At 6:12 p.m., two dark vehicles entered the parking lot outside the Redstone County Sheriff's Office.
They were ordinary-looking vehicles, without flashing lights or dramatic markings. The people who stepped out wore business attire, carried identification, and moved with the quiet efficiency of professionals accustomed to sensitive assignments.
Daniel Mercer met them at the entrance.
The team leader, Special Agent Rachel Bennett, presented her credentials and introduced the technical specialist accompanying her.
"Daniel," Bennett said, "Deputy Director Shaw sent us the initial information. We've reviewed the preservation notice and the available audit references."
"Good. We have identified a disputed transfer, a changed seal number, a special authorization, and a payment to Meridian Evidence Logistics."
"Have the original records been preserved?"
"The preservation process has begun, but we need to complete the technical acquisition and secure the physical documentation."
Bennett nodded.
"Then that's our first priority."
They entered the building together.
The atmosphere had changed since Daniel's arrival. Conversations stopped when the federal team passed. Employees who had previously treated the investigation as an administrative inconvenience now seemed uncertain about what to say.
Sheriff Harlan waited near the conference room.
He had changed out of his outdoor jacket and straightened his uniform, apparently hoping that a more formal appearance might restore some of his authority.
"Agent Bennett," he said, extending his hand.
She shook it.
"Sheriff."
"I want to make it clear that my department intends to cooperate."
"That's helpful. We'll need your cooperation in preserving the records and identifying the personnel responsible for their maintenance."
"Of course."
Bennett opened a folder.
"We'll also need a written inventory of the relevant systems, the names of authorized administrators, and the current procedures for evidence transfers."
Harlan nodded.
"Lieutenant Grady can provide those."
Bennett glanced toward Daniel.
"Is Lieutenant Grady still responsible for the system?"
"He remains the listed custodian. We have not established whether he was personally responsible for any irregularity."
"Understood. We'll handle that through the appropriate process."
The team entered the records room.
A technical specialist began documenting the computer system, its configuration, and the available audit information. The original records would be preserved using approved methods designed to maintain their integrity and establish a reliable chain of custody.
Daniel stood nearby, answering questions about the specific entries he had discovered.
Bennett reviewed the transfer history.
"The change occurred at 7:13 a.m.," she said.
"Correct."
"And the payment was processed that same morning?"
"According to the initial records, yes."
"That timing deserves attention."
"Agreed."
She opened another document.
"Meridian Evidence Logistics has received payments from several county agencies. Most appear routine, but two transactions in neighboring jurisdictions were flagged because the corresponding delivery records were incomplete."
Daniel looked at her.
"Do we have a connection to the same evidence cases?"
"Not yet. We have a shared contractor and similar documentation problems. That's enough to justify comparison, not enough to establish a common scheme."
Daniel nodded.
"Then we should compare the original records and payment authorizations."
"That's already underway."
The technical specialist interrupted.
"Agent Bennett, we've identified several administrative access events that require review."
Bennett approached the workstation.
"What kind of events?"
"An administrative account accessed the disputed transfer record outside the normal review window. There are also several failed authentication attempts associated with the same account."
Daniel moved closer.
"Can we establish whether the account was accessed remotely?"
"We're examining the available logs. The current record suggests that some access may have originated from a device not normally associated with the evidence room."
Bennett's expression became serious.
"Preserve the relevant logs and identify the device through the appropriate forensic process."
The specialist nodded.
Sheriff Harlan stood near the doorway, listening.
"Are you saying someone hacked our system?"
The specialist turned toward him.
"I'm saying that the access history contains anomalies. We need to determine whether they resulted from authorized administrative work, a configuration issue, compromised credentials, or another cause."
Harlan folded his arms.
"Those computers are maintained by the county."
"That doesn't prevent an account from being misused," Bennett replied. "But we won't reach a conclusion until the evidence supports one."
Harlan said nothing.
