Once more: the computer records

[fierljepper]

Some wild thinking ahead.

Two things keep bothering me about the computer records:

1. Why was Val up so late that night and why did he only visit ONE site (the x-plane forum) and why did he spend 30 (!) minutes on Hotmail before that?

2. The records show that Joran accessed Hotmail at 22:33 on May29th and this in conflict with what he states in his book (p80), where he claims to be back home at 23:15. Although it is also feasible that PvdS picked him up around 22:00 at the MacDonalds and that he immediately went behind his computer, the statements from Deepak and Satish reveal that Joran wasn't in his appartment when they picked him picked him up around 23:45. They claim he was printing a school paper and that is something you can only do on a computer... So, there is some evidence that Joran was on his computer around that time. Assuming that Joran's phone records (that he most certainly possesses and on which he has based his book), show that he indeed called his father (to pick him up at MD) and Deepak (to give him a ride to CnC) around 23:00, these datapoints would then need the 22:33 hotmail visit in the computer records to be of by an hour. Is that possible?

The investigators encoutered two data issues that could have caused problems:
1. The VDS computer analysis records indicate that they forgot to record the data/time when they secured the hard disk. This implies the team didn't have a reliable VDS computer systems time. They solved this mistake by comparing the timings of the Hotmail/MSN log-on HTML-screens. That particular reconciliation matched the PC system time with the centrally recorded MSN/hotmail times and based on that they decided to assume the PC was clocked at GMT-4 (=Atlantic "summer" time. Aruba doesn't do daylight savings). This was indeed also the system time(zone) they found on the VDS PC. There is a notorious problem though that is called the 'one hour of' issue. Most installed Windows applications (like MSN) all use the PC system's time and timezone, however typical Internet applications like Hotmail can't directly access these. Hotmail, GMail, Yahoo!, and other web-based services usually ask you for your time zone when you sign up. If you ignore that, get it wrong, or move to a different time zone, you'll need to change the setting in order for the time stamps of your emails to be correct.

http://ask-leo.com/why_is_the_time_on_my_email_wrong.html

2. The other suspicious thing about the computer records is, that although the VdS PC runs on Windows XP, the family has created only a single user account called "owner". So there are no separate log-on accounts defined for each family member. The only way the investigators could therefore attribute the site visits to the individuals, is either by the login accounts on MSN and/or hotmail, which seem accurate (so Joran's alleged 22:33 log-in is clearly him) or by assuming a certain past surf behavior. They state that they have assigned the airplane site to Valentijn based on the latter, but that is by no means certain. I've always been surprised about the fact that apparently Valentijn sneaked out of bed and viewed only ONE particular site. If he was fully awake he would have watched many more sites that night (as a 15 year old). So, did Joran caught his brother out that late or could it even have been Joran who 'hit' the plane site, maybe because it's set as the standard home page (first screen that appears) or since he accidentily hit the wrong bookmarked site?

Based on the above, let's assume that they both got their Hotmail timezones wrong when they signed up for their accounts. That would mean that they're both an hour of on Hotmail and the sequence then might look as follows:

23:33 Joran on Hotmail (during/after he printed his school work)
<3:05 Joran arrives home. Val woken up by noise.
03:07 Val gets out of bed and goes to X-plane forum
03:11 & 3:13 Joran sends text messages
03:25-35 MSN conversation Deepak/Joran
03:34 Val goes quickly on hotmail to check e-mail (fits precisely in the gap between the 3:33 "Hey Swa" and the 3:35 "TopaPimp" messages.)
03:40-56 Joran on various sites
04:35 Joran on Hotmail
1 hour gap
05:30 Joran on Hotmail
06:15 Joran wakes up (but probably didn't got to bed at all)

Other combinations/thoughts?

[iquitos]

where did you get this information?

[luvslalom]

Some wild thinking ahead.

Two things keep bothering me about the computer records:

1. Why was Val up so late that night and why did he only visit ONE site (the x-plane forum) and why did he spend 30 (!) minutes on Hotmail before that?

