“That’s the executive hallway camera,” I said.

“Yes, but the metadata on the raw server log shows it was modified yesterday afternoon at four o’clock,” she said.

“That’s right before the board meeting,” I said, my mind racing. “Who modified it?”

“The user ID is listed as ‘ADMIN_ST_09’,” Koko said. “That’s not a standard IT login. That’s a high-level administrative override.”

“That login belong to Victoria’s personal assistant,” I said, a wave of cold anger washing over me. “I saw her use it during the quarterly audit.”

“There’s more,” Koko said. “The actual video footage they used to show you entering Andrew’s office… it wasn’t recorded yesterday.”

“What do you mean?” I asked.

“The original clip was pulled from the archive,” Koko said. “It was recorded three weeks ago, on the night you stayed late to help Andrew prepare the presentation for the French delegation.”

“I remember that night,” I said. “I went into his office to drop off the translated files.”

“They took that footage, cropped out the folders in your hands, and spliced it onto yesterday’s timestamp,” Koko said. “They literally copy-pasted you into a different date.”