Tim Allerton’s theft and substitution of Linnet Doyle’s pearls is a two-stage deception that initially made the missing necklace look like a straightforward theft. Hercule Poirot’s reconstruction separates the earlier replacement of the genuine pearls with an imitation from Tim’s later visit to Linnet’s cabin on the night she died. Tim admits taking the necklace from her bedside table, but cannot say whether she was alive or dead; his confession solves the pearl theft without establishing that he committed the murder.

The substitution behind the apparent theft

Poirot first turns to Tim when Linnet’s pearls are reported missing. The obvious possibility is that Tim has taken them, but that explanation does not account for the subsequent return of a necklace that looks like the missing one. On examination, the returned string proves to be imitation. For Poirot, that difference changes the question: the necklace that disappeared and came back was not the genuine jewel, but an imitation that Tim had already substituted for the real pearls. The apparent recovery therefore conceals an earlier loss of the authentic necklace.

This distinction prevents the two actions from collapsing into a single theft. Tim had arranged for an imitation necklace to be available in place of Linnet’s genuine pearls; on the night of the crime, he entered her cabin and took the necklace he found there. When Poirot identifies the returned string as false, it is not evidence that the genuine pearls have been recovered. It is the clue that the real substitution has already occurred, and that the actual pearls must still be hidden elsewhere.

How Poirot traces the genuine pearls

Poirot places the genuine pearls in a rosary hanging in Tim’s cabin. Its beads are elaborately carved and unscrew, with a pearl fixed inside each by seccotine. The concealment turns a devotional object into a container designed to appear unremarkable: Poirot reasons that police searchers would generally respect a religious symbol unless something about it gave them a reason to investigate. The rosary’s construction and location account for why a search might fail to find the jewels even after suspicion had fallen on Tim.

Poirot also reconstructs a possible route by which Joanna Southwood sent Tim the imitation necklace. His theory is that it travelled inside a book with a square space cut from the middle of its pages; because a book is open at both ends, it would be unlikely to be opened during postal handling. Poirot connects this possibility to Tim’s arrival from Majorca after he heard that Mrs. Doyle would be on her honeymoon. The proposed method explains how the imitation could have reached him, but it remains Poirot’s theory rather than proof of Joanna’s participation. Tim refuses to admit anything about her and points out that the investigators have no evidence against her.

The visit to Linnet’s cabin

The immediate theft takes place during the early hours of the night Linnet dies. Someone saw Tim leave her cabin shortly after one o’clock. Confronted with this, he admits that he entered, felt quietly along the small table by the bed, took the necklace, put another string down, and slipped out. The method relies on the fact that Linnet had placed the pearls on the bedside table and, in Tim’s view, was so absorbed by her own troubles that she would be unlikely to notice a change. He also says the opportunity seemed unusually convenient: his cabin was only two doors away.

Tim had assumed Linnet was asleep. When Poirot asks whether he heard her breathing, Tim cannot remember hearing it; he recalls the room as very still. Asked whether he noticed the smell of smoke that might have remained after a firearm had been discharged, he does not think he did, but cannot confidently recall that detail either. Those gaps leave the timing of the theft unresolved: Tim cannot say whether Linnet was alive or dead when he took the necklace. His admission explains his presence in the cabin but does not, by itself, answer the question of her death or make him her killer.

Admission, motive for secrecy, and limits of the solution

Tim confesses to the pearl theft and accepts that the genuine pearls are where Poirot says they are. He does not provide evidence against Joanna or explain how he obtained the imitation, insisting that the latter is his own business. His response draws a clear boundary between what he will admit and what he will not implicate another person in; Poirot recognizes the correctness of that position without treating it as an exoneration of the theft.

Tim explains that his mother’s friendliness toward Poirot made him uneasy. He disliked the prospect of sitting beside a successful detective just before attempting a risky exchange, and admits that the proximity gave him cold feet, though not enough to abandon the plan. He says he needed to make the exchange at some point and believed the boat offered a unique opportunity. These details establish the practical circumstances of the attempt and his awareness of its risk, not a motive to murder Linnet.

The episode also exposes the danger of letting one conspicuous crime explain every suspicious circumstance. Tim’s presence in Linnet’s cabin on the murder night is significant, but his account leaves the most consequential uncertainty intact: he does not know whether she was alive when he took the necklace. Likewise, the recovered imitation does not restore Linnet’s genuine pearls, and Poirot’s account of Joanna’s possible role is not independently confirmed. The solved theft thus clarifies one strand of the case while preserving the distinction between Tim’s proven act and the still-separate question of who killed Linnet.