Story code: ST-001386
Part 2: The Metadata Check
Sarah Miller took a slow breath, her shoulders remaining straight as she looked at the glass. ‘Officer, my phone has a screen-time tracker that logs every app open and close. I handed my device to your colleague at the front desk when I walked in. I have nothing to hide.’ Marcus let out a short, sharp laugh, his fingers tapping rapidly against the metal counter. ‘Of course she says that now. She had all night to clean her device. That backup drive doesn’t lie. The files were deleted, and the backup captured the exact state of the folders.’ Officer Davis did not look up from the terminal screen. He adjusted his glasses and pointed to the log file on the monitor. ‘Mr. Vance, you stated you retrieved this backup drive immediately after the deletion occurred at ten o’clock last night. Correct?’ ‘Yes,’ Marcus said, his voice rising in pitch. ‘I saw the notification, saw the files were gone, and ran the backup tool to secure the evidence before it was lost forever.’ ‘Then please explain this,’ Davis said. He turned the auxiliary monitor slightly toward the counter so Marcus could see the interface. I clicked on the master file table directory. The screen highlighted the drive’s hardware initialization records. The physical creation timestamp of the backup directory on the USB drive was logged as today at 7:30 AM. Marcus squinted at the monitor. His tapping hand stopped. ‘Like I told your clerk, that’s just a timezone discrepancy. The server is on UTC, or maybe the drive’s internal clock is set to a different region. It doesn’t change the fact that she deleted the files.’ ‘Our terminal automatically normalizes all metadata to local standard time using the precinct’s network clock,’ I said, keeping my voice flat. ‘The drive registers a write-operation at seven-thirty this morning, local time. It was formatted and populated three hours ago.’ Sarah turned her head slightly to look at Marcus. Her expression remained blank, but she did not speak. Marcus’s face flushed. He pulled a leather portfolio from under his arm and laid it on the counter. ‘You’re looking at the wrong directory. Look at the temporary folder. The files were cached there. She’s the only one who had the credentials to access that directory.’ I ran a hardware signature query on the drive’s root folder, typing the command to pull the media access control address of the machine that authorized the file transfer. The terminal began processing the query, a small progress bar ticking across the bottom of the screen. Marcus blinked, his eyes darting to the terminal screen and then to Davis. ‘That’s impossible. I didn’t write those files. The system must have logged my access when I plugged the drive in to check it before coming here. That’s a standard read-write mounting error.’ Officer Davis leaned back, crossing his arms. He watched Marcus’s hands, which were now gripping the edge of the counter. ‘If this was an automatic backup of her deleting the files last night, Mr. Vance, why does the registry show your own laptop’s hardware signature logged the writing of these files just three hours ago?’