Russell O'Brien Part Statement about the photo of Madeleine that was printed off,and that the red top photo was taken from Kate's camera.
Russell OBrien Rog Interview
Part Statement date 10.4 08.
1578 “’And a female member of staff possibly from MARK WARNER’?”
Reply “Yeah, she was certainly, yeah, she was, she was English, you know, clearly not a, not a local. Erm, next it says ‘We tried to find a picture of Madeleine’, I mean, it wasn’t so much struggling to get the picture, it was struggling to find the means of printing it. We had the cam,we had Kate’s camera, erm, the, what we were trying to do is find a picture that actually gave a good likeness, rather than just being any old shot it actually had, you know, a close-up of her, of her face. There were a lot of pictures on the camera but they were, you know, just at home and on, you know, in profile and things like that”.
1578 “Yes”.
Reply “So we had, we”.
1578 “So to the words ‘we were struggling’, ‘but we were struggling’ need to be removed?”
Reply “Erm, yeah, ‘we tried to find’, I think, it’s fairly irrelevant, I think, you know”.
1578 “So?”
Reply “’We were trying to find a picture but we’, you know, delete ‘but we were struggling’. ‘Kate checked the camera’. Erm, I don’t actually remember saying that Jane had taken the picture of Madeleine at the tennis lesson, in any case, it wasn’t that day it was the day before that Madeleine and E**a were in the group, erm, on a different day doing the tennis. I think, you know, it’s fairly, I think it’s fairly irrelevant anyway, I don’t think Jane did have a picture from the tennis lesson. So I think that that could all go, I think that ‘Jane had taken a picture of Madeleine at the tennis lesson that day’ could all go and then put, the main thing here was, erm, ‘We were searching for a printer and Kat, one of the Nannies, said she had a printer’. I’m pretty sure it was Kat. So this paragraph’s quite”.
1578 “So we keep in ‘We couldn’t print it off’?”
Reply “’We needed to print it off’ that, that was the sticking issue, we had pictures but we needed to get in somewhere to print them and I think people had asked at, at, at the reception down at Ocean Club”.
1578 “So the pictures of Madeleine?”
Reply “On a digital camera”.
1578 “That were printed off?”
Reply “Yeah”.
1578 “Came from Kate’s camera”.
Reply “From Kate’s camera as far as I can remember, yeah. And the main issue was trying to find somewhere to print it”.
1578 “What about if we say ‘Kate checked her camera and found some pictures’?”
Reply “Yeah, yeah, or ‘Kate’s camera was checked’, I don’t think Kate was in no, in no state whatsoever to check her camera”.
1578 “Okay. So ‘We tried to find a picture of Madeleine’?”
Reply “Yeah”.
1578 “’Kate’s camera was checked’?”
Reply “Umm, ‘And Kat or one of the other Nannies went to their flat to retrieve a printer or something that would connect to a printer and then the pictures were printed in the office off the small reception portal’, there’s a little office in there”.
1578 “Okay. But ‘Kate or one of the Nannies’?”
Reply “Yeah, ‘Kat or one of the Nannies’, I mean, Kat was there and Leanne was there, but whether it was actually their printer or lead, I’m not sure.
1578 “Did you have any photo of Madeleine in your possession”?
Reply “Erm we got a photo of Madeleine later on but this is two hours later, erm”.
1578 “So who gave it to you”?
Reply “Okay well certain, I’m not quite sure what the, the initial, the question made it sound like whoever had one in our possession anyway, I didn’t, erm we got a, we erm, after a portion of my searches, we got hold of erm Kate’s camera, err looked through the digital cam to try and find a picture of Madeleine reasonably recently.
End part Statement ROB.
The following Item's below Camera memory cards, and a video tape from a Sony video Camera, were delivered to DC Martin at 9pm at Night on the 8th of May 2007, to his home Address for examination, which was carried out the following Morning, did these item's belong to the McCann's?, if they did then the time on the last photo would not have been there on the last photo, as the time date was stuck 0000 01.01.2000, these item's were obviously important for the item's to be delivered to the home Address of D.C. William's.
08 03 Outcrops Pesos VIII viol III Pages 543 to 548
03_volume_III_O_appends_VIII_Page_543
03_volume_III_O_appends_VIII_Page_544
03_volume_III_O_appends_VIII_Page_545
03_volume_III_O_appends_VIII_Page_546
03_volume_III_O_appends_VIII_Page_547
03_volume_III_O_appends_VIII_Page_548
(in English)
Hampshire constabulary
Witness Statement
Statement of: Stuart William Martin
Occupation: Detective Constable 1755
Date: 9th May 2007
1. I am employed by Hampshire Constabulary as a Detective Constable and am currently stationed in the Hi-Tech Crime Unit. I hold a Batchelor of Mechanical Engineering and Management degree from Liverpool university. My duties include the retrieval and examination of evidence from computers and other digital media and the investigation of computer crime. I have successfully completed two courses held by Guidance Software Inc in relation to their forensic software tools.
