Kris Kremers and Lisanne Froon were two Dutch women that disappeared in Panama on April 1st, 2014. Three months after they disappeared, their backpack was found on the bank of the Serpent River, 14 Kilometers north of where they were last known to be hiking. Inside of their backpack was numerous items, including the Canon Powershot camera they had taken with them on their hike. The camera was still working.
Investigators found numerous photos on the camera’s SD card – photos that were taken by Kris and Lisanne. However, one photo had been permanently deleted from the camera. Photo #509 was nowhere to be found. This single photo is the subject of much debate and might contain the answer to exactly what happened to Kris Kremers and Lisanne Froon.
Matt is an expert on this case. He purchased the exact same camera model that Kris and Lisanne used on their trip. To date, Matt has tested the camera more thoroughly than anyone, including Dutch and Panamanian investigators. He previously used the camera to replicate similar night-photo conditions (Matt’s other article).
Matt wrote the following technical analysis in order to demonstrate the operations and functionality of the Canon Powershot SX270 HS and the SanDisk SD card that contained the photos.
Missing Photo #509 Analysis
This article discusses the missing photo 509. In this analysis, the words “photo” and “image” are used interchangeably. There are 133 photos available that were taken on and after 01 April 2014. Photos 476 to 508 are 33 images that were taken on 01 April. Photos 510 to 609 are 100 images were taken on 8 April 2014.
The following information is known about the missing photo 509:
- It was taken after Image 508, which puts the earliest time it could have been taken at 01 April 2014, 13:54:59
- It was taken before Image 510, which puts the latest time it could have been taken before 08 April 2014, 1:29:32
Image 509 must have been taken between 01 April 2014, 13:54:59 and 08 April 2014, 1:29:32.
This large timespan that the photo could have been taken leaves a sizable gap of unknown information. Therefore, it’s helpful to try to narrow the potential timespan of when photo #509 could have been taken.
If we look at the pattern of how all photos were taken (see: New Case Data: Timestamps Of Missing Daytime Photos), it becomes obvious that the photos were all taken in groups of at least 2 photos. If photo #509 was taken as part of the normal pattern of other photos on 01 April 2014, we can determine that it would be likely that photo #509 was taken as part of the group, with 507 and 508, and it would be the third image in this group. Furthermore, it would likely have been taken with a similar time apart as 507 and 508 which would put the timing at approximately 13:55.
The next significant event is the emergency calls at 16:39 on 01 April 2014. It is not likely that people take images in distress situations for reasons other than documenting that distressing situation and if that was done those images would more likely have been taken with the cell phone that was already in their hands rather than taking the camera from the backpack and using it. Therefore, it is likely that 509 was not taken on 01 April 2014 after 16:39.
There remains the possibility that photo #509 was taken between 02 – 07 April. However, it is unlikely that the camera was used to take a photo while the cell phones were used during the days until 06 April. If there was a desire to take pictures it could have been done with the cell phones that were already powered on and available. It is also more likely that several pictures would have been taken if there was a need to document anything with the camera.
The next possible time 509 could have been taken is on 08 April when the camera was used to take images 510-601. Image 509 would have had to be taken and deleted before image 510 was taken, which is extremely unlikely that images were deleted in a stressful situation at night.
It is not possible to say when image 509 could have been taken but it could be more likely that it was taken on 01 April between 13:55 and 16:39, closer to 13:55.
Image Numbering
All 133 images are sequentially numbered, just like the Canon SX270 HS digital camera would do. Out of the sequence of images there is no image 509. It was not available to the forensic analyst who examined the SD card of the camera. Looking at the SD card on a Windows computer would look as shown in Picture1 below:
Picture 1 (above): Simulated sequence of images. Note that those are not the real images nor times and it serves only to visualize the file names.
Note that the camera has 2 methods of numbering images. “Auto Reset” and “Continuous”. The differences relevant to this situation is that “Auto Reset” will give the next image a number sequential to the last image taken, regardless if the number was already used before. If Image 509 was deleted before 510 was taken, the camera would use image number 509 again.
“Continuous” will only use one image number once and if an image was deleted, it will give the next image a new number. If 509 was deleted, the next image would be 510.
I analyzed EXIF data from the Canon SX270 HS and unfortunately the image numbering method is not saved in the EXIF information. The default setting is “Continuous” and it was used for all tests performed in this article. All testing for this article was done with Firmware 1.02 (the firmware that was installed on Lisanne’s camera).
