Chapter 4 - The Digital Forensics
The bridal suite at the estate had been transformed into an incident command room by nine o’clock that evening.
The reception had gone on—not as a somber affair, but as an extraordinary, defiant celebration. Julian’s brothers had opened the vintage reserves from the Henderson cellar; the dancing had been fierce and joyous; and by the time the last guests departed into the Virginia night, Mara had traded her veil and ivory gown for a pair of Julian’s oversized cashmere joggers and a structured black silk blouse.
Her cheek was covered in a thin layer of arnica gel, the purple contusion now deep and dark against her cheekbone.
On the mahogany dining table of the suite sat three laptops, two external hard drives, and a corporate-grade encrypted cellular router. Mara sat in the center chair, her dark hair pulled back into a severe ponytail, her fingers flying across the mechanical keyboard of her ThinkPad with the rhythmic, terrifying speed of an expert who lived in the terminal line.
Julian stood behind her, one hand resting on the back of her chair, setting down a mug of black tea beside her mousepad. Across from them sat Marcus Vance, Mara’s twenty-six-year-old cousin—Beatrice’s youngest son—who worked as a forensic investigator for a regional accounting firm.
"Did you pull the audit logs from the inn's network?" Mara asked without looking up from the screen.
"I didn't even have to break into the hardware," Marcus said, spinning his tablet around. "Arthur is seventy-one years old, Mara. He thinks clearing his browser history deletes files from the universe. He didn't clear the system spooler. The PDF generation engine left an exact cached footprint in the temporary system registry on the Blackwood desktop."
Marcus tapped the glass. "He created the document at 11:14 PM on Thursday. He named the export file `Mara_Clinic_Final_Print.pdf`. He used an unactivated copy of Adobe Acrobat DC that he downloaded through a torrent client three years ago. The metadata on the file doesn't just have your system template ID—it has his personal registered Microsoft Office user profile embedded in the author string."
"Which is?" Julian asked, his voice flat.
"`ArtieVance_Innkeeper`," Marcus replied. "The idiot literally stamped his own digital driver’s license onto the forgery."
Mara leaned back in her chair, staring at the lines of hexadecimal code streaming down her monitor. "That explains the document creation. But that doesn't explain how he got into my private developer directory. That directory is behind MedVance's corporate multi-factor authentication. Arthur can't reset his own email password without calling me three times. How did he pull the raw vector assets for Mount Vernon Health?"
"Look at the access logs for your cloud sandbox," Julian suggested, leaning over her shoulder, pointing at the timestamp column on her screen. "Wednesday, the twenty-second. The night we had dinner at his place to discuss the rehearsal dinner."
Mara clicked through the secure access gateway. Her eyes narrowed.
An active session had been initiated on Wednesday at 8:43 PM—precisely during the hour when Evelyn had insisted on taking Mara up to the attic to look at old family photo albums.
The authentication method was an authorized corporate token generated from Mara’s company-issued iPad.
"He didn't hack anything," Mara whispered, her fingers going still on the keyboard. "My iPad was in my overnight bag in the guest room. It was unlocked. Someone didn't just guess a password—someone who knew how to navigate an iOS directory picked up that tablet, found the local cache of my development sandbox, and AirDropped the template files to the office desktop."
"Arthur doesn't know what AirDrop is," Julian observed.
"No," Mara said, her voice dropping into a lethal, quiet register. "He doesn't. But Tyler does."
Marcus let out a low whistle. "Tyler? Uncle Arthur’s golden boy? He was at the house on Wednesday?"
"He came by to 'drop off firewood,'" Mara said, the memory sliding into place with cold, geometric precision. "He was in the downstairs hallway for twenty minutes alone while Mother had me trapped in the attic. Tyler is twenty-eight, he failed out of Virginia Tech’s computer science program twice, and he currently does contract IT work for the regional water board. He knew exactly what a MedVance developer sandbox looked like."
"And Tyler owes Arthur forty thousand dollars for the bail bond on his second DUI," Marcus added, pulling up a county docket on his phone. "Arthur holds the note on Tyler’s truck."
Julian straightened up. He took out his phone, opened his contacts, and dialed. He put it on speakerphone and set it on the mahogany table.
After two rings, the line connected.
"Henderson," a sharp, gravelly voice answered. It was Thomas Vance Henderson, Julian’s uncle and the senior managing partner of Henderson, Cole & Sterling, the largest litigation firm in Richmond.
"Uncle Thomas," Julian said. "Are you awake?"
"I’m in my study with a scotch, Julian. I’ve been waiting for your call since four o’clock. How is Mara?"
"She has an ice pack on her face and an administrative terminal open on her screen," Julian replied. "We have the metadata. We have the MAC address. We have the IP trace. And we have the co-conspirator who breached her corporate device."
A short, dry chuckle came through the speaker. "Good. Because Arthur Vance just made the worst tactical error of his miserable life."
"What did he do?" Mara asked, leaning toward the phone.
"He didn't go home after the deputies let him out on bail," Thomas said. "He went straight to the Winchester Country Club lounge. He’s been sitting there for the last three hours, showing his copies to anyone who will listen, claiming that you assaulted him when he confronted you with your 'secret medical history,' and that Julian is being held hostage by a manipulative sociopath."
Thomas paused, the sound of a pen clicking rhythmically over the wire.
May you like
"I’ve already drafted the complaints, Mara," Thomas said. "Defamation per se. Intentional infliction of emotional distress. Fraud. Civil conspiracy. And under federal law, the unauthorized access of a protected healthcare technology system under the Computer Fraud and Abuse Act. By noon tomorrow, we aren't just taking his inn. We are going to take the fillings out of his teeth."
---
