Eleven Seconds of Missing Audio, Forty-Seven Corrupted Exhibits, and the AOC Archive That Never Forgets: How a Digital Evidence Administrator’s Hash Log Stopped a Contract Renewal Cold

Eleven Seconds of Missing Audio, Forty-Seven Corrupted Exhibits, and the AOC Archive That Never Forgets: How a Digital Evidence Administrator’s Hash Log Stopped a Contract Renewal Cold

I am the digital evidence systems administrator for a county superior court, and on a Monday morning at 09:30 I ran a SHA-256 cross-check on a homicide-case body-camera exhibit and found that the file my chain-of-custody manifest had been carrying for nine months was not the same file we had ingested at the scene. My name is Marisela Fenton. I am the court’s digital evidence systems administrator. Rhonda Kirby treated my chain-of-custody manifest as a sticker on a file her module had already decided to deliver—and she forgot the AOC archive remembers what the redaction tool deleted.

It was 09:30 on a Monday morning. Through the glass wall of my office, I could see across the rotunda to the clerk’s window. The standing courthouse docket call was beginning. Defense counsel were pulling exhibits for the day’s hearings. 09:30 has always meant one thing: the courthouse opens. It is the hour the system works.

“Watch the frame count on the ingest side,” I told David. He was a junior IT specialist, three weeks on the job. The hum of the server room cooling fans vibrated through the floorboards. The air smelled faintly of ozone and floor wax. David leaned closer to the monitor. We were pulling a body-camera file from a sheriff’s patrol unit upload. I highlighted the chain-of-custody label on the screen.

“The vendor module will read the metadata,” I said. “We don’t trust the vendor module. We capture the codec parameters, the frame-count, and the audio-sample-count log right here. Then we generate the original-source hash .” I hit the execute key. The progress bar crossed the screen. A thirty-two character alphanumeric string appeared in the terminal window. I pointed to the secondary acknowledgment tag flashing green at the bottom corner.

“That means it landed in the AOC archive,” I said. “The Arizona Supreme Court’s write-once storage. It runs entirely independent of any vendor module we use for redaction or playback.”

David wrote it down in his notebook. “Why keep it separate?”

“Habit from a job in 2016,” I said. “A vendor rolled back a hash log during a server migration, and we couldn’t prove what we had ingested. The AOC archive means we never have to ask the vendor what they gave us. We already know.”

I stepped back from the workstation. I let him run the next test exhibit. He was slow, but he typed the parameters correctly.

Four months earlier, I stood at a podium in Phoenix. The Arizona Court IT Association’s annual conference was in its second day. The ballroom smelled of stale banquet coffee and dry erase markers. My session was titled “Redaction-Tool QA in Body-Camera Evidence Pipelines”. I advanced the slide. A spectrogram of an audio file filled the screen.

“A poorly configured redaction module does not announce its errors,” I told the room. “It drops frames. It clips audio samples. It does this silently during the masking pass for witness faces or juvenile identifiers.”

I walked them through three case studies. I showed them the math of a 48 kHz audio track and how an automated face-blur script could swallow eighty milliseconds of sound without throwing an error code.

A public defender in the third row raised his hand. “If a redaction artifact alters the timeline, what happens to the legal status of the chain-of-custody manifest?”

“The manifest certifies the custody of the file,” I said. “If the file is altered outside of a documented redaction log, the manifest is certifying a different piece of evidence than what was collected.”

I watched the presiding judge of an adjacent county take notes. I answered two more questions. I packed up my laptop.

Rhonda Kirby had stood in the doorway of my office two years ago. She was the on-site Project Manager for Tetragon Civic Solutions, our contracted records vendor. Beside her stood a seventeen-year-old girl with a green canvas backpack.

“Marisela, this is Cassie,” Rhonda said. “My daughter. Today is day one of her high-school IT internship.”

Cassie shifted her weight. She smelled faintly of green apple shampoo. She looked at the server racks humming behind the glass.

“Marisela’s the only person in this courthouse who can read SHA-256 in her sleep,” Rhonda told her. “If you can keep up with her, you’ll work anywhere.”