2. The records show that Joran accessed Hotmail at 22:33 on May29th and this in conflict with what he states in his book (p80), where he claims to be back home at 23:15. Although it is also feasible that PvdS picked him up around 22:00 at the MacDonalds and that he immediately went behind his computer, the statements from Deepak and Satish reveal that Joran wasn't in his appartment when they picked him picked him up around 23:45. They claim he was printing a school paper and that is something you can only do on a computer... So, there is some evidence that Joran was on his computer around that time. Assuming that Joran's phone records (that he most certainly possesses and on which he has based his book), show that he indeed called his father (to pick him up at MD) and Deepak (to give him a ride to CnC) around 23:00, these datapoints would then need the 22:33 hotmail visit in the computer records to be of by an hour. Is that possible?

The investigators encoutered two data issues that could have caused problems:
1. The VDS computer analysis records indicate that they forgot to record the data/time when they secured the hard disk. This implies the team didn't have a reliable VDS computer systems time. They solved this mistake by comparing the timings of the Hotmail/MSN log-on HTML-screens. That particular reconciliation matched the PC system time with the centrally recorded MSN/hotmail times and based on that they decided to assume the PC was clocked at GMT-4 (=Atlantic "summer" time. Aruba doesn't do daylight savings). This was indeed also the system time(zone) they found on the VDS PC. There is a notorious problem though that is called the 'one hour of' issue. Most installed Windows applications (like MSN) all use the PC system's time and timezone, however typical Internet applications like Hotmail can't directly access these. Hotmail, GMail, Yahoo!, and other web-based services usually ask you for your time zone when you sign up. If you ignore that, get it wrong, or move to a different time zone, you'll need to change the setting in order for the time stamps of your emails to be correct.

http://ask-leo.com/why_is_the_time_on_my_email_wrong.html

2. The other suspicious thing about the computer records is, that although the VdS PC runs on Windows XP, the family has created only a single user account called "owner". So there are no separate log-on accounts defined for each family member. The only way the investigators could therefore attribute the site visits to the individuals, is either by the login accounts on MSN and/or hotmail, which seem accurate (so Joran's alleged 22:33 log-in is clearly him) or by assuming a certain past surf behavior. They state that they have assigned the airplane site to Valentijn based on the latter, but that is by no means certain. I've always been surprised about the fact that apparently Valentijn sneaked out of bed and viewed only ONE particular site. If he was fully awake he would have watched many more sites that night (as a 15 year old). So, did Joran caught his brother out that late or could it even have been Joran who 'hit' the plane site, maybe because it's set as the standard home page (first screen that appears) or since he accidentily hit the wrong bookmarked site?

Based on the above, let's assume that they both got their Hotmail timezones wrong when they signed up for their accounts. That would mean that they're both an hour of on Hotmail and the sequence then might look as follows:

23:33 Joran on Hotmail (during/after he printed his school work)
<3:05 Joran arrives home. Val woken up by noise.
03:07 Val gets out of bed and goes to X-plane forum
03:11 & 3:13 Joran sends text messages
03:25-35 MSN conversation Deepak/Joran
03:34 Val goes quickly on hotmail to check e-mail (fits precisely in the gap between the 3:33 "Hey Swa" and the 3:35 "TopaPimp" messages.)
03:40-56 Joran on various sites
04:35 Joran on Hotmail
1 hour gap
05:30 Joran on Hotmail
06:15 Joran wakes up (but probably didn't got to bed at all)

Other combinations/thoughts?

0550: records show e-mail to Anita.

Didn't Val access a planes site? A site where a friend of Joran's was a pilot? Sorry can't find the links and it's just something I recall.

[GBMW]

02:34 hotmail Valentijn + 03:07 surfing to a plane website (probably also Valentijn) makes more sense to me than Valentijn getting a minute when Joran just has confiscated the computer or that Valentijn had just gone to bed and did hear Joran come in but didn't pay any attention to it..just went to sleep.

[fierljepper]

0550: records show e-mail to Anita.

Didn't Val access a planes site? A site where a friend of Joran's was a pilot? Sorry can't find the links and it's just something I recall.

Hi Luv,

Never heard the story about Joran's friend before. The x-plane site is about a highlly realistic flight simulator that is also used for official pilot certification. Allegedly it was Val who went to visit the forum of that site. Maybe he was posting there and wanted to check if someone had responded to one of his posts. But maybe it was Joran who was interested in planes as well. The investigators only state that Val had visited that site before (but wonder how they could they have seen that, since the VDS computer only has one account that is used by everybody. It must have been based on some circumstantial evidence that it was Val who logged on Hotmail just before or after that and/or a certainty that Joran wasn't home that time. To my knowledge Val was never interrogated, which is a bit strange for such a key witness.