Possible Reasons For Image 509 Missing
There are two reasons why Image 509 could be missing:
- It never existed.
This would be the case if it was not recorded due a camera malfunction, or the camera skipped the number. This however is not very plausible because the likelihood for a computer to miscount or miss numbers is minute. This likelihood increases somewhat at number “difficult” for computers and those are binary numbers, that exceed either one or more bytes such as 256 and 65536. If a counter only uses one Byte to count, it can only hold 256 values and for the next value would likely “roll” over to 0 or 1. Tests have shown that this is not the case for the Canon SX270 HS but it starts over at Image_0001 after having reached Image_9999. It does not overwrite images but stores them in a new folder. No issues with number roll over occur with the Canon SX270 HS.
To determine if the Canon SX270 HS skips image numbers, an experiment was conducted where 522 images were taken on a Sandisk standard speed memory card with camera default settings and as fast as the camera can take the images to challenge it the most into missing images. No flash was used for this trial. Taking the images took 15 min and on average it took 1.7s to take each image. No image number was missed by the camera.
In order to challenge the camera more, a faster SD card (Sandisk Extreme, 90MB/s write speed) was used and 503 images were taken with settings that would result in the smallest possible image size (50-84 kB) so that they would be written as quickly as possible to “trip up” the camera.
Taking those 503 images took 12 min and on average 1.4s for each image. Another test with the fast SD card and default settings was done and another 504 images were taken, which took 10 min and on average 1.2s. The differences in duration for each image are caused by external factors, like focusing and other camera functions, rather than by SD card write speed. In all cases, no image number was skipped.
A total of 1529 images were taken under conditions that would challenge the camera the most to skip an image number, but not a single image number was skipped.
Another test was then conducted where the camera was set to burst mode in manual mode and another 13384 images were taken until the battery ran out. In this configuration the camera took 0.3s per image and it did not skip any image number.
This establishes that the likelihood for the camera to skip images could occur at most every 1 in 1530 images or 0.07% if images are taken as fast as possible under reasonable realistic conditions.
If Lisanne’s camera skipped image 509, that would be a likelihood of 1 in 509 or 0.2%. If this was inherent to this Camera model, 3 images should have been skipped in the series of 1529 but instead none skipped.
If we add the images taken in burst mode, then the likelihood for the camera to skip images could occur at most every 1 in 14914 images or 0.007% and 30 skipped image numbers should have been observed in this trial.
It can be concluded that the likelihood for the camera to skip images numbers is extremely low with less than 1 in 14914 or 0.007% and was not observed in the experiment.
2. It was deleted.
The only other reason why the image does not exist is for it having been deleted. For this there are two possibilities.
- It was deleted by Lisanne
- It was deleted by someone else
Before exploring this question further, it should first be examined what was found on the memory card when examined by Dutch forensics:
- 470 images, 133 of which taken on or after 1 April 2014
- 7 videos, none of which taken on or after 1 April 2014
With image recovery software 64 images and 4 videos that were deleted and partially overwritten were found. No trace of image 509 was found or recovered, but 40 JPG images could be recovered.
All recovered images were thumbnails and other formats of images “IMG_0476.JPG” through “IMG_0609.JPG”. Forensics commented that those thumbnails were likely created by the camera to preview images when they are replayed in the camera. However, this is not correct as the camera does not create or store thumbnails and the review images are created from small versions of the image that are embedded in the EXIF information, which can be seen in Picture 2 below.
Picture 2 (above): Preview image and Thumbnail contained in EXIF data. Note: The image is an example only.
Another noteworthy observation are the image names of images 505, 506 and 507, which do not have the expected image name of “IMG_0xxx.JPG” but contain an appended string “~RF1xxxxx.TMP”, e.g. “IMG_0505.JPG~RF17df08.TMP”. The comment in the forensics report is, that this is the version before rotation of the image. All three images are taken in portrait orientation and it is likely that they were rotated with image editing software and then saved. I do not know which software would do this and change the file name like that but I suspect it was Apple software. It should be noted that those file names appeared first in Panama but it is unknown when and by who they were created.
It is apparent that someone reviewed and edited those images on a computer. At a minimum those edits consisted of rotating images and deleting thumbnails that were most likely auto generated by the image viewer used. Unfortunately it was not determined when the edits and deletions were made and if it was done before or after the camera was given to the police.
With the very limited information in the forensics report it is not possible to determine when all those changes were made. For this access to the disk image of the SD card would be required.
Picture 3 (above): excerpt from the Forensic Report, showing image 509 missing.