I pulled a chair over to the workstation. I told Cassie to sit. Over the next six weeks, I taught her how digital evidence moved through a legal system. I taught her the difference between an encrypted drive and a secure network layer. When she left for college the next year, she chose computer science as her major. I had liked Rhonda for the simple fact of bringing her daughter to my workplace to learn from another woman.

The email arrived on a Friday morning. It was from a defense investigator assigned to State v. Padron. A first-degree homicide case. Ms. Fenton, the email read. The audio on the body-cam exhibit drops out for ~11 seconds during the shooting scene. Is that a redaction or an artifact? We need to know which it is.

I read the lines twice. I placed my coffee cup on the desk. I opened a reply window. I will pull the original ingest log, I typed. I hit send. I did not pull it yet. I looked out through the glass wall of my office. 09:30 had arrived. Across the rotunda, the defense attorneys were lining up at the clerk’s window to pull their exhibits for the day.

I sat at my desk on Friday morning. The courthouse was just beginning to wake up around me. My coffee was still hot in the ceramic mug. I opened the AOC archive in my left browser tab. I opened the DEMS export log in my right tab. The email from the defense investigator sat minimized at the bottom of my screen, asking about an eleven-second audio drop in a first-degree homicide case.

I pulled the original ingest hash for the State v. Padron body-camera exhibit from the AOC write-once archive. I copied the thirty-two character string. I pasted it next to the post-redaction hash from the DEMS export log. I ran the comparison. The hashes did not match. I clicked into the file properties. The original ingest file had a specific frame count. The post-redaction file had a different one. The frame count differed by 167 frames. I moved my cursor to the audio stream properties. The audio sample count differed by 528,000 samples. I did the math in my head. At a standard 48 kHz sampling rate, 528,000 samples was approximately 11 seconds of sound. Eleven seconds gone from the shooting scene.

I pressed both palms flat against the laminate surface of my desk. The plastic edge bit into my wrists. I needed to steady my hands. I did not yet understand the scope of what I was looking at. I stood up. I pushed my chair back and walked out into the rotunda to breathe the conditioned air.

Nine months earlier, I had been the one to log that file. It was 02:45 AM on the night of the Padron shooting. I sat at this same workstation in the after-hours quiet of the courthouse. The rotunda was dark except for the security perimeter lights casting long shadows across the tile. I received the original upload directly from the sheriff’s patrol unit. The deputies had been standing in my doorway, smelling of sweat and adrenaline, waiting for the transfer to clear.

I ran the ingest hash. I watched the green verification bar fill the screen as the file landed securely in the AOC archive. I pressed my thumb hard against the sharp edge of the desk to keep myself awake. The metal corner left a deep indentation in my skin. I opened the database. I typed the chain-of-custody manifest entry. I assigned the tracking number. I signed my name as the custodian of record. I did not yet know what the file contained. I closed the workstation and walked out into the rotunda’s dim night light.

Two years ago, I stood at the whiteboard in my office with Cassie Kirby. I was showing her how a SHA-256 algorithm worked. She sat in the guest chair, her green canvas backpack on the floor, taking notes in a green spiral notebook. Rhonda had stopped by to check on her, waving from the doorway with a stack of vendor files in her arm. I wrote a simple string of text on the board. Then I wrote the sixty-four character hex output below it.

“Change one comma in the original file,” I told Cassie, pointing at the board, “and this entire output changes completely. It is absolute. It doesn’t care about context. It only cares about math.”

I handed her the dry erase marker so she could try calculating a simplified block herself. She took it, her fingers brushing the plastic casing. I liked Rhonda for the simple fact of bringing her daughter to my workplace to learn from another woman. I watched Cassie cap the marker and place it perfectly parallel to the eraser. I invited them both to lunch.

On Saturday afternoon, I sat at my home office. My laptop was open on the kitchen table. From the next room, I could hear the television. My husband was watching a basketball game. The whistle of the referee and the squeak of sneakers on hardwood drifted through the open door.