The 5:50 outlook message was not sent, but received (from Anita). The computer records say for May 30th:

5:50 Received message outlook Express - probably received automatically.

The investigators add to this:

During further investigations it has become clear that on May 31st 2005 around 5:51AM, also an e-mail message from Outlook Express was received. From this we deduct that it allegedly concerns a computer initiated action.

Outlook Express is software that runs on your PC (unlike Hotmail) and it can't receive messages when the computer is switched off. It only gets entries in the log files or receives/sends mail after a sync with the central mail server. This is unfortunately not a proof that the computer must have been switched on at 5:50, since the log files could have been copied the date/time stamp from the server at a later moment when the PC was switched on again (although I need to check if it really works that way). Also the VDS computer might have been kept on the entire night, when nobody was behind it.

[luvslalom]

Fierljepper:

The investigators only state that Val had visited that site before (but wonder how they could they have seen that, since the VDS computer only has one account that is used by everybody. It must have been based on some circumstantial evidence that it was Val who logged on Hotmail just before or after that and/or a certainty that Joran wasn't home that time. To my knowledge Val was never interrogated, which is a bit strange for such a key witness.

Val and Anita were both interrogated in 2007. Nothing was ever reported if Val chose to speak or answer to questions. Anita had said in an interview that she chose to remain silent b/c their (ALE) questions were not about finding the truth. I'm thinking that Val also didn't answer questions b/c from a 2007 (February) interview, Val was chiding his father not to give an interview b/c of later regrets for having said something that could be twisted. The interrogation apparently was 4 hours.

[fierljepper]

02:34 hotmail Valentijn + 03:07 surfing to a plane website (probably also Valentijn) makes more sense to me than Valentijn getting a minute when Joran just has confiscated the computer or that Valentijn had just gone to bed and did hear Joran come in but didn't pay any attention to it..just went to sleep.

GMBW,

Maybe you're right, but I'm still bothered about a 15 year old being on the computer that time of day on a school's night.

Joran most certainly didn't wake up Val around say 2:30, since Joran was on the phone with Deepak that time and allegedly rushing home barefoot in the vicinity of MacDonalds. But, Joran could have been arrived around 3AM-ish (given his 3:11 and 3:13 calls). In that case two scenario's emerge:

1a. He saw light in the house, peeked through the window and saw his brother behind the PC. He could have gone in and since now both have to hide something from their dad they decided to collude and not to betray each other.

1b. He saw light in the house, mubled to himself 'shit, there goes my alibi' and decided to wait in his appartment until the lights went out. He then sneaked in and switched on the PC.

2a. There was no light, but he made so much noise entering the house and getting a snack from the fridge, that he woke up Val. He had already switched on the PC, so Val asked him heavily yawning where he had been and went to his favo x-plane website

2b. There was no light, but he made so much noise entering the house and getting a snack from the fridge, that he woke up Val. This only happened after Joran already had switched on the PC and visited the x-plane site. Val then entered the room and sneaked to Hotmail on the free 3:34 gap between two MSN messages.

Or they just completely missed eachother by only 4-5 minutes in the middle of a school's night during the most eventful VDS day ever that later turned into one of the most discussed on the web... ...and nobody ever asked Val for his story...

[fierljepper]

Fierljepper:

The investigators only state that Val had visited that site before (but wonder how they could they have seen that, since the VDS computer only has one account that is used by everybody. It must have been based on some circumstantial evidence that it was Val who logged on Hotmail just before or after that and/or a certainty that Joran wasn't home that time. To my knowledge Val was never interrogated, which is a bit strange for such a key witness.

Val and Anita were both interrogated in 2007. Nothing was ever reported if Val chose to speak or answer to questions. Anita had said in an interview that she chose to remain silent b/c their (ALE) questions were not about finding the truth. I'm thinking that Val also didn't answer questions b/c from a 2007 (February) interview, Val was chiding his father not to give an interview b/c of later regrets for having said something that could be twisted. The interrogation apparently was 4 hours.

