Who had entered the instructions? Where had the command originated? Could someone authenticate remotely, or copy credentials, or manipulate a logged timestamp? Did the account have permission to authorize transfers at all, or had an administrator elevated it? He could not answer any of these questions yet, but the shape of the problem had changed. The prosecution was asking the jury to believe that a record of access was a record of action and that a record of action was proof of a particular person's intent.
Bennett was skeptical when Elijah brought her the diagram. She had encountered well-meaning family members before, many of whom became convinced that clever reasoning could undo an ugly collection of facts. But she recognized the technical distinction, and she did something that changed the course of their defense. She made room on the conference table, asked him to sit down, and said, "Show me which parts you can actually support."
For two hours, Elijah walked her through the evidence while she interrupted whenever he moved from a fact to an assumption. By the end of the meeting, she had written three specific discovery requests and the name of a forensic computer analyst she hoped a defense fund could afford. "I can't let you practice law," she told him. "But I can listen to a person who understands the records, and I can put legitimate questions in front of the court."
For the first time since his mother had been arrested, Elijah felt he was not entirely alone. Bennett was still exhausted, and they still did not have enough money for an expert, but she had stopped treating his questions as a distraction. She knew the courtroom rules and he could see patterns in the data. Together, they might find an opening that neither could reach alone.
Their first meaningful discovery arrived in a box so heavy the delivery clerk set it on the conference-room floor with a grunt. The city had produced thousands of pages of procurement records, access logs, email messages, scanned receipts, and vendor files. Much of it was irrelevant, some of it repeated, and several directories contained confusingly named versions of the same document. The state's cover letter described the production as comprehensive.
Elijah stared at the boxes without speaking. Bennett looked apologetic. "This is what we have," she said. "The trial judge has given us a short extension, but not much."
He took the first box to the library on a borrowed handcart. That night he created an index, recorded the source of every file, and started comparing the timestamps against the hospital schedules Sarah had carefully saved in a kitchen drawer. Each hospital shift appeared on an official roster signed by a supervisor. The first pattern emerged before midnight: on several days when her employee account supposedly initiated transfers, Sarah was working across the city in a laundry department with a time clock and security cameras.