“We will. But not through the ordinary channel.”
“Why not?”
“Because the ordinary channel routes the report through the courthouse administrator's office.”
Samuel waited.
Shaw took off her glasses.
“The administrator has access to the same audit system.”
For a moment, neither of them spoke.
The courthouse administrator was Thomas Whitaker, a man who rarely appeared in court but had considerable authority over staff, security, records, and building operations.
He had appointed several contractors. He approved emergency access requests. He controlled the budget for the digital evidence system.
And, according to the court's organizational chart, every report concerning unauthorized access eventually reached his desk.
“Are you saying Mr. Whitaker is involved?” Samuel asked.
“No,” Shaw replied immediately. “I'm saying we don't know who is involved. That is why we must preserve the records before anyone can alter them again.”
She opened a drawer and removed a small encrypted storage device.
“I exported a copy of the audit trail before I called you. I also requested the original server logs from the court's IT department. We need an independent copy, stored somewhere outside this building.”
“Can we do that?”
“If we follow the proper preservation process, yes. We will document every step.”
Samuel stared at the device.
“What about Mrs. Vale?”
Shaw's expression tightened.
“She is in custody. Her lawyer should be informed that a possible evidence-integrity issue has arisen.”
“Then we should call him now.”
“We will.”
“Why are we still sitting here?”
“Because I need you to understand something.” Shaw's voice was quiet but firm. “If the evidence has been altered, this is no longer a simple clerical error. If your credentials were used without authorization, you may be a witness. And if someone is trying to conceal what happened, they may try to make you look responsible.”
Samuel felt the blood drain from his face.
“They could blame me?”
“They already used your account.”
He looked down at the printed audit trail again.
His username sat beside the certification entry, neat and unmistakable.
Someone had placed his career, his credibility, and potentially his freedom on the line with a few clicks of a mouse.
And the woman who had warned the courtroom was now sitting behind a locked door, accused of murder.
Samuel swallowed.
“What do we do first?”
Shaw picked up the telephone.
“We protect the original.”
The original evidence was stored on a server in a secured room on the courthouse's fourth floor.
The room had two entrances: one from the IT corridor and another from a staff-only hallway near the records office. Both doors required electronic credentials. Access was recorded automatically, and the system was supposed to retain its logs for at least five years.
Supposed to.
At 10:06 a.m., Samuel and Patricia Shaw arrived outside the room with the court's IT manager, Helen Park.
Helen was forty-six, practical, and famously impatient with people who described technical problems as mysterious. She had worked in government IT for nearly two decades and preferred logs to explanations.
She listened as Shaw described the altered file.
Then she asked Samuel to show her the certification entry.
He handed her the printout.
Helen studied it without speaking.
“Who gave you this?”
“I exported it from the evidence management system.”
“Before or after the file was modified?”
“After I noticed the modification.”
“Did you save the raw audit data?”
“I saved a report.”
“That isn't the same thing.”
Samuel's stomach tightened.
Helen turned to Shaw.
“I need read-only access to the server and a formal preservation request. No one should touch the original until I've captured the system state.”
“Can you do that without going through Whitaker?” Shaw asked.
“I can preserve data under the court's incident-response policy. I'll document why I'm doing it and notify the appropriate authority. But I cannot promise the administrator won't hear about it.”
“Then let's make sure he hears about it after the evidence is secured.”
Helen gave a short nod.
They entered the server room together.
The air smelled faintly of dust and warm electronics. Rows of equipment stood behind metal panels, each with a small green or amber light. A ventilation fan hummed overhead.
Helen sat at a workstation and opened the evidence management system.
Samuel watched as she navigated to the case file.
The original spreadsheet appeared in the archive, marked with a status code he had never seen before.
SUPERSEDED — PRESERVATION HOLD.
“What does that mean?” he asked.
“It means the system recognized a replacement and retained the earlier version,” Helen said. “Someone may have attempted to overwrite the file, but the retention setting prevented the original from being permanently removed.”
“Can you open it?”
“Not yet. First, I need to copy the metadata and verify the file's integrity.”
She began the process.
A progress bar moved across the screen.
Samuel watched the percentage rise.
Thirty percent.
Forty-two.
Sixty-eight.
Then the screen froze.
Helen stopped typing.
“What happened?” Shaw asked.
“Session terminated.”
“By whom?”
Helen opened the security log.
A new administrative command had appeared.
REMOTE SESSION TERMINATION — AUTHORIZED ADMINISTRATOR.
The time was 10:11 a.m.
Someone had terminated their session while they were inside the room.
Helen's expression hardened.
“That wasn't a routine timeout.”
“Can they do that remotely?” Samuel asked.
“Yes.”
“Can they erase what we've already copied?”
“Potentially, if the copy remains on a connected system. That's why we need an isolated destination.”
She opened another window and checked the system's current administrative sessions.
One account was active.
TWHITAKER_ADMIN.
Thomas Whitaker.
Samuel looked at Shaw.