Appendix D – The PC Registry Documents
MJ introduced this document on 18 February 2015 to a Pre trial hearing, claiming it showed the printer had been set to Direct Printing by the setting of the Attributes value to 0x00000002 and that the document had been last modified at 11:04 p.m. on the night of the fire as outlined in red.
As was normal for MJ, he gave no technical references or authorities to show this was the setting for his claim, Direct Printing.
The Full page from the PC registry from which the above was extracted is copied below.
The data in the large red block matches the data in the extract as does the title of the page.
The Last Written Time 30/04/2011 3:38:35 UTC, shown in the small red box, however, is 5 months prior to the fire, this was the last time the data on this page or on pages linked below it in the registry relating to the Printer had been modified.
Forensic Toolkit version 3.2 would have displayed this date as the last Written date for the page.
The time shown by MJ was the last written time for ANY change to the PC Registry and was almost certainly related to changes relating to the Norton Anti-virus check software which ran every night at 11.00pm.