Forensics also reviewed the sectors on the SD card (on an image of the SD cars) to locate image 509. Picture 4 shows what was found.
Picture 4 (above): Sectors on the original SD card as found by forensics. Comment by forensics.
To demonstrate better what those numbers mean, lets dive a little deeper into how SDs function.
Picture 5 (above): Generic Image of a Sandisk 16 GB memory card (left) and its internal flash memory chip (right). Note: This is not the real memory card.
An SD card contains a flash memory chip as seen in Picture 5 and a controller chip. The flash memory chip has storage bits that are logically assigned to sectors by the operating system. Each of those sectors holds 512 bytes. An image that has a size of 1 Megabyte or 1,048,576 bytes would occupy 2048 of the 512 byte sectors. The operating system (on an empty SD card) will write the data into 512 consecutive sectors. So this image would occupy sectors 1 to 2048. The next 1 Megabyte image would then be written into sectors 2049 to 4097. Every further image would be written into the next free sector so that all images are stored sequentially in the order they were taken.
The following graphic shows a simplified visualization of a memory card that only contains sectors 1 to 400 for easier visualization.
Picture 6 (above): Simplified visualization of the sectors on a SD card.
If images are written into this simplified SD card, it would look as follows.
Picture 7 (above): Simplified visualization of the sectors on a SD card with images written on it.
There are 16 files written into this SD card. Each color represents a different file with the color not having any other meaning as making it easier to tell the files apart.
The first file (green) or image 1 occupies sectors 1-6. The second file written to this SD card would be Image 2 and the OS would have placed it sequentially into sectors 7-10. This image is a little smaller and therefore only occupies 4 sectors, while image 1 is larger and occupies 6 sectors. Larger images simply occupy more sequential sectors.
Rather than visualizing the sectors of the SD card as a square, it can also be visualized as a long chain, which is in a way easier. Picture 8 below shows the same files occupying the same sectors as in Picture 7 above. Image 1 still occupies sectors 1-6 and Image 2 occupies 7 – 10 , etc.
In Picture 8 we see 7 images up until sector 29, where I have made a cut to fit the image into the page.
Picture 8 (above): Simplified visualization of the sectors on a SD card as a long chain with images written on it.
This method of visualizing sectors sequentially will be used from here on.
If we delete image 2 (we remember it occupied sectors 7 – 10), then there will be an empty space, where image 2 used to be. The other images will not move and Image 1 still occupies sectors 1-6 and image 3 occupies sectors 11-15. The operating system of the camera will eventually fill the gap with other data or other images but it will not move already used sectors to fill the gap. Note that Windows would do this on a hard drive, which is known as defragmentation, but the Camera does not do this on the SD card.
Lets visualize the images and sectors that were found on the original SD card. Note that for simplicity sector numbers are started at 1 and each image occupies 10 sectors:
There is no gap or empty sectors between any image.
To determine how this arrangement of images can be achieved, a series of tests was conducted, and the results analyzed. If a simulated test results in the same arrangement of images and sectors, it can be a possible true event and otherwise it can be discarded as a true event.
A Canon SX270 HS with Firmware 1.02 was used. This is the same firmware as Lisanne had on her Canon SX270 HS, which is known by EXIF data published by Juan (link to Juan’s website). All camera settings were set to default and the file numbering method was left at default (“Continuous”).
After images were taken, the SD card was opened with a Windows 10 PC and the sectors on the SD card examined with WinHex/X-Ways Forensics 20.1.
Below is an example of the data given by WinHex on a test run where Image IMG_0009.JPG was deleted. Note that deleting an image on a FAT32 SD card will not actually delete the image itself, but it will only delete the directory entry to the file. The file is still on the SD card and is recognized automatically by WinHex and displayed as “?MG_0009.JPG”. This image could easily be recovered since it is still on the SD card, which is what image recovery software does. It looks for such image remains and restores an entry for the directory so that it is shown by the operating system. This however is irrelevant for this experiment and is only mentioned since WinHex shows this deleted image instead of a simple gap (Picture 9).
Picture 9 (above): Example of sectors and files as given by WinHex. This is not the real SD card.
