"You are very irritating."
"I've been told."
The call ended more warmly than it began. That evening, Marcus checked out of the hotel and moved into the small townhouse he had rented near the river. His boxes were still stacked against walls. The refrigerator contained mustard, bottled water, and nothing that qualified as dinner. He ordered takeout and ate at a folding table while the television repeated images of Westbridge headquarters.
A reporter interviewed Reigns outside the building.
"I can't comment on an active investigation," Reigns said solemnly, "but I can say I trust the truth. I've served this community twelve years, and I have faith that facts will clear my name."
Marcus watched without anger. That was not entirely true. He felt anger, but it had lost its heat. It now felt like pressure behind a sealed valve, useful only if directed. At 9:11 p.m., his personal phone buzzed with a text from an unknown number.
CHECK THE BACKUP PARTITION BEFORE THEY WIPE IT. Marcus stared at the message. He did not reply. He forwarded it to his attorney and the independent investigator assigned to his administrative review. Then he turned off the television and went to bed.
The forensic team began at 6:00 the next morning. Detective Sarah Kim was not permitted inside the room because of her previous involvement. Neither were Marcus, Reigns, Voss, Hayes, or any supervisor from Westbridge. The city had brought in a county cybercrime analyst and a contracted forensic examiner from the state municipal risk pool. They imaged the relevant servers before examining anything live.
They collected Marcus's workstation drive, authentication token history, network logs, building-entry data, and the complaint-management database. They also preserved a write-once archive partition installed eighteen months earlier after a ransomware scare. Nobody at first understood why that last system mattered. The primary complaint database showed Marcus's credentials accessing restricted files late at night. The immutable archive showed something else.
Marcus's genuine authorized access had occurred at 10:12 a.m. two days earlier, from the captain's office terminal, during the period he was physically present at headquarters. Each session had a valid command authorization and matched network-switch records. The after-hours access was created later. At 11:49 p.m., an administrative account entered the database and altered the displayed audit entries. It did not change the archive because the archive could not be rewritten from ordinary department credentials.
The administrative account belonged to Calvin Voss. That alone still did not prove Voss had personally typed the commands. Passwords could be stolen. Sessions could be hijacked. Then the forensic team checked the network source.
The changes originated from the supervisor workstation in Voss's office. Building-access records showed Voss entering headquarters at 11:31 p.m. and leaving at 12:46 a.m. Hallway video showed him walking into his office at 11:36 carrying a laptop case. No other person entered the room before the alterations began. The team then examined the system used to create the internal memorandum accusing Marcus of improper access.
Its metadata showed the draft had been created before the alleged misconduct occurred. At 9:14 p.m. More than two hours before the fake database entries appeared. By 1:40 p.m., the question was no longer whether Marcus had altered the records. The question was why Calvin Voss had apparently prepared an accusation before manufacturing the evidence to support it.
Marcus received a call from Deputy Chief Morrison at 2:06.
"Come to city hall."
"Am I restored?"
"Come hear the report first."
The meeting took place in a conference room with the mayor, city attorney, Morrison, two forensic examiners, and Marcus's own counsel present. The county prosecutor joined by video. Marcus listened without interrupting as the analysts explained every step. They showed his legitimate accesses. They showed the forged log entries.
They showed the administrative session from Voss's workstation. They showed the pre-dated accusation memo. Then they showed something Marcus had not expected. During the same late-night session, somebody accessed the body-camera maintenance database and attempted to add a retroactive fault notation to Reigns's camera. The notation claimed the unit had been reported unreliable two days before Marcus was stopped.
The immutable service log showed no such report.
"So the body-camera excuse was being backfilled too," the city attorney said.
The forensic examiner nodded. "That's what the evidence indicates." The prosecutor leaned toward her camera.
"Captain Ellison, your administrative leave is a city personnel matter, but from a criminal-investigative standpoint, I have no basis to consider you a suspect in the records alteration."
Mayor Porter looked at Morrison.
"Restore him."