“Could a routine export have created those differences?”
“No. A routine export cannot invent a transaction that does not exist in the source records.”
“Could a system error have changed the authorization field?”
“Not in this way. The field was manually inserted after the original spreadsheet was created.”
Rebecca looked at the forensic specialist.
“Have you documented the comparison?”
“Yes. We have preserved both versions, the file hashes, the metadata, and the audit trail. We also have a copy of the underlying financial records from Meridian.”
“Then prepare a report.”
She turned back to Helen.
“What about the access timeline?”
Helen brought up a second screen.
The original security logs showed that Eleanor's employee badge had been deactivated at 10:11 p.m. on September 12.
The badge could not have opened the executive-floor door at 10:23 p.m.
Someone had used a separate credential.
The record showed that a temporary access card had opened the door at 10:23 p.m. The card had been issued to a building contractor two days earlier and should have been returned before the end of that week.
The card had not been returned.
Its access permissions had been extended manually at 10:17 p.m. on September 12.
The extension had been authorized through an administrative account associated with Meridian's executive office.
Rebecca read the entry.
“Who had access to that account?”
“Three people,” Helen said. “Adrian Cole, Robert Kessler, and a security administrator named Peter Lawson.”
“Can we identify who requested the extension?”
“The log contains the account ID, not the individual who was physically at the terminal.”
“Then we need the building's camera footage.”
Helen opened the next record.
The camera facing the security office had captured a person entering at 10:15 p.m. and leaving at 10:20 p.m.
The image was not clear enough for immediate identification.
But the person carried a flat black case.
And the person's right leg moved unevenly.
Rebecca stared at the screen.
She remembered Eleanor's statement about the man she had seen leaving the executive floor.
A man carrying a flat black case.
A man with a slight limp.
She did not jump to a conclusion. The image needed enhancement, and the identity needed confirmation.
But the details now aligned closely enough to justify a more urgent investigation.
“Preserve the original footage,” she said. “Obtain the contractor's access records, the security office logs, and every record associated with the temporary card.”
Helen nodded.
Rebecca looked again at the altered spreadsheet.
The change was not a clerical mistake.
Someone had added a payment that did not exist in the original records, assigned it to Eleanor, and inserted it into the file used to support a murder prosecution.
The altered row had been designed to do one thing.
Make Eleanor look guilty.
And whoever had done it had used the court's own system to conceal the change.
The next morning, Rebecca Sloan met with the district attorney's office.
She brought the preliminary forensic report, the original spreadsheet, and a summary of the authentication records.
The district attorney, Evelyn Shaw, read the report in silence.
When she reached the altered payment entry, she set the pages down.
“Are you certain this transaction did not occur?”
“The source records show no such payment on September 12,” Rebecca replied. “The amount corresponds to a transfer made earlier to a different recipient. The entry in the prosecution's spreadsheet was manually inserted.”
“Could Eleanor Vale have inserted it before the file was submitted?”
“The audit trail indicates that the replacement file was created through a remote administrative session after the court had received the exhibit. We are still determining who controlled that session.”
“Does this prove she did not kill Adrian Cole?”
“No. It proves that a piece of evidence used to support the prosecution's theory was altered. The access records also contradict the claim that her badge opened the executive-floor door at 10:23 p.m.”
Evelyn looked toward the window.
“Does Michael Trent know?”