Daniel noticed that the sheriff seemed increasingly uncomfortable with the distinction between an unexplained event and an accusation.
It was a distinction Daniel had made repeatedly since the confrontation began.
Evidence first.
Conclusions afterward.
The technical team continued its work.
At 6:47 p.m., Bennett received a call from the financial investigation unit.
She listened carefully, then stepped into the hallway.
When she returned, she carried a different expression.
"Daniel, we have a development."
"What is it?"
"The payment to Meridian Evidence Logistics was not the only transaction associated with the disputed transfer. Investigators have identified a second payment to a company called Northbridge Administrative Services."
Daniel frowned.
"What's the relationship between the companies?"
"We don't know yet. Their registered addresses are different, but preliminary financial records suggest that they may share an intermediary."
"How much was transferred?"
Bennett gave him the amount.
It was substantially larger than the original payment.
Daniel looked toward the computer.
"Was the second payment recorded in the sheriff's office system?"
"Not under the same reference number. The financial unit found it through the county's accounting records."
"Then we need to establish why it was not linked to the evidence-transfer authorization."
"Exactly."
They returned to the conference room.
Harlan was waiting.
"What's happening now?"
Bennett placed the new document on the table.
"We have identified another payment that may be associated with the same contractor network. We need the underlying accounting records and the names of the officials who reviewed the transaction."
Harlan examined the document.
His expression became increasingly troubled.
"I don't recognize this company."
"That's one of the questions we need to resolve."
"I never approved this payment."
"Then we will compare the approval history with your account records and the county's authorization procedures."
Harlan looked toward Grady, who had entered the room several minutes earlier.
"Paul, do you recognize Northbridge Administrative Services?"
Grady's eyes moved across the document.
He appeared to struggle for an answer.
"I may have seen the name."
"Where?"
"I can't remember."
Daniel watched him closely.
"Would you recognize it if you reviewed the original accounting records?"
"Possibly."
Bennett closed the folder.
"Then we'll request those records through the appropriate process."
Grady nodded.
But his expression suggested that the name meant more to him than he was willing to admit.
The federal team worked for another hour, preserving digital records and preparing requests for additional documentation.
By 8:00 p.m., the initial evidence had been secured sufficiently for the next stage of the investigation.
Daniel stepped outside for a moment.
The air had cooled, and the parking lot was almost empty. A streetlight illuminated the spot beside the pickup truck where Harlan had shoved him earlier that afternoon.
Daniel looked at the side panel.
He could still remember the impact.
He could also remember the sheriff's words.
Procedure is whatever I say it is out here.
The statement had revealed more than anger.
It had revealed a belief that authority belonged to the person who held power rather than to the law that defined its limits.
Daniel's phone vibrated.
A message from Deputy Director Shaw appeared.
Preliminary financial review indicates a possible connection between Northbridge Administrative Services and a former county procurement official. Further details pending.
Daniel read the message twice.
Then another message arrived.
The former official's name is Peter Lawson.
Daniel looked back at the sheriff's office.
Peter Lawson.
The same man Deputy Miller had named as the recipient of the sealed envelope.
The investigation had just connected the financial records to a person who had received documents outside the ordinary administrative process.
Daniel returned inside.
He found Bennett in the conference room.
"We have a name," he said.
She looked up.
"Who?"
"Peter Lawson."
Bennett's expression changed.
"The former procurement official?"
"Yes. He received a sealed envelope from Deputy Miller about a month ago. The envelope reportedly contained corrected contractor-payment paperwork."
Bennett stood.
"Then we need to determine whether that delivery was connected to the transactions we're examining."
Daniel nodded.
"Agreed."
Neither of them yet knew what Lawson had done with the envelope.
But they now had a reason to examine his role.
And if the records established a connection between Lawson, the contractor network, and the altered evidence transfers, the investigation would extend beyond the sheriff's department.
The problem might not have originated in Redstone County at all.
It might have been operating through the county.