“I don't know yet.”
He paused.
“But I intend to find out.”
The first real break in the investigation came from someone nobody in the command staff had considered important.
She was a thirty-one-year-old civilian data analyst who worked in the department's technology services division.
Her office was small, windowless, and located near a server room on the third floor.
She wasn't a police officer.
She didn't carry a badge.
She didn't attend command meetings.
Most senior officials knew her only as the employee who occasionally sent reminders about password changes and records-access permissions.
But she understood the department's digital systems better than many of the people who supervised them.
She knew how security recordings were stored.
How system access was logged.
How audit trails worked.
And why deleting a file from an interface didn't necessarily remove evidence that the file had existed.
When the commissioner ordered preservation of the entrance recordings, the analyst received the request.
She immediately began working with the authorized investigative team.
The live video from the exterior camera had been available during the confrontation.
But the normal archive contained a gap.
At first, the system displayed the missing segment as a maintenance interruption.
That explanation seemed plausible.
The surveillance network had undergone several upgrades over the previous year.
But the analyst noticed something unusual.
The archive interruption had been activated manually.
Not by the contractor's normal maintenance account.
By an administrative credential associated with headquarters operations.
She examined the relevant logs.
The account accessed the system at 10:29 a.m.
Twelve minutes before the commissioner encountered the sergeant.
At 10:31, the archive configuration for the main entrance camera changed.
The live feed continued operating.
But the ordinary recording destination stopped receiving the relevant data.
The analyst checked the maintenance ticket.
The ticket had been created that morning.
It described an urgent software issue.
But no contractor technician had signed into the system during the relevant period.
She leaned back in her chair.
Then called her supervisor.
“I think we need to preserve more than the camera archive.”
Her supervisor sounded impatient.
“Why?”
“Because the interruption was manually initiated.”
A pause.
“By whom?”
She looked toward the screen.
“An administrative account.”
“Which account?”
She told him.
Silence.
Then he asked, “Are you sure?”
She looked again at the log.
“Yes.”
“Don't make any changes.”
“I haven't.”
“Document what you've found.”
She nodded.
“Already doing that.”