I had written a script to run a hash comparison batch across nine months of redacted exhibit exports. The batch took four hours to process. I sat in the wooden chair and watched the progress bar inch across the screen. I pressed my hand against the top of the laptop. The casing was warm against my palm.

The script finished. The terminal output generated a list. Forty-seven mismatches. Forty-seven exhibits across forty-seven different criminal cases showed frame or audio sample count discrepancies. The pattern was not random. It was concentrated heavily in MOV-encoded files, which was standard for a particular body-cam manufacturer model. Tetragon’s redaction module was silently corrupting the output for that specific codec during the masking pass.

I sent the document to the network printer. I listened to the rollers engage. I pulled the pages from the tray and printed the list. I stared at it. I folded the pages into a standard white envelope. I did not call Rhonda. I returned to the laptop.

I opened a new connection portal. I pulled Tetragon’s job-log archive directly from the DEMS module’s admin console. I navigated to the workflow configuration settings. I needed to see how the system was bypassing the fail-safe.

The post-redaction hash recheck step had been set to “skip”. The timestamp on the configuration change was from February 2026. The change was cryptographically signed in Rhonda Kirby’s vendor admin account. I pulled the corresponding help-desk ticket from the Tetragon engineer. The text was plain. “Backlog under SLA – disabling post-hash recheck per PM. Reconfirm Q3.” The reconfirmation never happened.

I looked at my phone calendar. Tuesday morning at 09:30 was blocked out. The Pinal County oversight hearing was scheduled for that exact hour. Tetragon’s contract renewal was the second item on the agenda. Rhonda would be the contractor’s representative on the stage. I was on the agenda to deliver the system custodian status report.

The same 09:30 that had always meant the courthouse opens was now the hour the redaction module’s contract was scheduled to roll forward. 09:30 had weight now.

I closed the AOC archive window. I exported the forty-seven-entry hash mismatch table to an encrypted USB drive. I picked up my phone. I photographed the Tetragon job-log screen showing the “skip post-hash recheck” configuration change. I opened the AOC Court Services Division Emergency Preservation Request portal. I did not call Rhonda.

It was 21:42 on Sunday evening when I submitted the AOC Emergency Preservation Request. I did not call Rhonda. I did not call the County IT director. The IT director was the contracting officer’s reporting peer. I printed the case-number receipt. I folded it sharply. I placed it into the same white envelope as the forty-seven-entry list.

The email arrived in my inbox at 06:55 AM on Monday. I was sitting at my kitchen island, a cup of black tea cooling next to my laptop. The morning was quiet. The cursor blinked over the unread message. It was from Rhonda Kirby. I clicked it open.

“Saw you’re on the agenda tomorrow,” the email read. “I told the Presiding Judge you’d walk through Q3 system stability personally before the contract vote. Helps to have the court’s voice on it rather than just the vendor. Thanks for being a partner on this.”

I read the text again. I set my mug down. The ceramic clicked sharply against the granite counter. I had roughly twenty-six hours to either appear on that stage as the credentialed endorsement of her contract renewal, or trigger the AOC Emergency Preservation Order before 09:30. I looked at the signature block at the bottom of her email. I saw the signs two years ago when she first took over the module. She had asked me to expedite a batch of files and bypass the secondary hash check for a weekend arraignment. I said no, and she smiled and called me a stickler. I chose to believe her respect for the system was the same as mine.

Over the last nine months, I signed forty-seven chain-of-custody manifests. I let my name be the rubber stamp for her turnaround optimization. I allowed my credential to be the cover for her SLA conformance because she was Cassie’s mother and she smiled when she asked. I watched the vendor module output metrics instead of reading the archive logs, and I handed prosecutors eleven truncated seconds of a homicide. I accounted for those months now. They belonged to me. I drove to the courthouse.

I logged into the AOC portal from my workstation. The Emergency Preservation Request I submitted at 21:42 Sunday still showed as pending. I sat at my desk and watched the defense attorneys line up in the rotunda through the glass wall. The clock moved forward. The green ‘pending’ badge on the portal remained a flat, unmoving rectangle. At 11:18 AM, the portal status updated to acknowledged.