WinHex also displays the first sector that is used by the file. Unfortunately, it does not display the last sector but for sequentially written files the last sector can be determined by the first sector and the file size. For example IMG_0001.JPG has a file size of 7.1 MB. The FAT32 formatted SD card holds 512 Byte per Sector, so the 7.1MB image file will occupy 7.1MB / 512Byte or 14,541 sectors. IMG_0001.JPG starts at sector 8384 and will end after 14541 sectors on sector 22925. The next image would then start at sector 22926. In the example above this is not the case as IMG_0002.JPG starts in sector 23040. The difference comes from the fact that the image size shown by WinHex is the net image size, while the image actually occupies a little more space on the disc as not just image information but also other meta data from the Operating System is stored.
In order to determine the size, the image occupies on disk, one can view this information in the file properties in Windows. Picture 10 below shows the difference between image size and file size for a random image.
Picture 10 (above): Windows file properties.
For simplicity and since the difference is very small, I used the net image size and not the image size on disk in order to look for gaps between images. If there is an actual gap from a missing image it is in the range of thousands of sectors while the small error from using image size vs size on disk accounts to only a few sectors difference and allows to collect valid results with this simpler method.
Camera Functionality Tests
I conducted eleven tests to see how the camera operates in terms of number photos.
The following summarizes tests that I conducted and their results in regard to gaps between image numbers. All test results are simplified to sector numbers starting at 1, one image taking up 10 sectors and image numbers changed to the real images. This does not change any results and is only done to simplify the results and their visualization.
Test 1:
- Take six (6) images: 504, 505, 506, 507, 508, 509
- Delete the last image (509) in Camera
- Take two (2) images: 510, 511
Test 1 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO image 509
- There is NO gap between images 508 and 510
Test 2:
- Take six (8) images: 504, 505, 506, 507, 508, 509, 510, 511
- Delete image (509) in Camera
Test 2 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO image 509
- There IS a gap between images 508 and 510
Test 3:
- Take six (8) images: 504, 505, 506, 507, 508, 509, 510, 511
- Delete image (509) with a Windows 10 PC
Test 3 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO image 509
- There IS a gap between images 508 and 510
Test 4:
- Take seven (7) images: 507, 508, 509, 510, 511, 512, 513
- Delete image (509) in Camera
- Copy all images onto a Windows 10 PC
- Delete all images from their folder on the SD card with a Windows 10 PC
- Copy all images back into their folder on the SD card with a Windows 10 PC
Test 4 Result:
- On the SD card are images 507, 508, 510, 511, 512, 513
- There ARE random gaps between random images
Test 5:
- Take six (8) images: 504, 505, 506, 507, 508, 509, 510, 511
- Delete image (509) with a Computer
- Copy the main image folder “DCIM” with all image sub folders onto a Windows 10 PC
- Delete main image folder “DCIM” on the SD card with a Windows 10 PC
- Copy the main image folder “DCIM” with all image sub folders from the Windows 10 PC back onto the SD card
Test 5 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO image 509
- There is NO gap between images 508 and 510
Test 6:
- Take six (6) images: 504, 505, 506, 507, 508, 509, 510, 511
- Delete image (509) with a Computer
- Copy the main image folder “DCIM” with all image sub folders onto a Windows 10 PC
- Format the SD card with a Windows 10 PC
- Copy the main image folder “DCIM” with all image sub folders from the Windows 10 PC back onto the SD card
Test 6 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO image 509
- There is NO gap between images 508 and 510
Test 7:
- Take four (4) images: 505, 506, 507, 508
- Take one (1) video: MVI 509
- Right away take four (4) images: 510, 511, 512, 513
Test 7 Result:
- On the SD card are images 505, 506, 507, 508, 510, 511, 512. 513
- There is NO image 509
- There IS video 509
- There are NO gaps between images or videos
- The video 509 is not stored in the sequence it was taken
The video was most likely not written right away as the camera does some processing to it and if images are taken before the camera is finished with the video, it is saved at that time and not necessarily in order.
Test 8:
- Take four (4) images: 505, 506, 507, 508
- Take one (1) video: MVI 509
- Wait then take three (3) images: 510, 511, 512
Test 8 Result:
- On the SD card are images 505, 506, 507, 508, 510, 511, 512. 513
- There is NO image 509
- There IS video 509
- There are NO gaps between images or videos
- The video 509 is not stored in the same place, image 509 would be stored.
Test 9:
- Take four (4) images: 505, 506, 507, 508
- Take one (1) video: MVI 509
- Turn Camera OFF and ON
- Take three (3) images: 510, 511, 512
Test 9 Result:
- On the SD card are images 505, 506, 507, 508, 510, 511, 512. 513
- There is NO image 509
- There IS video 509
- There are NO gaps between images or videos
- The video 509 is stored in sequence and in the same place, image 509 would be stored.
