She Fired the Man Who Saved Her Company

Vanessa stared at the file name.

“I've never seen that document.””

Marcus turned the laptop toward her.

“Your account is listed as the last editor.””

“My account is listed as the last editor of dozens of files I never opened. That's how shared workspaces function.””

She leaned forward, examining the metadata.

“This could be an automated sync. Or someone could have copied my credentials.””

Eleanor looked at the forensic specialist.

“Can we establish whether the file was actually opened by Vanessa's account?””

“Not from this summary alone,” the specialist replied.

“We need the document's revision history, the server access logs, and the endpoint records for the device that last modified it.””

Vanessa nodded.

“Then get those records.””

Richard remained silent.

Marcus knew why. The investigation had spent hours circling his daughter, and now the evidence was drawing her back into the center of the case. Richard wanted to believe her. But every time he leaned toward that belief, another record appeared.

Patricia closed the folder.

“Until the file is authenticated, we will not characterize it as evidence of misconduct. The ownership records could explain the attempted transfers, but we must verify their source.””

Marcus looked at the file name again.

“Why would Peter download it while leaving the building?””

“Perhaps because it contains information he wanted to keep,” Eleanor said.

“Or because someone asked him to retrieve it,” Richard added.

Vanessa shook her head.

“You're all assuming Peter is the victim now. He managed the payment system. He controlled the administrative account.

He dismissed the alerts. If anyone had the ability to manipulate these records, it was him.””

“That's possible,” Marcus said.

“But it doesn't explain why the file was last edited under your account.””

Vanessa turned toward him.

“And it doesn't prove that I edited it.””

“No,” Marcus agreed.

“It doesn't.””

His calm answer seemed to frustrate her more than an accusation would have.

The forensic team began recovering the workbook from the archive. While they waited, Marcus requested the full revision history of the Westbridge valuation documents.

Patricia authorized the request.

Within minutes, the specialists had located an earlier version of the file.

The original workbook contained three tabs: valuation, liabilities, and ownership.

The downloaded version contained a fourth tab.

*BENEFICIAL OWNERSHIP — PRIVATE.*

Eleanor leaned forward.

“Open it.””

The specialist hesitated.

“The workbook is protected. We'll need to create a forensic copy before attempting to inspect the hidden sheet.””

“Do it,” Patricia said.

The team generated a verified copy, recorded its hash, and began examining the workbook's structure.

Marcus watched the progress bar crawl across the screen.

He could hear his own breathing. His eyes felt gritty, and the back of his neck throbbed from the previous night's work. Yet the exhaustion had become secondary to the strange, growing certainty that the transaction had been designed to conceal something much more complicated than an ordinary theft.

The workbook opened.

The hidden tab contained a table of corporate entities, registered agents, payment references, and ownership percentages. Some fields were blank. Others had been replaced by coded abbreviations.

At the bottom was a note.

*Do not disclose the final ownership structure until the acquisition closes.*

Richard's expression hardened.

“Who wrote that?””

The specialist examined the cell metadata.

“The note was added during the most recent revision. We haven't identified the individual yet.””

Marcus pointed at a column of reference numbers.

“These match the intermediary accounts.””

Patricia moved closer.

“And these company names match the entities receiving the advisory payments.””

Eleanor scanned the list.

“Then the workbook may contain a map of the money.””

“Possibly,” Patricia replied.

“But we still need to verify the underlying records. A spreadsheet can contain true information, false information, or a mixture of both.””

Vanessa stared at the screen.

“I've never seen this hidden tab.””

Marcus glanced at her.

“Your account edited the workbook.””

“Again, that doesn't prove I opened it. I review acquisition summaries, but the analysts prepare the detailed ownership records.””

Richard spoke quietly.

“Who prepared this file?””

Vanessa hesitated.

“Peter's team.””

“Which analyst?””

“I don't remember.””

Marcus looked at the revision history.

The earliest version had been created by a junior financial analyst named Tasha Green. She had left the company three months earlier.

He recognized her name because she had once asked him how to document a discrepancy when a manager instructed her to close an exception without supporting evidence.

He had advised her to preserve the original record.

A week later, she had resigned.

“Could we contact Tasha?”” Marcus asked.

Patricia nodded.

“Through counsel, yes. But we shouldn't assume she knows anything about the transfer.””

Marcus agreed.

The specialist continued examining the workbook.

A second hidden section appeared beneath the ownership table. It contained a list of payments scheduled across several months, each associated with an internal acquisition reference.

The total was nearly twelve million dollars.

Richard gripped the edge of the table.

“Twelve million?””

“That's the sum of the listed transactions,” Marcus said.

“We need to verify which payments actually occurred and which were merely planned.””

Patricia began dictating the required records to her team.

The boardroom door opened.