I opened the notification. It contained a tracking number. It did not confirm whether the Emergency Preservation Order would be served before 09:30 Tuesday. I was still on the agenda. Rhonda was still on stage. I closed the portal.

At 14:20 that Monday afternoon, Rhonda stood inside Tetragon Civic Solutions’ Pinal County field-office trailer behind the courthouse. The trailer smelled of industrial carpet and the sharp ozone of running servers. She stood at her standing desk, reviewing the contract-renewal slide deck. The pending contract was worth 4.2 million dollars across four years. The slide deck on her monitor showed nine months of “100% SLA conformance” on redaction turnaround.

She was on a phone call with her national account director, walking through the value proposition. She shifted her weight. She was relaxed. She was thinking about the bonus structure on the renewal.

“Marisela has been a partner from day one,” Rhonda told the account director. “She’s our best mechanic on the chain-of-custody side.” She clicked to the next slide. It showed the agenda for Tuesday’s oversight hearing.

“I added her slot on the agenda without asking her,” Rhonda said. “Marisela’s a good sport about jumping in, and it gives the Presiding Judge a county voice on system stability that closes the deal.”

She picked up her coffee cup. She took a sip. She ended the call and began reviewing her opening remarks.

Tuesday morning arrived. At 08:45, I walked through the courthouse rotunda toward the atrium. My shoes clicked against the polished tile. The morning light filtered through the high glass ceiling, casting long, sharp shadows across the floor. David, the junior IT specialist, waved at me from the server room doorway. I did not wave back. I carried my hearing folder under my arm. Inside my pocket, I carried the encrypted USB drive and the white envelope containing the forty-seven-entry list.

The oversight hearing was scheduled to begin at 09:30. I stepped into the atrium at 09:18. The space was designed for public ceremonies, with high arched ceilings that amplified every footstep. The contract-renewal agenda was printed on a sheet of paper in my hand. I gripped it until the edges crumpled. The room was already filling with county staff, clerks, and attorneys. The Presiding Judge of the Criminal Division sat at the raised dais at the front of the room, reviewing his notes. To his right sat the County Bar Association liaison. To his left was the Maricopa County Attorney liaison.

Rhonda Kirby sat at the contractor table to the side, adjusting her slide remote. Her slide deck was already projected onto the main screen behind the dais. She looked up and saw me. She smiled and patted the empty chair beside her. I did not sit down. I walked directly to the presenter podium. I placed my heavy hearing folder on the wood. I waited for the clock to move.

At 09:30, the Pinal County Courthouse atrium was loud. The makeshift dais sat at the center, with the Presiding Criminal Judge, the Honorable Theresa Aguilar, at the microphone. The County Bar liaison and the Public Defender’s representative sat to her right. The Maricopa County Attorney liaison sat to her left. Rhonda Kirby sat at the contractor table to the side, her slide deck already projected onto the main screen behind the dais. I stood at the presenter podium. A reporter from the Casa Grande Dispatch sat in the gallery, her notepad open.

At 09:34, Judge Aguilar reached for her gavel to call the oversight hearing to order. She did not lift it.

At 09:36, a Senior Court Services Officer walked down the center aisle of the atrium. He bypassed the gallery. He bypassed my podium. He walked directly to the dais and served a thick, sealed packet on Judge Aguilar, then turned and placed an identical packet on Rhonda’s table.

Rhonda looked at the paper. “We have a contract renewal vote in five minutes,” she said. “Whatever this is can wait until after the vote.”

The officer did not lower his voice. “The Administrative Office of the Courts has issued an Emergency Preservation Order,” he said. “The redaction module is suspended effective immediately.”

The room went entirely still. The ambient echo of the atrium vanished.

Rhonda looked at me. “Marisela,” she said quietly. “What did you do.”

I did not lower my voice. “I filed an Emergency Preservation Request to the AOC Sunday night,” I said. “The redaction module has been silently dropping audio and frames on MOV-encoded body-cam files for nine months. Forty-seven exhibits. Forty-seven cases.”