Test 10:
- Take eight (8) images: 504, 505, 506, 507, 508, 509, 510, 511
- Secure Erase image (509) with a Windows 10 PC and Eraser 6
Test 10 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO image 509
- There IS a gap between images 508 and 510
Secure erase does not simply delete the directory entry like the Windows 10 file delete does, but it overwrites the actual image file with random data. This makes the image unrecoverable but does look very differently on a sector basis when compared to a file deleted with Windows 10.
Test 11:
- Take six (6) images: 504, 505, 506, 507, 508
- Take video 509
- Turn Camera off / wait until buffering is complete
- Take two (2) images: 510, 511
- Delete video 509 in camera or with Windows PC
Test 11 Result:
- On the SD card are images 504, 505, 506, 507, 508, 510, 511
- There is NO video 509
- There IS a gap between images 508 and 510
General observations:
- Rotating an image on the SD card with a computer will not move it out of its location since only an EXIF flag is changed and not the image rewritten. Note that some old software may still rewrite the image.
- Using Auto Reset file numbering does not change anything in principle as of how the images are stored on the SD card. It would only change the way the files are numbered. If Auto Rest was used, then there would be no missing image name 509 if the image was deleted before image 510 was taken.
- There is no principal difference if 509 was an image or a video. For that reason it will only be discussed as if it was an image
Test Summary
Out of all test runs there were three (3) that matched the configuration that was found on the original SD card: Test 1, Test 5 and Test 6. All other tests resulted in different configurations., See Picture 11.
Test 1 consisted of deleting Image 509 in camera BEFORE image 510 was taken.
Test 5 consisted of copying the image folder DCIM on a computer, deleting the image folder DCIM with a computer, deleting image 509 and copying folder DCIM without image 509 back onto the SD card
Test 6 consisted of copying the image folder DCIM on a computer, formatting the SD card, deleting image 509 and copying folder DCIM without image 509 back onto the SD card
Picture 11 (above): Summary of test to evaluate how images appear on disk.
Note that the possibility that 509 was a video does not change anything in principle and therefore only the possibility that it was an image will be further discussed.
Since Test 5 and Test 6 are essentially the same and require a computer the copy and delete images they can be pursued as one option, which leaves us with essentially those two possible events:
- Lisanne took image 509 and deleted it before taking image 510
- A 3rd Party deleted image 509 with a computer
It would likely be possible to determine which event took place by examining the SD card or the SD card image that the forensics had available. Unfortunately, the forensics report does not go into more detail as is shown in this article and therefore Event 1 or Event 2 cannot be distinguished based on evidence.
The only remaining option is to estimate the likelihood with which those events could have taken place and select the more likely one as the true event.
Event 1: Lisanne deleted image 509
Possible reasons for deleting the image are:
- Accidental deletion
- Intentional deletion by Lisanne
Let’s discuss these possibilities:
1. Accidental Deletion
Assuming the camera is turned on, a total of 4 small buttons have to be pressed in the correct order to delete an image, this includes one button press to acknowledge a prompt. If the camera is turned off stored away, it would also have to be turned on first, requiring 5 buttons to be pressed in the correct order.
To do this inadvertently while operating the camera is nearly impossible. It is also possible that the camera is put away while turned on and before the camera shuts off by itself, buttons are randomly pressed by movement. It is not very likely to put the camera away while turned on, but maybe possible in a stress situation. However then buttons still must be activated in the right order. The camera was likely designed to prevent exactly those things from happening and it is essentially impossible to happen.
2. Intentional Deletion by Lisanne
Image 509 would have had to be deleted by Lisanne before 510 was taken, which is possible, but the question is how likely it is. Of all the images that should have been deleted is image 495, which is a not published Mirador selfie in which Kris has her eyes closed. They spent a minimum of 15 min on the mirador which allowed for enough time to review images and deleted bad ones but this was not done, which suggests that Lisanne was not concerned about reviewing and deleting images that day. As the day went on, fatigue and stress would have increased which will make it much less likely that thought was spent on reviewing and deleting images.
The likelihood of Lisanne having taken, reviewed and deleted image 509 is probably less than 50%. It a possibility that images were deleted to make space on the SD card for more images. However if it is considered that 508 images were taken at the time and the 16 GB Sd card can hold upwards of 7000 images at highest resolution, this becomes unlikely.