Thanks Luv. I didn't know this, but apparently he kept his mouth shot. It is bit strange that he chose that strategy, since if they would have met that night it would actually help Joran by having a witness that brought him home around 3AM, making his "Satish picked me up" story even more credible. Of course if there nothing to say and they missed eachother that night, his witness statement could only induce more risks and twisted words that could harm his brother. It would be nice though when he just would have confirmed his computer activity that night.

[fierljepper]

Now, let's go one step wilder...

What if Val actually joined J2K that night. Big brother re-enforcing his position by showing younger brother what life's really about. Mum gone to NL, dad deeply asleep. Both boys do also resemble each other a bit.

Val joined them in the car, however didn't go into CnC's (too young) but waited outside on the parking lot for things to come. No witnesses have seen that only 3 boys were in the car after it left CNC's, so there could have been 4 or more. Then after the lighthouse visit J+N were dropped off together on the beach and K2 dropped off Val at home. Val was back home around 2:10 and decided to switch on his PC and to wait for Joran to arrive home since he must had to tell some 'really good stories' about that evening. Yeah, his older brother was really on to something very exciting here!

Deepak and Joran later agreed to protect both their younger brothers and do so until today (although there's no reason why K2 wouldn't tell the truth unless they have something to hide as well. But hey, maybe they do really care about the innocent part of the VDS family).

Another scenario is that J2K + N indeed first went to the VDS house (as Joran claimed at some time) and then picked up Val for a late night trip. Later he was dropped off at the VDS house etc.

This is at least one reason I can think of why he was awake so early that morning, but maybe he just couldn't sleep and visited his computer many nights (would be interesting to check this against his computer log files though)...

[luvslalom]

Thanks Luv. I didn't know this, but apparently he kept his mouth shot. It is bit strange that he chose that strategy, since if they would have met that night it would actually help Joran by having a witness that brought him home around 3AM, making his "Satish picked me up" story even more credible. Of course if there nothing to say and they missed eachother that night, his witness statement could only induce more risks and twisted words that could harm his brother. It would be nice though when he just would have confirmed his computer activity that night.

Had Val made a statement/answered quesitons Phil would have asked for same for the Kalpoe lawsuit. There's no mention of this on the discovery log.
VDS had two dogs that would have barked when someone is approaching, imo. I'm wondering if that isn't what woke Val to begin with?

[Rolls]

1. Why was Val up so late

Kids of this age are known to stay up real late reading under the covers with a torch/flashlight; I've heard them on CB in the early hours; I know parents that have had trouble with computers and TV's in kids bedrooms. (shrug)

1. The VDS computer analysis records indicate that they forgot to record the data/time when they secured the hard disk.

Huh? They took the computer - and its RTC chip.

Another scenario is that J2K + N indeed first went to the VDS house (as Joran claimed at some time) and then picked up Val for a late night trip. Later he was dropped off at the VDS house etc.

Young guy and young chick want a younger sibling along?
You are joking, aren't you?

-
Interesting construct. Thanks for putting that together.

Thort 1: bringing Val in introduces a complexity that doesn't seem to help resolve any of the unknowns.

Thort 2: this suggested timeline still leaves the same people doing the same known things (that have nothing to do with disposing of Natalee) which still seriously limit the possible field of action that night.

-Rolls

[AC]

I can't remember, but how old was Val in May of 2005? Does anyone remember?

[sarge]

He was 15. Not long afterwards he was sent to the USA.

[GBMW]

02:34 hotmail Valentijn + 03:07 surfing to a plane website (probably also Valentijn) makes more sense to me than Valentijn getting a minute when Joran just has confiscated the computer or that Valentijn had just gone to bed and did hear Joran come in but didn't pay any attention to it..just went to sleep.

GMBW,

Maybe you're right, but I'm still bothered about a 15 year old being on the computer that time of day on a school's night.

Joran most certainly didn't wake up Val around say 2:30, since Joran was on the phone with Deepak that time and allegedly rushing home barefoot in the vicinity of MacDonalds. But, Joran could have been arrived around 3AM-ish (given his 3:11 and 3:13 calls). In that case two scenario's emerge:

1a. He saw light in the house, peeked through the window and saw his brother behind the PC. He could have gone in and since now both have to hide something from their dad they decided to collude and not to betray each other.

