Chapter 4 - THE USB DOESN’T SOLVE ANYTHINGNathan wanted the USB to be a confession.
Not Daniel’s.
Ryan’s.
He wanted one clean file named READ THIS.
One video.
One voice.
One perfect answer.
He got spreadsheets.
Thousands of lines of archived server logs.
Old transaction IDs.
User sessions.
Backup files.
Fragments of emails.
Three encrypted folders.
That was all.
Digital forensic specialist Priya Desai explained it to Marisol while Nathan sat outside a glass wall pretending not to watch.
The USB had been assembled from multiple sources.
Some files appeared to be genuine CareBridge exports from nine years earlier.
Others had been copied more recently.
No guarantee who created the drive.
No guarantee Daniel authored any notes.
Chain of custody before Evan handed it to Nathan was unknown.
Useful.
Not magical.
Marisol eventually briefed Nathan on what she could.
The first transfer had been authorized through Daniel’s login token.
The workstation identifier belonged to an office computer.
Device fingerprint did not match Daniel’s company laptop.
Could Daniel have used the office workstation?
Yes.
Could someone else have used his credentials?
Also yes.
The USB proved neither.
What made it interesting was timing.
At 11:58 p.m., the system recorded a transfer instruction.
Daniel’s hospital bracelet archive showed a monitor reading at 12:17 a.m.
Twenty-minute gap.
Possible.
But the hospital was twenty-eight minutes from CareBridge at night.
Without traffic.
That made physical travel difficult.
Not impossible if either timestamp was wrong.
Marisol subpoenaed hospital archives.
The current electronic record showed Daniel discharged at 10:41 p.m.
That fit the old theory perfectly.
Hospital.
Release.
CareBridge.
Transfer.
Disappear.
But the bracelet data contradicted it.
Priya found something else.
A second authentication event occurred at 12:03 a.m.
Multi-factor verification.
Back then CareBridge used a hardware token system.
The event ID showed Daniel’s token number.
That meant whoever moved the money had more than a password.
They had access to his token.
Or a copy.
Nathan remembered Daniel carrying the little plastic device on his keychain.
Then Marisol asked the question he did not want.
“What happened to Daniel’s keys after his car was found?”
Nathan thought.
“Police recovered some.”
“Token?”
“I don’t know.”
She pulled the old evidence inventory.
Wallet.
Car key.
Apartment key.
Loose change.
No hardware token.
Missing.
Ryan had told detectives Daniel probably took it when he fled.
Reasonable.
Unless someone else had it.
Nathan said:
“So Ryan stole the token.”
Marisol gave him a look.
“Stop.”
“I’m thinking.”
“You’re concluding.”
He hated her.
She was usually right.
Ryan’s attorney, meanwhile, delivered a formal statement.
Ryan admitted knowing Daniel had reappeared.
Not for nine years.
For less than two weeks.
He claimed Evan mentioned a stranger at the cemetery.
Ryan initially believed the man was a scammer.
Then he found the hospital bracelet in Evan’s room.
Ryan panicked because he believed Daniel was dangerous and trying to manipulate the boy.
That was why he took Evan’s phone.
That was why he locked the basement.
“Temporarily,” his lawyer emphasized.
Marisol asked:
“Why did Mr. Bennett believe Daniel was dangerous?”
“Daniel stole from CareBridge and disappeared.”
“Did Mr. Bennett contact police after learning he was back?”
“No.”
“Why?”
“He was protecting Evan.”
“From a potentially dangerous missing person by not calling police?”
The lawyer did not enjoy that question.
Ryan’s account had another problem.
He claimed he first realized the bracelet existed after seeing it in Evan’s room.
But Evan said Ryan saw it in his pocket that afternoon.
Small difference.
Potentially stress.
Potentially lie.
Marisol preserved it.
Then came the hospital records.
St. Matthew’s had migrated systems twice.
The official discharge time remained 10:41 p.m.
But archived nursing notes—scanned images, not editable fields—showed medication administered at 11:23 p.m.
A radiology log showed Daniel’s CT scan began at 11:38.
Completed 11:52.
That made the transfer at 11:58 almost impossible.
Nathan stared at the scan timestamp.
Six minutes.
Six minutes from a CT table to CareBridge headquarters twenty-eight minutes away.
No.
Unless Daniel had authorized remotely.
But the workstation was on-site.
Marisol said:
“This does not identify who used the workstation.”
Nathan nodded.
For once he did not jump.
“Could someone have remotely accessed it?”
“Priya’s checking.”
“What about the discharge time?”
“Someone changed it.”
Nathan looked at her.
“You know that?”
“Archive audit shows original entry overwritten.”
His mouth went dry.
“When?”
“Three days after Daniel disappeared.”
“By who?”
“Old user ID.”
“Name?”
Marisol shook her head.
“Not yet.”
Nathan stood and walked to the window.
Nine years ago, police used that discharge time to establish opportunity.
Daniel had left the hospital before the transfer.
At least, everyone thought he had.
“What else on the USB?”
“Encrypted folders.”
“Can you open them?”
“Eventually.”
“Password?”
“Unknown.”
Nathan laughed bitterly.
“Of course.”
Marisol joined him at the window.
“You wanted it to solve everything.”
“Yes.”
“Good thing it doesn’t.”
He looked at her.
“Why?”
“Because if one drive could rewrite nine years by itself, one drive could also lie.”
Nathan understood.
He did not like it.
But he understood.
The truth would need independent support.
Hospital.
Servers.
Witnesses.
Property.
Financial records.
People whose interests conflicted.
Pieces that did not know they were supposed to agree.
Then Priya called.
Marisol answered.
Listened.
Her expression changed.
“What?”
She put the phone on speaker.
Priya’s voice came through.
“I found a user map from the old CareBridge admin system.”
Nathan leaned closer.
“And?”
“The workstation used for Daniel’s transfer was inside the executive finance suite.”
Ryan’s suite.
Nathan’s heartbeat accelerated.
Priya continued.
“But Ryan wasn’t the only person with access.”
“Who else?”
“CFO account holder.”
Marisol grabbed a pen.
“Name?”
Priya answered.
“Miles Arden.”
Nathan had not heard that name in nearly nine years.
CareBridge’s former chief financial officer.
May you like
The man who resigned six weeks after Daniel disappeared.
And vanished from Nathan’s memory almost as completely as Daniel had vanished from Texas.
Related Stories