James stepped inside, holding a phone.

“We've located Peter Lawson.””

Everyone turned toward him.

“Where?”” Richard asked.

“At a hotel near the airport. He contacted outside counsel and agreed to an interview, but he won't return to the building.””

“Did he say why?””

“He claims he was afraid someone would destroy the evidence if he stayed.””

Vanessa gave a sharp laugh.

“Convenient.””

James continued.

“He also says the Westbridge ownership workbook was created to document a hidden beneficial owner. According to him, he was trying to preserve it before someone could alter the file.””

Patricia frowned.

“Did he identify the owner?””

“No. He said he would only discuss that with counsel present.””

Eleanor looked at Richard.

“Then we arrange the interview and preserve his devices.””

Richard nodded.

“Do whatever is legally necessary.””

James left.

Vanessa leaned forward.

“If Peter is claiming he was protecting evidence, ask him why he dismissed Marcus's alerts. Ask him why he used an administrative account to modify the payment controls. Ask him why he told someone to delete a spreadsheet.””

“Those are exactly the questions he will be asked,” Patricia replied.

Vanessa's face tightened.

“And ask him why he used my account.””

The words hung in the room.

Marcus returned to the revision history.

A small entry near the bottom of the report caught his eye.

The file had been opened at 11:29 p.m. from a workstation in the executive conference suite.

The same suite where Vanessa had appeared on the security footage.

But the access record showed something else.

The file had been opened using a temporary collaboration token created specifically for the Westbridge acquisition.

“Look at this,” Marcus said.

The specialist enlarged the entry.

“The token was issued at 11:27 p.m.,” Marcus continued.

“That means someone established the collaboration session before the file was opened.””

“Who requested the token?”” Eleanor asked.

The specialist checked the audit trail.

“The request came from the acquisition project account.””

“Who administers that account?”” Richard asked.

Vanessa answered quietly.

“I do.””

Richard closed his eyes for a moment.

Vanessa immediately continued.

“But my team uses it. Peter had access. The acquisition analysts had access. I wasn't the only person who could request a collaboration token.””

“Can we identify the device that requested it?”” Marcus asked.

“We're checking.””

The specialist ran another query.

The result appeared a few seconds later.

The collaboration token had been issued from a device registered to Vanessa's office.

Vanessa stared at the screen.

“That device is shared.””

“Who used it last night?”” Eleanor asked.

“I don't know.””

“Who had physical access?””

“Several people.””

Richard looked at his daughter.

“Did you authorize anyone to use that workstation last night?””

“No.””

The answer came too quickly.

Marcus noticed the shift in her expression. It wasn't the same fear she'd shown when Richard displayed the email. This time, she looked genuinely confused.

He returned to the workbook.

“There's another inconsistency,” he said.

“The hidden ownership tab was added after the transfer instructions were created.””

Patricia looked at him.

“Explain.””

“The first transfer instruction appeared at 11:38. The ownership tab was added at 11:51. If the workbook was created to justify the transfer, the timing is backward. Someone added the ownership details after the transaction was already underway.””

Eleanor leaned closer.

“Could that mean the workbook was being altered to cover the trail?””

“Yes. Or someone was adding evidence after discovering the attempted transfer. We need to compare the original file with the server backups.””

Patricia immediately authorized the comparison.

A few minutes later, the specialist returned with the result.

“The hidden ownership tab does not exist in the earliest backup. It was added in the most recent version.””

“By whom?”” Richard asked.

The specialist enlarged the editor field.

The name appeared.

Tasha Green.

Marcus stared at it.

Tasha had left the company three months earlier.

She should not have had access to the acquisition project account.

Vanessa slowly shook her head.

“That is impossible.””

Patricia looked at the timestamp.

“The account was reactivated last night.””

Richard's voice dropped.

“By whom?””

The specialist opened the authorization record.

The reactivation request had been approved through a credential assigned to the audit committee chair.

Eleanor stood abruptly.

“That credential is mine, but I did not authorize any reactivation.””

Nobody spoke.

Marcus looked at the hidden ownership tab, the dormant employee account, and the series of transactions that had been disguised as acquisition expenses.

The investigation had begun with Vanessa's email.

It had led to Richard's credentials, Peter's administrative account, and a former employee's reactivated access.

Now it had reached Eleanor.

The boardroom door opened again.

A security officer handed Patricia a sealed envelope.

“Ms. Greene, this was delivered to reception for you. The sender requested that it be opened in the presence of the audit committee.””

Patricia examined the envelope.

There was no return address.

Inside was a single printed page.

At the top was the title of the ownership workbook.

Beneath it was a sentence typed in bold.

*If you want to know who owns Westbridge, stop investigating the people who moved the money. Investigate the person who approved the acquisition.*