1b. He saw light in the house, mubled to himself 'shit, there goes my alibi' and decided to wait in his appartment until the lights went out. He then sneaked in and switched on the PC.

2a. There was no light, but he made so much noise entering the house and getting a snack from the fridge, that he woke up Val. He had already switched on the PC, so Val asked him heavily yawning where he had been and went to his favo x-plane website

2b. There was no light, but he made so much noise entering the house and getting a snack from the fridge, that he woke up Val. This only happened after Joran already had switched on the PC and visited the x-plane site. Val then entered the room and sneaked to Hotmail on the free 3:34 gap between two MSN messages.

Or they just completely missed eachother by only 4-5 minutes in the middle of a school's night during the most eventful VDS day ever that later turned into one of the most discussed on the web... ...and nobody ever asked Val for his story...

IIRC it was also Valentijn who woke up Paulus the next night when the family was at the door....and that wasn't at a reasonable time for a kid his age on a school night either.MO Maybe Valentijn was the first one to wake up because of the noise or maybe he was still awake.

It's likely they missed each other and it's likely they didn't.

But if Valentijn would be able to give Joran an alibi for how late he was home...why is Joran going on about records and that they proof the time he got home?

It's likely one wouldn't find it odd a brother would back up a brother; but it would have given Jorans alibi of when he got home more foundation. MO

But in the leaked statements it's not mentioned,not in his book nor in the interviews he has given.

This could be because they did miss each other or maybe that brotherly time spent together was a topic of conversation on another 'poolmeeting'.

[AC]

He was 15. Not long afterwards he was sent to the USA.

Thanks, Sarge!

[billybob]

Now, let's go one step wilder...

What if Val actually joined J2K that night. snipped on purpose...

I cannot believe this post. Val would have no parts of anything like that. First he and his brother were not that close. Nothing Joran was doing back then would have interested Val at all. and actually it sickens me to see Val mentioned like this - in such a wild preposterous tale.

[GEL]

bb, that's the way a lot of us feel about the Twitty boys, especially the repeated crap about Thomas Twitty. Val was on Aruba as were the Twitty boys, so I guess they're all fair game. If you want to omit Val you have to omit Thomas Twitty. Can't have it both ways, IMO.

[sarge]

I cannot believe this post. Val would have no parts of anything like that. First he and his brother were not that close. Nothing Joran was doing back then would have interested Val at all. and actually it sickens me to see Val mentioned like this - in such a wild preposterous tale.

Did you know Val or Joran very well in May of 2005?

[Reality]

I can't remember, but how old was Val in May of 2005? Does anyone remember?

A mere child, would you like your kid stalked like you are doing joining in with the mob here ?

[Reality]

bb, that's the way a lot of us feel about the Twitty boys, especially the repeated crap about Thomas Twitty. Val was on Aruba as were the Twitty boys, so I guess they're all fair game. If you want to omit Val you have to omit Thomas Twitty. Can't have it both ways, IMO.

Aren't you a lovely baby ?

Do you have children Vals age ?

But I guess in your book its an eye for an eye, 2 wrongs make a right.

[fierljepper]

Huh? They took the computer - and its RTC chip.

Rolls,

Understand the confusion. They took an image copy of the HD and that's what they used to investigate. So, investigators got fysically separated from the PC (and the RTC). Apparently they forgot to note down the system time/zone when they made the image copy of the HD.

Here's what the report says:

The investigation was conducted by us with the forensic research programme Encase 4.20 & Encase version 5.03 and Forensic Toolkit version 1.51. Below is an overview of the data belonging to this image-backup.

(...)

The data we’ve researched were a copy of a hard disc with the following properties:

(...)

System date & time:
After making inquiries, it became clear to us that the hard drive was secured by the research team, and hereby no date and time regarding the concerned computer was noted. By means of comparing several found html pages, which were made during the log ins on the hotmail accounts of Joran van der Sloot, Paulus van der Sloot and Valentijn van der Sloot, on May 30 2005 and May 31 2005, with the login info on Hotmail MSN, provided by the research team, it seemed to us that on May 30 2005 and May 31 2005, the computer system did not have relevant deviations. During the further investigation the time zone was put to us at GMT -4, which is consistent with the local time of the computer system which the investigated hard drive came from.

