MY PERFECT ALIBI

The PRINT COMMAND

There was a hearing at the Whangarei District Court in front of Judge McDonald on 16,17, 18 February 2015. His notes of the hearing record the full position very accurately as shown below.

The defence had Computer Forensics expert, Mike Chappell of NZ Forensics, Christchurch as an advising expert. Mike had his full analysis system with a certified copy of the PC drive recovered from the Acer PC in the Courtroom.

The hearing was a result of the defence appeal against the admissibility of the evidence of the Crown expert witnesses. The Judgment of the Court of Appeal issued on 17 June 2014 had given the Crown the opportunity to introduce new evidence as detailed in their paragraphs 31-33.

A discussion took place regarding the Automatic Printing option and Mr Jorgensen, the Crown expert agreed that Automatic printing was not used on the night of the fire. Which left the Court to only consider the issue of a ‘Print Command.’ (Reserved Judgment, Para 6.)

Previously, Mr Jorgensen had also agreed that there was ‘No direct evidence of a print command being sent from Mr Robinson’s Macbook, in Hamilton to the home Acer computer.’ This fact was relied upon by the Crown case. (Reserved Judgment, Para 5.)

This left the Court to consider the inference that a Print Command was sent. Judge McDonald clarified this point in his Para 10.

Mike Chappell produced PC records showed that the Acer PC had crashed on the night of the fire, this prevented it doing the normal controlled shut down and deletion of temporary files created since the previous shut down.

The Printer Spool file had not been deleted due to the crash and it contained the last file printed using the Print Spooler, that event had occurred at 22:55:09 on the 8 September 2011 which is over 24 hours prior to the fire. Again, Judge McDonald recorded Mr Jorgensen agreeing that this was the case in his paragraph 13.

Mr Jorgensen then suggested that Direct Printing could have been used. This is a rarely used alternative to using the print spooler but having done so would account for the lack of record in the Print Spooler file. To set this alternative, changes would have to be made to the PC’s printer registry record.

Mr Jorgensen did not have access to the PC registry files in the Court room, so the case was adjourned to allow him to return to Wellington, access the files and report back the next day by AVL link.

Judge McDonald recorded Mr Jorgensen’s evidence to the Court via AVL in Para 16.

Mr Jorgensen based his evidence on an extract from the PC registry he presented to the Court, shown below.

The extract contained sufficient detail, ‘DriversVersion-3BrotherMFC-J265W Printer’, to allow Mike Chappell to access the full page record direct from the PC registry files that he had access to in the Court room. The section seen from the ‘Help File’ entry to the ‘Manufacturer’ entry contains the data referred to my Mr Jorgensen showing this was the same page.

Whilst Mr Jorgensen was correct in stating the ‘System Registry’ had been last modified on 9 September at 11:04pm the Registry showed that the Pages referring to the Brother MFC-265W Printer had not been modified since the ‘Last Written time’ on 30/04/2011.

This appears to be Mr Jorgensen misleading the Court since the Forensic Toolkit Software he used would have included the Last Written Date in any report on the printer registry pages.

Whilst the hearing had taken place to investigate if an inference of a print command could be based on proven facts as detailed by Judge McDonald the result was far more conclusive.

The Print spooler file showed the last print command was issued on 8 September 2011 at 22:55:09, the printer registry files had not been modified since 30 April 2011, the details of that modification are unknown, but it was probably a routine print driver update by Brother.

The printer was being controlled by the print spooler on 8 September and no change had taken place after that time, therefore it was being controlled by the print spooler at the time of the fire on on 9 September 2011 and no print command had been issued after 8 September 2011 at 22:55:09.

This evidence not only removes the possibility of a Jury accepting that a reasonable inference that a print command was sent on 9 September 2011 existed. It actually proves that there was No Print Command sent following 22:55:09 on the 8 September 2011.

As Judge McDonald recorded in his Paragraph 5, the Crown case against Mr Robinson relied on a print command being sent to the Acer PC’s printer on the Night of the fire, 9 September 2011.

The evidence revealed at this hearing proved that a Print Command did not occur. Mr Jorgensen agreed at this hearing that there was no evidence of a Print Command being sent and that Automatic printing was not used on the night of the fire, this would have generated a print command in any case. The evidence here is clear and based on PC records, there is no opinion or level of proof argument, there was NO PRINT COMMAND.

The REMOTE IGNITION Theory replied on the Print Command and it was proven here for what it really was, a cynical fabrication to allow IAG to avoid the insurance claims.

The Crown’s Mr Annadale accepted that was the position, as recorded once again by Judge McDonald.

