It wasn’t a matter of opening a PDF and discovering the identity of a person in its properties.

The team compared versions, transmission records, and device material produced in response to the legal requests.

The altered version traced back to Robert’s home computer.

It had been saved under his user account three days before closing, then sent into the transaction file.

“That establishes the route of the document,” David said.

“It doesn’t show whose hands were on the keyboard by itself.”

“Who had access?”