Rhonda gripped the edges of her podium. “The post-hash recheck step is a belt-and-suspenders quality check. The SLA does not require it.”

“The State v. Padron exhibit is missing 167 frames and 11 seconds of audio at the shooting scene,” I said. “The audio cannot be recovered. Defense counsel asked about the drop on Friday. The hash check would have caught it in February when you disabled it.”

“We disabled hash recheck during Q1 backlog to keep operations within SLA,” Rhonda said. “It was a temporary accommodation.”

I opened my hearing folder. I laid the document flat on the wood. “The configuration change in Tetragon’s module admin console signed in your vendor admin account on February 14. The internal Tetragon ticket says ‘reconfirm Q3.’ Q3 ended in September. Today is October 14. You weren’t reading the ingest hashes in this archive. I was.”

Rhonda stared at the printed page. She did not speak.

“The AOC write-once archive holds the original ingest hashes for the 47 affected exhibits,” I said. “The redacted exports on the DEMS log do not match those hashes, and the configuration change that disabled the post-hash recheck is signed in your vendor admin account with a date that precedes the first affected case by two days.”

I stepped back from the microphone. Judge Aguilar set her gavel down. She picked up the Order packet. She read it through twice. She called a recess. She did not look at Rhonda.

The Public Defender’s representative stood up. She walked to the back of the atrium. She began making a phone call to her supervisor. She did not return to her seat.

The Casa Grande Dispatch reporter closed her notepad. She photographed the dais on her phone. She walked out the front doors of the courthouse. She did not return.

Rhonda gathered her slide remote. She straightened the edge of her presentation packet against the contractor table. “Tetragon ran this contract through nine months of 100% SLA conformance,” she said. “The redaction module is sound.” She picked up her phone. She walked out the atrium side door without looking at me. The AOC Officer noted 09:42 in his field notebook. The contract renewal vote was foreclosed.

It was late Tuesday afternoon in my office at the courthouse. The light filtering through the high atrium-side window had gone gold and flat. The building was quiet, save for the low hum of the HVAC system. The room smelled of fresh toner and printer paper. The white envelope containing the forty-seven entries sat on my desk. Behind me, the whiteboard still bore Cassie Kirby’s faded pencil-traced SHA-256 example, partially visible beneath the dry erase dust.

I opened my email. The defense investigator on the Padron case had written me a one-line email: “Thank you for confirming. The family deserves to know what was actually said.” I closed the message. The eleven seconds of shooting-scene audio were still gone. The State would have to rebuild the prosecution from surviving full-frame video and officer testimony. Because of the continuance window, two suspects in unrelated cases were already receiving supervised release on reduced conditions. I opened the AOC public docket on my screen. It retained my name as the system custodian-of-record for those nine months. The docket does not delete.

I looked up at the clock on my wall. It read 16:48. 09:30 on this Tuesday had already passed, and it did not pass the way it has passed every Tuesday for four years. The contract was not renewed. The module was suspended. The Presiding Judge had called a recess and did not reconvene for the day. I opened my hearing folder on the desk and turned to the State v. Padron entry. My note in blue pen rested on the paper: 167 frames – 528,000 samples – approx 11 sec – shooting scene. Below it, I had clipped today’s AOC case-number receipt. The two pages sat next to each other. 09:30 used to mean: the courthouse opens. Today 09:30 meant: the courthouse stayed closed on the contract it was about to renew. That is a different thing. I did not feel triumph. I felt the weight of eleven seconds of audio that cannot be recovered for the family of a homicide victim, and the weight of forty-seven cases that will spend the next thirty to ninety days in continuance.

I pulled open my supply drawer. I took out a fresh chain-of-custody binder. It was the same brand, the same format. I opened the cover. I wrote the date. I wrote: “DEMS Re-Validation – AOC Cycle – Day 1.” I set my pen in the gutter of the spine. The blank lines waited.

Rhonda thought a hash recheck was a belt and suspenders step she could disable for one quarter. She forgot the AOC archive holds the original hashes in write-once storage with my license tied to it—and the difference between a frame I ingested and a frame her module delivered is not a quarter, it is a record.