Maya pointed to one entry. "This says the contractor had access from late evening until early morning."
Rebecca nodded. "That was normal. We scheduled technical work after administrative hours so the evidence office could keep functioning during the day."
"Were you here?"
"Sometimes."
"And when you weren't?"
"A shift supervisor handled access."
"Do the records identify the supervisor?"
"They should."
Lena searched. Some did; others did not. Several overnight entries showed the contractor credential entering the building, but there was no corresponding employee name attached to the access event.
Maya asked, "Would that normally happen?"
Lena shook her head. "Someone from the department should have been assigned to the restricted area."
Rebecca said, "The logs are incomplete. We already know that."
"Which is why we preserve everything that remains," Maya replied.
One of the FBI technicians called Maya over to another workstation. "I found something in the contractor certificate history."
He displayed a list of authentication events connected to Sloan Integrated Systems. The contractor certificate had accessed the network well outside the dates listed on the maintenance schedule.
"How often?" Maya asked.
"Regularly."
"From inside the building?"
"Not always. Some sessions appear remote."
Mercer frowned. "Remote support was included in the contract."
The technician nodded. "Limited remote maintenance was included. These sessions reached more than the documented maintenance environment."
"What kind of access?"
"Evidence indexes, system configuration, retention controls, and portions of the vehicle data interface."
Rebecca stepped forward. "Calvin's company supported multiple city systems. That may be normal."
The technician looked at Maya. "It might be, if there's documentation authorizing it."
Maya asked Lena, "Is there?"
"Not that I've found."