I was shown a sheet of data, labelled ‘Significant file activity on home computer on Date of Fire – 9 September 2011’
I show it above, you will see a list of times with column labelled Affected File but the contents of that column vary from files, program descriptors, directory names and just letters
The next two columns, Type of Activity and Notes were Jorgensen’s interpretation of the particular file activity, it is obvious that the notes do not make sense, for example there are ‘.eml’ email files listed at 8 different times through the day, there are different explanations of these files being active for the same activity.
At 10:07:58 the Affected Filename is just ‘A1’ not a file name or a program, possibly a dump of a memory ROM but that is not controlled by the user. How this leads to the Stated activity – ‘File Download’ is impossible to ascertain and the Note – ‘Portable browser application downloaded by user action via keyboard’ is technobabble!
This was my first contact with ‘evidence’ produced by Jorgensen, it was ALL utter rubbish!
The problem here was that the physical evidence showed that we were in Whangarei at 10:55 meeting a Trade Me customer who had left part of his vehicle at Killara when he picked up one of the items we were selling on TradeMe a week earlier. It takes well over one hour to drive from Killara to Whangarei, longer when, as on this day, traffic was heavy with people going to Auckland for the start of the Rugby World Cup later that day.
If the keyboard was being used at that time it must have been by one of the intruders but I guess it was just Jorgensen being his unique sort of ‘Computer Expert.’
Almost all the entries are similar to this, there are no authoritative references to show anything he states is correct, the document is just a classic example of the sort of ‘evidence’ produced by Jorgensen – classic Technobabble!
Dawson made a great play of showing me references in the report, quoting the name of the report and the page and paragraph numbers that he was referring to.
Finally, he explained how they thought the fire was caused, I had sent an email to the PC at the house, the PC had automatic software to print this email and I had hacked the printer and put it in the library so that it burst into flames when this occurred and this started the fire that destroyed the house.
I almost fell off my chair with laughter but I retrained myself. It was utterly bizarre and totally impossible. I tried to explain why to Dawson, realising he wouldn’t understand but that others, who I knew would be watching might begin to see the issue.
I pointed out that I only owned two printers, they were both made by Brother and both of them were based on ‘Ink Jet’ technology., simple devices, inexpensive with no heat source in the design at all and no re-programmable firmware as you would find in top of the range laser printers.
I told Dawson that I had been buying chipped printer cartridges for these printers off TradeMe for five or six years and the trading record would support this, I had never had a laser printer in New Zealand so the whole idea that the printer could burst into flames or be ‘hacked’ would not stand up at all.
Dawson told me that Joseph and Jorgensen had found my searches for all the components in my PC browser history files and reconstructed the system and because the reconstruction worked it proved that I was guilty!
Shortly after this, Dawson left the room with the tape left running for around 20–30 minutes, I expected him to return and tell me I could go but he came back, glum faced and continued, the DVD recorder stopped having filled it’s first DVD so a new one was inserted with the usual explanation of what happened to the cover the interruption.
I asked a couple of questions, pointing out that the printer would not even work in the library, the wifi networks in 2011 were not very strong and the signal down there was poor unless you were close to the glass in the window.
I also told them that only one of the two almost identical printers was wifi, the other was connected by a cable to the laptop we used in the kitchen workstation and that I suspected that telling the remains apart to show the printer found in the library, which was directly under the kitchen workstation was the wi-fi one would be near impossible but it was a waste of time talking to Dawson so I gave up.
The events that followed the interview defined the whole case – Read all about them here.
Get the latest on the BLOG!
Any NZ Police interview that is recorded is required to have the following times noted in the recording to prevent any possible editing. Start of interview, end of interview, time anybody entered or left the interview room, time when a new CD is inserted into the machine if the previous one is full.
You should also never have been left alone in the interview room and you are correct, the full DVD should contain five files, four video files of exactly one gigabyte in size and a smaller file that contains the data required to make the four files run as a single video and other technical data. This pattern repeats on subsequent DVD’s until the recording ends, the final DVD having the small file one final file of less than one gigabyte and one to three one gigabyte files. This is exactly the same set of rules that apply to commercial DVD sets, films etc played on DVD players.
The Police can edit these videos but only with the approval of the presiding judge and that of both Crown and defence lawyers.
These omissions show that the video has, as you detail, been edited. You should make a complaint on that issue to the Police Complaints authority, I used their contact info to sign in to your comment system. They, I assure you, will take the matter very seriously.
Hi Chris
I’m Mike, I posted on your blog years ago, I’m amazed you still seem to be struggling against the insurer, they were wildly out of order on last read.
