The online resale listing provided the first tangible lead to the missing equipment.
Investigators preserved the listing, documented its contents, and began identifying the seller through the appropriate legal procedures. They did not attempt to access the seller's private accounts without authorization, nor did they assume that the name attached to the listing necessarily identified the person who controlled it.
Within hours, the platform supplied information under a valid request.
The account had been created several months earlier and had been used to advertise surplus electronic equipment. The contact details were associated with a business address used by Victor Shaw's renovation company.
That connection was significant, but it still required corroboration.
Deputy Director Hayes organized a team to examine the company's inventory records and determine whether the listed device could be recovered.
Meanwhile, Evelyn reviewed the timeline of Paul Bennett's disappearance.
Bennett had last been seen leaving the courthouse on a Friday afternoon. He had sent a brief email to his supervisor that evening, saying he needed time away from work. The following Monday, he failed to appear for a scheduled meeting.
His family reported him missing several days later.
There was no confirmed evidence that he had been abducted. He might have left voluntarily, gone into hiding, or encountered circumstances that had prevented him from contacting anyone.
But the anonymous threats and suspicious access records made it necessary to consider whether someone had intimidated him.
Evelyn studied the final email.
“Has anyone verified the account from which this message was sent?” she asked Nina.
“Yes. The message originated from Bennett's account, but that doesn't establish that he personally sent it. We need to examine the login history and compare it with his known devices.”
“Can we establish whether he was using his usual workstation?”
“Not yet. The account was accessed through a remote connection, and the available records are incomplete.”
Hayes joined the discussion.
“Let's focus on the equipment. If we recover the storage device, it may provide a clearer timeline.”
The investigation moved forward.
The contractor's inventory showed that the missing drive had been removed from the courthouse during a scheduled equipment transfer. The disposal record claimed it had been sent to an approved recycling facility, but the facility had no record of receiving it.
The discrepancy was documented.
A separate shipping record indicated that a package containing electronic equipment had been delivered to a commercial storage unit under a company account associated with Shaw.
Investigators obtained the necessary authorization to examine the unit.
Inside, they found boxes of cables, discarded computer components, and several storage devices. Each item was photographed and documented before being moved.
One device matched the serial number recorded in the courthouse inventory.
The technical team secured it for forensic examination.
Hours later, Nina reported the initial results.
“The device contains fragments of archived access logs and several deleted file indexes. Some data may be recoverable, but the device appears to have been used after it was removed from the courthouse.”
“Can you establish what was accessed?” Evelyn asked.
“We've recovered portions of the directory structure. Several entries correspond to the missing-file investigation. We have not yet recovered the complete contents.”
“Is there evidence that the files were copied?”
“There are indications of transfer activity, but we need more analysis to establish what was copied, when it happened, and where the data went.”
Hayes nodded.
“Preserve the device and continue the examination.”
The recovered logs revealed a series of access events associated with the old archive corridor. One event occurred on the day Bennett disappeared. Another occurred three days later, when the maintenance system recorded a temporary credential entering the building.
The credential had been assigned to Victor Shaw.
That was the strongest connection yet between the contractor and the missing records.
However, the investigators still lacked evidence establishing that Shaw had personally taken the files or that he had threatened Bennett.
The team continued examining the device.
Near midnight, Nina found a recovered directory containing a spreadsheet with several names, dates, and payment references. The file appeared to document transfers between a contractor account and several intermediary businesses.
Some entries corresponded to payments already under review in the corruption investigation.
Others were unfamiliar.
One entry contained the initials R.C.
Richard Cole.
Another contained the initials D.M.
Daniel Mercer.
Evelyn studied the spreadsheet carefully.
“Could these refer to the same people we have been investigating?”
“They could,” Nina replied. “But the file contains no full names or explanatory notes. We need independent evidence to establish what the initials mean.”
“Agreed.”
The team compared the entries with financial and procurement records obtained through authorized channels. They found a payment to a business connected to Cole's family, but no direct evidence that Mercer had received money.
The distinction mattered.
Mercer had admitted searching records and accepting the promise of a transfer. He had not admitted receiving payment, and the recovered spreadsheet did not establish that he had.
Evelyn informed Hayes.
“We should not treat the initials as proof of bribery. The records justify examining the relevant transactions, but we need corroboration.”
Hayes agreed.
Then Nina discovered another file.
It was a scanned statement attributed to Paul Bennett, dated two days before his disappearance.
The document described irregularities in the archive system and alleged that certain records had been removed without proper authorization. It named Victor Shaw and Richard Cole as people who had requested access to the storage area.
At the bottom was a handwritten note:
THE ORIGINAL SIGNED COPY IS NOT IN THE ARCHIVE.
Judge Whitmore read the statement through the secure connection.
“Could this be the document we have been searching for?”
“Possibly,” Evelyn replied. “But we need to authenticate it and locate the original.”
Nina examined the scan.
“The digital file has been modified several times. I can compare the signatures and document structure with known examples, but authentication will require additional evidence.”
“Then begin that process,” the judge said.
The team returned to the archive records.
The original signed statement had been listed in an inventory created six weeks earlier. Its reference number appeared on the missing-file list found in the hidden room.
Yet no record showed where it had gone.
Evelyn reviewed the building's access logs again.
A final entry caught her attention.
On the evening Bennett disappeared, a maintenance credential had opened a secondary door near the loading dock. The same credential had been used to access a storage area shortly before the equipment was removed.
The account belonged to the renovation contractor.
But the identity of the person who had used it remained unknown.
Hayes looked at the timeline.
“If we can establish who used that credential, we may be able to determine whether the documents and equipment were moved together.”
Evelyn nodded.
“We should also locate Bennett. His testimony could help authenticate the statement and explain why he disappeared.”
The next morning, investigators received a call from a lawyer representing a person who wished to provide information about the missing records.
The person would not identify himself over the phone.
He requested a secure meeting and insisted that he had evidence proving the original files had been moved before the courthouse audit.
Hayes arranged a meeting through the appropriate channels.
When Evelyn arrived at the designated location, she found a middle-aged man waiting beside a table. His face was pale, and he repeatedly glanced toward the windows.
He introduced himself with a shaking voice.
“My name is Paul Bennett.”
Evelyn remained calm.
“Mr. Bennett, we've been trying to locate you. Are you safe?”
“For now.”
“Do you have information about the missing files?”
He nodded.
“I know where the original signed statement is. I also know who ordered the documents to be moved.”
Evelyn leaned forward.
“Who?”
Bennett looked toward the door.
“Richard Cole arranged the access. Victor Shaw handled the equipment. But neither of them was the person giving the orders.”
“Who was?”
Bennett took a folded sheet of paper from his coat.
Before he could hand it over, his phone vibrated.
He looked at the screen and went completely still.
“What is it?” Evelyn asked.
Bennett turned the phone toward her.
The message contained a photograph of the building where they were meeting.
Below it were eight words.
WALK AWAY NOW, OR YOUR FAMILY WILL PAY.
Evelyn immediately alerted the security team.
Bennett's hands trembled.
“They know I'm here.”
“We'll take the appropriate steps to protect you and your family,” Evelyn said. “But I need you to tell us who sent that message.”
Bennett stared at the phone.
Then he whispered a name.
It was not Richard Cole.
It was not Victor Shaw.
It was someone who had been trusted to protect the very investigation they were now trying to destroy.