The next lead came from a detail that had seemed too technical to matter when the investigators first obtained the archive index. The user code associated with the closed comparison request had survived in a separate access-control report. It was still incomplete, but the report contained enough information to identify the category of account and the period during which it had been used.
Evelyn called me just after lunch. “The police have narrowed the account to a supervisor login assigned to Meridian's records-processing department. It was active during the period when Adrian Cole managed that unit.”
“Does that mean it was his account?”
“Not yet. The account assignment record is incomplete. Several supervisory users could access the restricted review folder, and the investigators are checking the historical roster.”
I looked at the circle around Cole's name in my notebook. For days, it had represented a possibility. Now his department was linked to the account that closed the review, but the link still did not establish that he had personally performed the action.
“Could the account have been used by someone else?” I asked.
“Yes. We already have a case in which an inactive employee's credentials were used to open the MR-17 cabinet. That is precisely why the police are trying to distinguish the account holder from the person who actually used the system.”
The access-control report also showed that the comparison request had been closed during a short interval when the assigned supervisor was not recorded as being in the building. That fact did not prove unauthorized access. Employees could work remotely, use a terminal in another location, or have their accounts operated by authorized colleagues under certain circumstances. But the discrepancy gave the investigators a specific event to examine.
“Who was the assigned supervisor?” I asked.
“Adrian Cole is one possibility. The roster is being reconstructed. We should know more when the personnel archive is compared with the access log.”
I felt both impatience and dread. Every answer created another question, and each question led to a record that might be incomplete. The investigation had reached the point where a single minute in a database could matter more than a whole page of someone's recollection.
That afternoon, Daniel helped me organize the evidence into separate groups. We placed the financial records together, the authorization documents together, and the archive access records in a third folder. The recordings and their transcripts went into a fourth. Evelyn had asked us not to annotate the original copies, so we worked with duplicates and kept a separate index of the references.
As we sorted the pages, Daniel stopped at the archived note from Meridian that said the matter had been cleared by the requesting party's legal representative.
“Whoever wrote this knew it would make people stop asking questions,” he said.
“Maybe,” I replied. “Or they believed the lawyer really had cleared it.”
“You still think Hales might have been telling the truth?”
“I think he may have been telling part of the truth. He admitted that he knew the envelope was being held and that he had contacted Meridian. He also admitted he failed to verify the expanded authorization. We don't know whether he approved the release, whether someone misunderstood what he said, or whether his name was used to justify a decision he never made.”
Daniel leaned back. “That's a lot of possibilities.”
“It is. But we have to find evidence that separates them.”
He looked at the papers for a long time, then placed the authorization copy on top of the stack. “What if the original doesn't match because someone changed the document after you signed the narrow version?”
The question landed harder than I expected. It was one of the possibilities I had avoided considering in detail. A limited authorization could have been altered, replaced, or used as the basis for a broader scan. If that had happened, the original signature might have been genuine while the permissions surrounding it were not.
“We need the original to know,” I said. “The copy alone can't tell us whether the paper was altered before scanning, whether a different document was substituted, or whether the signature was copied onto a new form.”
I added the possibility to our evidence index, clearly marked as an unverified hypothesis. I did not want the idea to become a fact simply because it was frightening.
The following morning, Detective Raines requested another meeting. This time, she wanted to discuss the old access-control report and a separate personnel document that might help identify the account holder. Evelyn drove me to the same neutral office where we had met Helen Mercer.
The detective had a printed timeline on the table. It showed the comparison request being opened, assigned, suspended, and closed. Several timestamps were marked with question symbols because the system clocks had not always been synchronized.
“The status change occurred during a period when the account assigned to the task's supervising unit was not associated with a recorded building entry,” she explained. “We cannot assume the person was absent, because the building log is incomplete and remote access was possible. But the timing is significant enough to investigate.”
“Can you tell whether the account was used from inside Meridian?” Evelyn asked.
“Not from the current record. The server retained the user code and the action, but the network address field is blank in the migrated copy. We are looking for a separate authentication log.”
I studied the timeline. The comparison request had been suspended because the source needed confirmation. Later, the task had been closed. Between those two entries lay the decision that mattered most, but the system had preserved only the result.
“What happened to the authorization after the task was closed?” I asked.
“The expanded release was processed later. The exact interval is established by the surviving records, but we cannot yet show whether the person who closed the comparison task also knew the release would proceed.”
“Could the task have been closed without the comparison being completed?”
“Yes. The status entry and the absence of a comparison result suggest that possibility. We are not yet able to rule out the possibility that the result was stored elsewhere.”
The detective showed us a separate document: a maintenance note from the period when Meridian migrated its archive software. It described a problem with the restricted review folder, including incomplete user-history fields and missing attachments after a system conversion.
“Could the comparison result have been lost during migration?” Evelyn asked.
“Yes. That's one of the explanations we are checking. The migration could account for missing fields and attachments. It would not, by itself, explain why the task was closed before the migration. We need the earlier records to determine what happened at the time.”
That distinction was crucial. A later technical failure might explain why evidence was missing now, but it could not automatically explain the original decision. The system might have lost the comparison result after it was completed, or it might never have recorded a result at all.
