Chapter 5 - THE RED FOLDER
Police did not arrest Paul because he owned gray boots and a silver SUV.
They obtained surveillance, phone-location records, company work logs, and a warrant after the preschool data and neighbor video strengthened the connection.
Paul’s vehicle GPS showed a gap between 1:21 and 2:08 p.m.
He claimed the tracker lost signal.
A traffic camera captured a silver SUV matching his near Megan’s neighborhood at 1:43.
The image was not sharp enough to identify the driver.
A search of Megan’s house continued under a warrant limited to evidence related to the assault, confinement, financial crimes, and missing documents.
Investigators found overturned furniture, broken cabinet doors, and the open lockbox in Noah’s room.
The living room router had been unplugged.
The home-security hub was smashed.
Megan’s laptop remained on the kitchen counter with its hard drive removed.
The red folder was gone.
A piece of it remained beneath the dresser.
On the paper were handwritten notes from Megan’s attorney:
Freeze Noah credit.
Revoke pickup.
Protective order filing Friday.
Contact Luke after account confirmation.
The plan had been interrupted one day before formal filing.
Inside Travis’s truck, officers found a crowbar, three empty energy-drink cans, several pills in an unlabeled bottle, and a printout of my work calendar.
The calendar showed the quarterly budget meeting from 2:00 to 4:00 p.m.
The entry was highlighted.
Beside it, someone had written:
First call ignored.
Second call maybe.
Twenty-minute response minimum.
My skin went cold when Aaron showed me the photograph.
“This was planned.”
“It appears someone considered your availability,” he said carefully.
“Travis knew Noah had the phone.”
“Megan?”
She shook her head.
“I thought the phone stayed in Noah’s backpack. Travis knew Luke gave it to him, but I never explained the two-call rule.”
I had explained the rule to Noah at my house.
Only Olivia and my mother had been present.
Unless the phone itself had been monitored.
The old device belonged to my account. It contained no social-media apps and only limited data. Police preserved it for forensic examination after obtaining consent from me and appropriate authorization relating to the investigation.
The call logs were simple.
Two calls to me.
One attempted call to Megan.
A failed 911 dial.
Then another entry appeared.
At 1:46 p.m., a remote-management profile had activated the phone’s microphone.
The profile belonged to a service called FamilyGuard Monitor.
I had never installed it.
Megan had not.
The profile was created four months earlier using an administrator email ending in kanesys.net.
Paul’s company.
Someone had been able to hear Noah’s environment, track the device, and possibly know when he reached the closet.
The old phone had not merely saved him.
It had been part of the surveillance around him.
The financial evidence developed more slowly.
Megan provided Noah’s Social Security card, birth certificate copies, and bank alerts. I supplied records for the custodial savings account my parents created after Noah’s birth.
The account held forty-two thousand dollars, mostly gifts and part of an inheritance from my grandmother.
Megan and I were joint custodians under the account terms.
Neither Travis nor Paul had authority.
Eight months earlier, the mailing address changed from mine to a post-office box.
The change request carried my digital signature.
I had not signed it.
Two withdrawals totaling eighteen thousand dollars followed. The money entered a business account belonging to Kane Systems Integration and then moved into several smaller accounts.
Paul claimed the payments were for home-security work Megan authorized.
Megan denied hiring him.
No invoices existed.
A second credit account had been opened under Noah’s identity using his Social Security number and an adult date of birth. The lender’s verification process failed to detect the mismatch immediately.
The application listed Paul’s office as the employer address.
The email used Noah’s first and middle initials.
The recovery phone belonged to Travis.
The money trail supported identity theft and financial exploitation allegations.
It did not explain the full plan.
Megan’s attorney believed the red folder contained the most damaging document: a printed email in which Travis asked Paul whether “the child account would cover the legal retainer after Luke was removed.”
Removed from what?
Custody?
The financial account?
The house?
No one knew.
At my office, Meridian Freight began an internal review. Paul’s company had provided access-control maintenance and printer security.
My calendar could have been obtained through a compromised account, an internal contact, or a device during servicing.
The company’s information-security director, Helen Brooks, told me not to assume the source.
“Vendors had limited access,” she said. “Limited does not mean none. Employees also had access to your calendar.”
“Who?”
“Your manager, department assistant, meeting participants, IT support, and anyone using a compromised credential.”
The list included twelve people in the conference room when Noah called.
Helen asked whether I had noticed anything unusual before the meeting.
I remembered Dean Harrow asking me to leave my laptop connected to the presentation system during lunch.
I remembered a contractor working near the printer.
I remembered my calendar invitation being revised twice.
None became proof.
When I returned home, Noah was sitting at my kitchen table drawing a closet with a blue door.
My mother stayed nearby under the temporary safety plan while Megan attended an interview.
Noah added a gray figure outside the house.
Then he drew a smaller black shape beside the figure.
“What is that?” I asked.
He looked at me.
“The bag he took.”
“The red folder?”
Noah shook his head.
“He already had that.”
I waited.
“The gray man took your work card.”
My employee badge had never been missing.
I checked my wallet.
The card remained there.
Then I remembered Meridian had issued me a replacement badge after the original failed six months earlier.
IT told me the defective badge had been destroyed.
May you like
If Paul had the old card, it might still contain identifiers capable of being cloned.
The first theft from Noah’s account occurred one week after my badge was replaced.
