Elijah took the thumb drive home under Bennett's instructions. He copied the materials into a read-only working directory, logged their file names and creation dates, and began sorting them with a script he wrote on his laptop. The sorting found hundreds of duplicates and fragments of emails that referred to attachments not included in the indexed production. Several files had been renamed with meaningless strings, and the city supplied no coherent explanation of how they related to the forensic summary.
At two in the morning he was still searching. Sarah came into the kitchen wrapped in an old sweater and found him leaning over the screen. She put a hand on his shoulder and looked at lines of numbers that blurred together to her. "Did you find it?" she asked. Elijah wanted to say yes, but he could not tell her a comforting story merely because she needed one.
"I found gaps," he said. "I don't know yet what they mean."
Sarah heated leftover soup and sat beside him while he ate. She did not ask another question. When he finally lay down near dawn, he dreamed he was running through a building with endless locked doors, each one opening onto another corridor. The sound following him was Pierce's voice repeating that his mother's account had authorized the transfers.
On the fourth morning, the prosecutor introduced Exhibit 42. The presentation appeared simple enough to end the dispute: a sequence of supposedly authenticated digital approvals with Sarah's user identifier, transaction references, and timestamps arranged in a clean table. Each line was paired with an invoice and a bank transfer. Pierce described the exhibit as the most direct account of the fraud and let the jurors study it in silence.
Elijah noticed the problem immediately. The timestamps were consistent internally but did not align with the underlying workstation access logs or with several hospital shifts. One transfer appeared to have been initiated at a moment when Sarah was recorded entering the hospital's secure laundry wing. Another carried a device identifier from the fourth-floor municipal terminal despite the fact that Sarah's access badge had never opened that floor.
He passed Bennett a note. She reviewed it, then rose and asked for a hearing outside the presence of the jury concerning the accuracy and completeness of Exhibit 42. Harrison granted a short recess and instructed the jurors to leave. Pierce closed her folder with visible irritation, as though the defense had asked to delay a train that was already moving.
With the jury gone, Bennett told the judge the defense had identified discrepancies in the government's summary and needed the underlying technical records authenticated. Harrison asked whether she had a qualified expert ready to testify. She explained that the public defense allocation had not covered the full forensic examination they had requested and that the records had arrived late. Elijah stood beside her with a stack of printouts he had worked through overnight.
"Your Honor," he said after Bennett signaled him, "these are not just different interpretations. The device identifier in the exhibit belongs to a workstation my mother could not physically access. The login record can be genuine and still identify the wrong human being."