“Have you found the original authorization?” I asked.
“Not yet. We have not found a record showing that it was returned to the insurer, destroyed, or transferred to another archive. The courier register is still our best evidence of its arrival at Meridian, but we cannot confirm the contents of the packet.”
I felt the old disappointment settle over me. I had begun to hope that the recovered call and the comparison index would lead directly to the original. Instead, they had revealed the existence of a review process whose outcome was missing.
The detective continued. “There is one encouraging development. A former Meridian systems administrator has agreed to help us interpret the old account records. He believes some authentication data may have been stored in a separate security database rather than the main archive. He is checking whether that database was backed up.”
“Would it show who used the account?” Daniel asked.
“It might show where the login originated, when the session began, and whether a second authentication step was recorded. It would not necessarily identify the person at the keyboard, but it could narrow the possibilities.”
After the meeting, Evelyn took me for a short walk before we returned home. I needed the air, and she seemed to understand that the accumulation of technical details was making it harder for me to think.
“Do you believe Cole closed the review?” I asked.
“I believe his department was involved in the process. I do not yet know whether he personally made the decision. There is a difference between responsibility for a department and responsibility for a particular act.”
“But if he was the supervisor, wouldn't he have been responsible for making sure the rules were followed?”
“Potentially, yes. But we still need to know what he knew, what authority he had, and whether someone used his account or acted outside his instructions. If the evidence eventually establishes that he knowingly closed an unverified authorization, that would be significant. We are not there yet.”
I watched a bus pull away from the curb. People stood at the stop, checking their phones and adjusting bags, unaware that a small collection of old records was slowly reconstructing a decision made years earlier.
“I keep thinking about the caller who contacted my mother,” I said. “The day after the accident, someone wanted to know whether I'd spoken about the documents. That person knew the paperwork mattered.”
“Yes,” Evelyn said. “And the call record gives the police a reason to investigate the people who had access to the records-processing extension. But it still does not establish that the caller was Cole or that the collision was deliberate.”
“I know.”
She waited, allowing me to finish the thought.
“I don't want to turn every suspicious thing into proof. But I also don't want to keep treating each piece as though it has nothing to do with the others.”
“That is exactly what the investigation is trying to determine. The pieces should be considered together, but the connections between them must be demonstrated.”
When we reached the car, my phone vibrated. It was a message from Laura. She had been helping our mother sort through old papers and had found a small envelope tucked inside a folder of insurance correspondence. The envelope was not sealed. On the front, in my mother's handwriting, were the words: Call about work documents.
My pulse quickened. I called Laura immediately.
“Where did you find it?” I asked.
“In the folder Mum kept after your accident. It's mixed in with the insurer's letters and hospital paperwork. There's a sheet of paper inside with a date and a telephone number. Mum says she wrote it down after the call from the man.”
“Does she remember writing anything else?”
“She remembers being upset. She said she wanted to keep the number in case someone called again. She doesn't remember who told her to put it in the folder.”
I asked Laura not to write on the paper or move it unnecessarily. Evelyn advised her to photograph the envelope where it had been found and keep the contents separate until the police could collect them. The number might be the same one already recorded in my mother's notebook, but we needed to establish whether it was a duplicate or a separate contact.
That evening, Laura brought the envelope to Evelyn's office under the agreed evidence-handling arrangements. The paper inside contained the date of the call, a partially written number, and a short line in my mother's handwriting: Asked if she had discussed Northbridge with anyone.
The word Northbridge had been written clearly.
I stared at it until the letters seemed to blur. My mother had not merely remembered that the caller asked about work documents. She had recorded the name of the company associated with the disputed payment. The note had been made close to the time of the call, before the archive recordings were discovered and before anyone had suggested that Meridian might be involved.
“This is important,” Evelyn said, “because it is a contemporaneous note. It supports your mother's recollection without depending entirely on what she remembers now.”
“Does it identify the caller?” I asked.
“No. But it establishes that the caller's question concerned Northbridge specifically.”
I thought of the man in the recording asking about the envelope, the original authorization, and the records. I thought of the first voicemail's instruction to deny that the documents had been received. I thought of my mother being asked whether I had discussed Northbridge while I lay in the hospital, unable to answer for myself.
The caller might have been checking whether I had disclosed something. The caller might have been trying to establish whether my family knew about the documents. There could be another explanation, but none made the question ordinary.
Before leaving, Evelyn made sure the envelope and paper were documented for the investigators. She warned me not to treat the handwriting as proof of the caller's identity or the note as proof of a conspiracy. I agreed, though I could feel my anger growing more focused.
At home, I opened my notebook and wrote the new information beneath the archive timeline.
Mother's contemporaneous note names Northbridge. Caller asked whether I had discussed the company with anyone. Date: day after accident.
Then I returned to the question about the account that closed the comparison request.
Who used the supervisor login, and did that person know the source was unconfirmed?
For months, the paperwork had seemed to be a collection of separate failures. Now the same concern kept appearing in different forms: a question about Northbridge, a warning about the authorization, a comparison suspended for lack of source confirmation, and a release that went ahead anyway.
Someone had known that the source mattered.
Someone had known that I had questions.
And someone had acted as though closing the record would make those questions disappear.