I have also successfully completed one course held by Access data Corp in relation to their forensic data tools.
2. On 8th May at 21.00 hours, the following was delivered to my home address by PC 178 Barham, requesting they be examined to establish if they contained pictures and video footage of a hotel complex in Praia da Luz.
ID ref Description
NALF/1 Video tape from Sony Handicam Video Camera Re Praia da Luz holiday 28/4/07 – 5/5/07.
NALF/2 64 MB camera memory card from Olympus C50 camera Re Praia da Luz holiday 28/4/07 – 5/5/07.
NALF/3 32 MB camera memory card from Olympus C50 camera Re Praia da Luz holiday 28/4/07 – 5/5/07.
3. Video tape from Sony Handicam Video Camera Re Praia da Luz holiday 28/4/07 – 5/5/07.
On 9th May 2007 at 08.30 I delivered this video camera in the sealed bag number CD 48113 to the imaging unit at Hampshire Police Support headquarters, Netley for examination. I conducted no examination of this bag and contents.
4. 64 MB camera memory card from Olympus C50 camera Re Praia da Luz holiday 28/4/07 – 5/5/07 (NALF 2) and 32 MB camera memory card from Olympus C50 camera Re Praia da Luz holiday 28/4/07 – 5/5/07.
On 9th May 2007 I commenced my examination of a sealed plastic bag seal number CD48115 with two exhibit labels attached marked 64 MB camera memory card from Olympus C50 camera Re Praia da Luz holiday 28/4/07 – 5/5/07 (NALF 2) and 32 MB camera memory card from Olympus C50 camera Re Praia da Luz holiday 28/4/07 – 5/5/07 (NALF 3).
5. This bag contained a power lead and cable, a black camera case which contained an Olympus C50 camera and a memory cad holder which contained one card.
6. I identified NALF/2 as the memory card which was installed in the camera and NALF/3 as the card in the memory card holder.
7. NALF/2 is an Olympus XD 64 MB memory card number MXD64P3L922905RN9 0223 MAD.
8. NALF/3 is an Olympus XD 32 MB memory card number MXD32P3RO34505RN20235 MAD.
9. I imaged NALF/2 using Guidance Software Inc computer forensic software called Encase version 5.
10. I imaged NALF/2 using Guidance Software Inc computer forensic software called Encase version 5
11. I examined the data from the two cards and located 43 pictures in the live area of the two cards.
12. I produced these pictures as identification references SWM/3019/01 to SWM/3019/43.
13. On checking the camera I found that the time and date was not set on the camera and it was recording the time and date as 0000 hours on 01/01/02. This did not change during the examination. None of the pictures SWM/3019/01 to SWM/3019/43 have any created dates recorded. The last written time and date for each of them is recorded as 0000 01/01/02.
14. Last Accessed represents the date the file as last examined. Whether the Last Accessed Date is triggered depends on the nature of the examination. Opening a file will trigger the Last Accessed Date, as will looking at the file properties and browsing the file structure with Windows Explorer. Examining a file on “write protected media” such as a floppy disk will not trigger this date, neither will examining a file on a compact disk or DVD.
15. Last Written represents the time and date that the contents of the file was last changed. The Last Written date and time is unchanged by the process of copying a file from one drive to another.
16. The creation date and time of the file is usually when it is written to the surface of the disk, subject to the accuracy of the computer clock that was used to perform this task. When this date and time is seen to be after the last written date and time it shows that the files has been transferred from another media.
17. Starting Extent represents the physical location of the starting cluster of the file.
18. Using my forensic software I was able to locate 73 pictures files in the unallocated clusters which had been deleted and were no longer accessible to the camera user.
19. I produce a report containing each of these picture identification reference SWM/3019/01 to SWM/3019/43.
20. I produce a compact disk SWM/3019/44 containing pictures SWM/3019/01 to SWM/3019/43 and report SWM3019/45. I have also copied the pictures and the folders as they appear on the cards, to this disk.
21. Unallocated clusters
22. Unallocated clusters are clusters on a drive that are not currently assigned to a file. Also called free space. A file may either occupy one or more clusters. The clusters that a file occupies are not necessarily contiguous. Some of these clusters may still contain data from files that have been deleted but not yet overwritten by other files.
23. When the data is extracted from the unallocated clusters there are not imes and dates or file names attributed to the data. My forensic software therefore saved the data in file format and named the files according to the location of the data within the unallocated clusters.
End.