There was no evidence of REMOTE IGNITION, I was 400Km away in Hamilton at the time of the fire and together these facts give me a

PERFECT ALIBI – I had no opportunity to cause the fire!

3 comments

  1. Red Morris says:

    Dreadful story but this computer investigator is a real dork! In my 20 years at M’soft I’ve never seen such rubbish.

    The key that shows if Direct Printing is set is not the one he selected at all, it is on a page two pages deeper in the printer registry pages. It doesn’t make any difference to your case, the Registry is hierarchical, a change to any page updates the date on the top page and all higher pages in the stack but not on the pages below it in the file.

    A change to the correct attribute for direct printing page, when it occurred would have changed the last written date of all the pages above it and that would include the top printer page which shows the April change date. If that page wasn’t changed since April 2011 then no page below it was changed since that date either and direct print was not set after April 2011, if at all, since any other change would alter that date. New driver updates occur regularly and that is the most common reason for a printer registry page to update.

    You are also correct when you call his ‘activity log page’, technobabble, great word, it is almost entirely rubbish but it does explain why the last update of the entire Registry was at 23:04, his last entry is consistent with Norton completing a virus check on the disk. This event at it’s end updates the registry keys for last date completed and several others before doing a housekeeping routine and shut down so it was the almost certainly the last action that generated the registry’s last change time, it wasn’t anything to do with printers.

    I’m sending a private message with my contact details if you want more detail, just ask.

    Hope this helps, good luck and God be with you.

  2. Edmund Pontin says:

    Your Judge McDonald verified your alibi for you.

    Hard to see why the Police do not act here, if it was a Murder by shooting case you may have been a suspect but once they showed you were not at the murder scene at the time of the shooting they would have immediately released you and you would never had any further issue.

    Here it is arson, you were accused using a fancy story that was rubbish really, the Police accepted it with no real evidence and you had masses of pain for years until this Judge sorted it out very clearly, no print, no remote ignition!

    There is no other conclusion from the PC data and that damns the insurance company, the Police and the bent investigators.
    I cannot believe the investigators that worked for insurance company then were accepted as expert witnesses, sucks and totally unacceptable, how could they be deemed independent, same Police rules I guess! Nothing they could say would get around your alibi and it puts most of their evidence against you into the dangerous false category.

    They would all be jailed here in the US and the insurance company faced crippling damages due to their actions.

  3. Michael C says:

    Great post, it gives detailed answers to many of my doubts on your case.

    To me, it appears that Judge McDonald has recorded everything very well, the main point being that the Crown case rested on remote ignition taking place to link you to the arson charge. The remote ignition was a theory that originated from IAG’s expert Martin Jorgensen. Theories are fine in cases such as this but there needs to solid evidence to support it, in this case there appears to be none but the Crown continued even without any supporting evidence.

    I will ignore your personal comments but Judge McDonald and the Crown’s barrister Mr Annandale supply all the evidence you need to prove your alibi without any comment from you.

    As I see it, Jorgensen accepted that there was no real evidence of a print command, the automatic printing option is irrelevant since it would also need to generate a print command but Jorgensen accepted it wasn’t used on the night of the fire.

    Your expert seemed to be on the ball, the print spooler data shows the last time the spooler worked was on the day previous to the fire so there was either no print command after that time or the printer was set to direct print before the fire.

    The Printer registry pages, these are a group of pages in the registry that contain the settings controlling the printer, had not changed since April 2011 so the settings could not have changed to direct printing for the 9 September. The print spooler operated on 8 September so the print spooler was operating on 9 September and Judge McDonald recorded that Jorgensen agreed that this was the case.

    The startling fact that Jorgensen attempted to introduce a misleading document, which is also recorded by Judge McDonald, validates your claims that IAG had acted illegally in the way they have dealt with your claim. It is odd that Judge McDonald didn’t censor Jorgensen or even report him to the Police but it is irrelevant to your argument.

    With no print command there could have been no remote ignition and Crown lawyer, Mr Annandale accepted this, as noted by Judge McDonald in his oral Judgment of 1 May 2015 where he acquitted you.

    You therefore are correct in your claim that this evidence confirms your alibi, without remote ignition you had no opportunity to cause the fire from a distance of 400Km.

    That IAG continued and still continue to maintain their position, as you detail elsewhere, based on you being guilty of Arson is disturbing and unsupportable.

    The evidence recorded by Judge McDonald would also be applicable in the Civil Court with the same validity, there is no way to avoid the lack of a print command destroying any case against you in the civil court since it is too late now for IAG to come up with some other scenario to connect you to the fire when it hasn’t been mentioned since 2011.

    I hope this simple independent analysis of this evidence assists you and other readers to better understand that your claims are valid.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.