Then, two days later, he noticed something else.
The access log for the executive floor showed Eleanor's badge opening a restricted door at 10:23 p.m.
The same record listed the badge's serial number.
Samuel compared that number with the exhibit inventory.
It was correct.
But a separate security report, filed by Meridian's building manager, stated that the badge had been deactivated at 10:11 p.m., shortly after Eleanor left the building.
If the badge had been deactivated, how had it opened the door twelve minutes later?
He wrote another note.
This time, he asked his supervisor, Deputy Clerk Patricia Shaw, whether the discrepancy needed to be flagged before the next hearing.
Shaw had worked in the courthouse for twenty-two years. She was a careful woman with silver hair, reading glasses, and a habit of tapping her pen against the desk when she was thinking.
She read Samuel's notes twice.
“Have you spoken to the evidence technician?” she asked.
“Not yet.”
“Then do that first. Access records can be messy. There may be a duplicate credential or an administrative explanation.”
“I understand.”
“And Samuel?”
He looked up.
“Do not make assumptions about a case because two records don't line up. You have a duty to preserve the record, not investigate the defendant.”
He nodded.
At the time, the advice seemed sensible.
He would later remember the exact words and wonder whether Shaw had been warning him about his own limits—or about someone else's expectations.
The evidence technician, a contractor named Victor Hale, answered Samuel's email the next afternoon.
He wrote that the access records had been reviewed and that the badge discrepancy was attributable to a delayed synchronization between the building's security system and Meridian's central server.
He attached a short technical explanation.
Samuel read it carefully.
The explanation sounded plausible, but it did not answer why the badge had remained active after the building manager claimed it had been disabled.
He replied with a request for the original access export.
Hale did not respond.
When Samuel followed up the next morning, Hale called him directly.
“You're new to this, right?” Hale asked.
“Yes.”
“Then let me save you some time. The records have already been verified. The prosecution has its own digital experts. If they say the file is authentic, your job is to file it.”
Samuel frowned.
“My job is to ensure the exhibit index is accurate.”
“And it is accurate.”
“Then why can't I see the original export?”
There was a pause.
“Because it's restricted material. You're not the only person who needs to follow access rules.”
Hale ended the call before Samuel could respond.
That evening, Samuel stayed late to finish a docket update. Before leaving, he checked the evidence system once more.
The access log showed no new activity.
Everything appeared normal.
He went home believing the matter was settled.
It was the last time he would feel comfortable with that assumption.
At 9:34 a.m., after Eleanor had been removed from the courtroom, Samuel received a message on the internal court system.
It was from Patricia Shaw.
Come to my office immediately. Do not discuss the evidence file with anyone else.
Samuel read it twice.
Then he closed the case management window and walked down the corridor.
Shaw's office door was open. She stood behind her desk with a printed sheet in her hand.
“What did you see this morning?” she asked.
Samuel hesitated.
“Mrs. Vale asked the court to check who entered the evidence room.”
“And why do you think she said that?”
“I don't know.”
Shaw looked at him for a long moment.
“Samuel, did you access the sealed file last night?”
“No.”
“Did you authorize anyone to use your credentials?”
“No.”
“Did you share your password with anyone?”
“No.”
“Then why does the system show that you certified the file at 1:02 a.m.?”
The question struck him like a physical blow.
“You saw it too?”
Shaw placed the sheet on the desk.
It was a printout of the digital audit trail.
The file number was correct. The access times matched the records Samuel had discovered earlier. His username appeared beside the certification entry.
But the certification itself was not his.
“I didn't do this,” he said.
“I believe you.”
He stared at her.
“You do?”
“I checked the building access logs. Your badge did not enter the courthouse overnight. The security cameras show no sign of you. And your workstation was shut down at 6:14 p.m. yesterday.”
“Then someone used my credentials.”
“Yes.”
“Who?”
“I don't know yet.”
Samuel leaned forward.
“Mrs. Vale knew something was wrong. She must have seen a discrepancy in the evidence.”
“Or someone told her.”
“Who would tell her?”
Shaw did not answer.
Instead, she turned the audit trail toward him.
“Look at the administrator override.”
Samuel scanned the entry.
The system showed that a user with administrator privileges had opened the original file, replaced the spreadsheet, and generated a new hash value. The new file had then been marked as a verified copy of the original.
But there was a second line in the record.
The original file had not been deleted.
It had been moved into a restricted archive.
Samuel felt his heart begin to race.
“Someone preserved it.”
“Or the system preserved it automatically,” Shaw replied. “We cannot assume anything yet.”
“But the file was changed.”
“Yes.”
“And someone used my name to certify it.”
“Yes.”
“Then we have to report it.”
Shaw looked toward the office door before lowering her voice.