Young guy and young chick want a younger sibling along?
You are joking, aren't you?

Yes. Agree this scenario indeed leans towards the extreme end of the continuum of likely possibilities...

-
Interesting construct. Thanks for putting that together.

Thort 1: bringing Val in introduces a complexity that doesn't seem to help resolve any of the unknowns.

Thort 2: this suggested timeline still leaves the same people doing the same known things (that have nothing to do with disposing of Natalee) which still seriously limit the possible field of action that night.

-Rolls

True. However, even it Val is a 'light' sleeper and wakes up easily during the night, I still feel there could have been something that woke him up between say 2:00 and 2:25 (need some to time to fully wake up and fire up the PC at 2:34). Just wondered if there is any way to connect the dots between the events on the beach and Val waking up? The VDS family have dogs and they typically react to 'people that make a move'.

Few thoughts around such 'moves' that could have been induced between 2:00-2:25:

1. The Daury scenario is true and Daury indeed is Daddy. In some way Joran managed to call his dad around 2:10-ish that night after Natalee died (although I can't think of a logical way that wasn't shown in any of the records (even tried pigeons and smoke signals), except for the situation that PvdS had his own secret mobile phone, disposed of it and used Anita's), Dad woke up, dogs gots excited, he drove off to help his son, send Joran home and disposed of the body in a way that only. Maybe Dad even decided to take the two dogs with him in the car hence the link to the peculiar statement from Joran at one time "and then Deepak came with two dogs and buried her near the Fisherman's huts". Is that the source of the dogs reference?

2. Joran called Val's mobile and woke him up that way when things got out of hand around 2:10. Val wakes up his dad, hands him his phone and Dad rushes off to the beach, etc. Val of course stays up until Joran got home, doesn't know what happened and likes to hear the end of this story. There was a rumour once that Val's mobile had been found and also (from Joran's book) that Joran had destroyed the SIM card of his brother phone during a holiday once (why would somebody do or mention such a weird thing).

3. Joran was home together with Natalee. He was f.i. dropped off by the K2 around 2AM and took Natalee into his room. Or Val woke up by the loud noise of Deepak's car. When she collapsed he went into the main house and woke up the sleeping dogs. An interesting scenario is that Deepak got fed up driving around and indeed was on the PC at 2AM since they first all drove to the K2 home to drop off Deepak and then Satish took over the wheel to drive back with J+N to the VDS house (or to a worse place). Joran goes into the house wakes up his Dad (and Val) and Dad puts J. on the computer when he disposes of the body.

4. He just woke up because he is a young boy full of energy and does this every night (the full computer records will probably prove/disprove such behaviour). It is strange though that was on the computer 3:07, Joran allegedly arrived home around 3:11-3:20-ish, must have stirred the peaceful sleeping dogs again and still Val didn't notice this being in his bed just 10 minutes or so.


5. ...?

[billybob]

bb, that's the way a lot of us feel about the Twitty boys, especially the repeated crap about Thomas Twitty. Val was on Aruba as were the Twitty boys, so I guess they're all fair game. If you want to omit Val you have to omit Thomas Twitty. Can't have it both ways, IMO.

and I agree with you -- you have never seen me make one post about the Twitty boys -- EVER!!!

[billybob]

Did you know Val or Joran very well in May of 2005?

I know them both very well now - and I do know more about their relationship than you all do!

[GEL]

and I agree with you -- you have never seen me make one post about the Twitty boys -- EVER!!!

Not saying 'you' did, but you know what I meant or you wouldn't have agreed. Thanks bb.

[sarge]

and I agree with you -- you have never seen me make one post about the Twitty boys -- EVER!!!

You have never spoken any unkind words about the Twitty boys or about Natalee's brother. You did not ever engage in any of the unkind remarks about his weight or as far as I can remember, you did not ever say anything unkind about Natalee.

I think you are sincere when you talk about the VDS and you are friends with them now. However, unless you lived in their house and knew the family before the Natalee Holloway disappearance you cannot speak as an authority on went on in their house before you knew them. You only know what you have been told.
It seems to me that Val has turned out to be a fine young man with a very bright future ahead of him. Speculation here is just that, speculation or theories of what might could have happened.