MY PERFECT ALIBI
The PRINT COMMAND
There was a hearing at the Whangarei District Court in front of Judge McDonald on 16,17, 18 February 2015. His notes of the hearing record the full position very accurately as shown below.
The defence had Computer Forensics expert, Mike Chappell of NZ Forensics, Christchurch as an advising expert. Mike had his full analysis system with a certified copy of the PC drive recovered from the Acer PC in the Courtroom.
The hearing was a result of the defence appeal against the admissibility of the evidence of the Crown expert witnesses. The Judgment of the Court of Appeal issued on 17 June 2014 had given the Crown the opportunity to introduce new evidence as detailed in their paragraphs 31-33.
A discussion took place regarding the Automatic Printing option and Mr Jorgensen, the Crown expert agreed that Automatic printing was not used on the night of the fire. Which left the Court to only consider the issue of a ‘Print Command.’ (Reserved Judgment, Para 6.)
Previously, Mr Jorgensen had also agreed that there was ‘No direct evidence of a print command being sent from Mr Robinson’s Macbook, in Hamilton to the home Acer computer.’ This fact was relied upon by the Crown case. (Reserved Judgment, Para 5.)
This left the Court to consider the inference that a Print Command was sent. Judge McDonald clarified this point in his Para 10.
Mike Chappell produced PC records showed that the Acer PC had crashed on the night of the fire, this prevented it doing the normal controlled shut down and deletion of temporary files created since the previous shut down.
The Printer Spool file had not been deleted due to the crash and it contained the last file printed using the Print Spooler, that event had occurred at 22:55:09 on the 8 September 2011 which is over 24 hours prior to the fire. Again, Judge McDonald recorded Mr Jorgensen agreeing that this was the case in his paragraph 13.
Mr Jorgensen then suggested that Direct Printing could have been used. This is a rarely used alternative to using the print spooler but having done so would account for the lack of record in the Print Spooler file. To set this alternative, changes would have to be made to the PC’s printer registry record.
Mr Jorgensen did not have access to the PC registry files in the Court room, so the case was adjourned to allow him to return to Wellington, access the files and report back the next day by AVL link.
Judge McDonald recorded Mr Jorgensen’s evidence to the Court via AVL in Para 16.
Mr Jorgensen based his evidence on an extract from the PC registry he presented to the Court, shown below.
The extract contained sufficient detail, ‘DriversVersion-3BrotherMFC-J265W Printer’, to allow Mike Chappell to access the full page record direct from the PC registry files that he had access to in the Court room. The section seen from the ‘Help File’ entry to the ‘Manufacturer’ entry contains the data referred to my Mr Jorgensen showing this was the same page.
Whilst Mr Jorgensen was correct in stating the ‘System Registry’ had been last modified on 9 September at 11:04pm the Registry showed that the Pages referring to the Brother MFC-265W Printer had not been modified since the ‘Last Written time’ on 30/04/2011.
This appears to be Mr Jorgensen misleading the Court since the Forensic Toolkit Software he used would have included the Last Written Date in any report on the printer registry pages.
Whilst the hearing had taken place to investigate if an inference of a print command could be based on proven facts as detailed by Judge McDonald the result was far more conclusive.
The Print spooler file showed the last print command was issued on 8 September 2011 at 22:55:09, the printer registry files had not been modified since 30 April 2011, the details of that modification are unknown, but it was probably a routine print driver update by Brother.
The printer was being controlled by the print spooler on 8 September and no change had taken place after that time, therefore it was being controlled by the print spooler at the time of the fire on on 9 September 2011 and no print command had been issued after 8 September 2011 at 22:55:09.
This evidence not only removes the possibility of a Jury accepting that a reasonable inference that a print command was sent on 9 September 2011 existed. It actually proves that there was No Print Command sent following 22:55:09 on the 8 September 2011.
As Judge McDonald recorded in his Paragraph 5, the Crown case against Mr Robinson relied on a print command being sent to the Acer PC’s printer on the Night of the fire, 9 September 2011.
The evidence revealed at this hearing proved that a Print Command did not occur. Mr Jorgensen agreed at this hearing that there was no evidence of a Print Command being sent and that Automatic printing was not used on the night of the fire, this would have generated a print command in any case. The evidence here is clear and based on PC records, there is no opinion or level of proof argument, there was NO PRINT COMMAND.
The REMOTE IGNITION Theory replied on the Print Command and it was proven here for what it really was, a cynical fabrication to allow IAG to avoid the insurance claims.
The Crown’s Mr Annadale accepted that was the position, as recorded once again by Judge McDonald.
There was no evidence of REMOTE IGNITION, I was 400Km away in Hamilton at the time of the fire and together these facts give me a