You are investigating a crime that was staged to look like something it wasn't.
A genuine suicide requires the person to be physically and mentally capable of taking action. Examine whether the evidence supports this capability.
Additionally: not all documents have a face value. Some documents have when they were created — and that timing may matter as much as what they say.
Look at the toxicology report (E02). At the detected level of Alprazolam, what was Rohan physically capable of doing in his final 30 minutes?
Now look at the "suicide note" (E03). A document exists that records exactly when it was printed. Cross-reference that timestamp with the autopsy's estimated time of death.
If the note was printed after death — who was in the building at that time? Check the access log (E08).
Evidence E03 (the "suicide note") contains a printer log at the bottom of the document. The log shows the note was printed at 11:32 PM — via a Remote Desktop session on Rohan's own computer.
The autopsy (E01) establishes death between 11:00 PM and 11:20 PM.
The note was printed 12–32 minutes after Rohan was already dead. Rohan did not print it. Someone else initiated that Remote Desktop session. The building access log (E08) shows only one person besides Rohan held Floor 14 keycard access that night. That person swiped in at 10:02 PM and swiped out at 11:28 PM — moments before the printer fired, and 19 minutes before the body was discovered at 11:47 PM.
You now have everything you need to name the culprit, their method, and their motive. The remote desktop session, the printer timestamp, and the keycard log form a complete chain.