As I stated previously your home was designed for a perfect fire! We used to have loads of fires in homes with wood panelled walls and ceilings, codes changed that and things improved markedly. The massive ceiling voids in your living rooms would have filled with hot explosive smoke and caused massive flash overs ripping the home apart and creating an impossible task for the fire investigators. Your fire could have started anywhere in reality, the images of so much soft furnishing which, I know is untreated in New Zealand, WTF, would have fuelled the blaze at an hyper rate and once the timber walls and ceiling were ignited by the inevitable flash overs you monster home wouldn’t have survived for many minutes. Not your fault, I know you didn’t build it like that but boy it was set up by design to burn.
I guess the insurance company investigators didn’t really look at anything, dumb bastards that had a single motive looking at your posts – to get you and get their bosses off the hook. It should have all been over in the first few hours of the investigation, if there is solid evidence of intrusion it is seldom worth looking further, any other evidence would always be undermined by the intrusion. You go with the balance of probability, the intruders caused the fire and once the possible connection between the policy holder and intruders shows zilch then the insurer must pay out or waste loads more bucks. In New Zealand, as you state, they have a lot of practice doing this and get away with it – your investigators wouldn’t last past their introduction in Chicago – biased and untrained – a formula for a fix up and that is what you got!
Hope this helps
Mike
Hi Mike
I remember you previous post, thanks for updating it.
We realise now that the house was basically lined with highly flammable material, all the areas which were lined with wood panelling were totally destroyed and this was the core of the property, add in all the NZ made sofas and it was a torch waiting for a match apparently. We knew none of this prior to the fire, you just assume everything had been done to the regulations and was safe, I suppose it passed all the building inspections.
The previous owner put all the panelling and ceilings up, he was a woodworking fanatic and it did look beautiful. The sofa laws baffle me totally, the foam is treated with a chemical dangerous to the environment but the amounts are tiny compared to the poisons pumped into it by one large fire such as this and there are thousands of house fires in NZ every year! Madness!
Thanks again, always great to get honest expert opinion.
Chris
I’m a student at CIASOLUTIONS in Melbourne studying Computer Forensics principally using Forensics Toolkit FTK to access data.
I look at this page in your blog and ask myself what the hell was going on here? The Significant File Activity list is totally rubbish, some ‘Affected Filename’ lines may be of interest but they do not support the ‘Type of Activity’ and the ‘Notes’ column that he states. You would need to produce masses of corroborating evidence to show those connections most of which are just one of tens of possible activities that could affect that file, some have no basis at all.
Computer forensic analysts have to be extremely careful, particularly on legal and ethical principles or their evidence could be challenged and rendered inadmissible as eventually happened in this case but this right at the was the start of the case and I cannot see how this was allowed to go on. In my opinion if this Jorgensen claims he is qualified in computer forensics he is a charlatan of the first order.
I am pleased you nailed him in the end but it seems that he got away without punishment for his vicious and vindictive lies, allowing him to sprout more garbage like this in his next case.
Tim Oswald
Thanks Tim
I agree totally, I have been in the Micro computer industry since Day ZERO and I have never come across an expert like this, just Technobabble endlessly and when challenged he changes his story to another version of Technobabble. I don’t think he knows anything at all. A classic example of what can happen when you give a super piece of software like FTK to a moron that just wants to find what his bosses want and doesn’t understand that you need not just the result but the proof that your claims are actually real.
Good luck in your studies, it doesn’t appear difficult to get work in that area of expertise if Jorgensen is anything to go by.
Chris R
Did you have a proper lawyer representing you?
If you did and you told them all this why didn’t they take action, they would have had an original copy of the video and the transcript, just the missing times on the video would have been enough for them to make an application for dismissal! Tampering with the evidence at this stage in the investigation would have been fatal to the prosecution case.
The Evidence Act and Police Interview Code of Practice require several procedures to be followed during a suspect’s Police interview, most critically obvious in the transcript is the total absence of records of the times when the officer left the room, returned to the room and when the interview concluded. These omissions render the interview inadmissible and reinforce the claims made by the defendant. It was also unacceptable to leave the uncharged suspect in a locked interview room alone for a period of time, possibly 30 mins by his recollection.
I have studied the transcript, it appears to be completely genuine, I am requesting copies of the video recordings. I am sure it will be the interview recorded in the transcript but there can be little doubt it was not a full and correct record of the interview itself which would, undoubtedly had the time stamps detailed above.
It is difficult to see why the Police themselves would undertake these actions, the evidence was all collected by agents of the insurance company and maintaining a case against the suspect was vital to their interests by allowing them to avoid meeting the insurance claims. One must therefore question the reasons that the officers involved took such actions.
I feel that the lawyer involved was incompetent, inexperienced or possibly a party to the deception, it is hard to see why they did not take action against the Police Officer who seems to have been continuously involved in your case. I seriously recommend that you report their actions to the Law Society and the actions of the Police Officers to the Police Complaints system.