Event 2: A 3rd Party deleted image 509 with a computer
- Accidental Deletion by a 3rd Party
- Intentional Deletion by a 3rd Party
Let’s discuss these possibilities:
- Accidental Deletion by a 3rd Party
It is known that there was access to the SD card that was done in a careless way, such as:
- Software was used on the SD card that created thumbnail images
- Thumbnail images were deleted from the memory card
- Images were rotated and saved back onto the memory card
This is an incredible amount of manipulation on the SD card that destroyed evidence. Whoever performed those manipulations on the SD card was extremely careless and it is not impossible that when the thumbnail images were deleted, also inadvertently image 509 was deleted. However, simply deleting image 509 was not done and the person doing it would also have to copy the entire image folder to a computer, accidentally deleted image 509, and then moved the folder back to the SD card. It seems unlikely that a person who carelessly works on the SD card would have gone through the trouble of also copying the images to a computer and then back onto the memory card. This sequence of events is somewhat unlikely.
The unknown person could have been anybody involved in finding the backpack and camera or it could have been anybody withing the police forces who had access to the SD card.
An inadvertent deletion would look like what was done in Test 2, where a gap was left:
As compared to what was found on the SD card:
It is also possible that several events occurred. If image 509 was inadvertently deleted and subsequently by someone else for any reason the images were taken off the SD card and copied back on, it would have removed the gap that can be seen in Test 2, and the sectors on the SD card would be arranged as they were found.
With access to the original SD card or the disk image taken from the SD card, it would likely be possible to reach further conclusion if those events could have happened or not.
2. Intentional deletion by a 3rd Party
It is possible that a 3rd Party intentionally deleted image 509. The question would be for a motive. What would motivate someone to delete an image and intentionally or unintentionally do it in a way that the image can not be recovered?
The answer can only be that there was something in image 509 that was not desirable for the others or the police to see. The only thing that this could be would be an indication of a suspect or a crime. It is possible that image 509 showed a person who is not involved in any wrong doing, however just by being in this image this person would be exposed to police scrutiny and they would have to undergo questioning and they may even be accused of criminal wrong doing by the public, as has happened with other local people. If anybody might have been shown in this image, they would have found themselves in constant questioning. First by police and then by the general public and news media.
Therefore, someone may have decided to simply delete this image and end any speculation about a possible person shown in the image.
The person deleting the image would have had to employ the methods described in Test 5 or 6. This could have been intentionally if the person possessed the knowledge how to ensure the image can not be recovered or unintentionally. The majority of people are probably not aware that deleting an image does not actually fully delete it to the point where it can not be recovered and they may not have the knowledge of how to permanently delete the image. Therefore it could only have been a lucky and unknowledge person or a knowledgeable person.
It is furthermore possible that image 509 showed something that would reveal something highly undesirable or incriminating about the disappearance or a person that was shown committing an illegal act. Someone could have just decided to simply delete image 509 by employing the methods described in Test 5 or 6 to avoid any suspicion against themselves or others.
It is difficult to assign a probability to this, however it is probably more likely than Lisanne having deleted the image. However it is not easily possible to assign a probability to this and it is left to the reader to form an opinion.
Conclusion Of Image #509 Analysis
The following are possibilities for why image 509 does not exist:
- Camera malfunction. The likelihood for this to have occurred is 0.007%
- Inadvertently deleted by Lisanne. This is nearly impossible.
- Intentionally deleted by Lisanne. This is probably less likely to happen than it was to happen.
- Intentionally deleted by a 3rd Party. It is not easily possible to assign a probability to this.
- Unintentionally deleted by a 3rd Party. It is not easily possible to assign a probability to this, although it is a possibility.
At this point it must be left to the reader to decide which possibility they accept as most likely.
Further research could be done if the disk image of the SD card was available. Until then it is only possible to rule out certain events from possibly having happened and confirming other events. Another problematic fact is that if any 3rd Party involvement in the disappearance of image 509 is accepted, it would also allow for the possibility that there were images or videos after image 609 that were also lost.
Final Comments
I’d like to thank Matt, as always, for his excellent research and contribution to this disappearance case. His diligent commitment to finding answers and moving this case forward is tremendously valuable. We all want more answers and offer our respects to these two girls and their families.
To reach Matt directly, please feel free to send an email to: researchtt2@gmail.com
For all of our articles related to the disappearance case, please visit the Case Articles page.
Thank you to all our supporters and readers!
Resources
Canon User Manual Library – The Canon Powershot SX270 HS is not found.
Wikipedia – Canon PowerShot S Series
Official Camera User Guide – Canon 2013. Local copy that was found online.
Please note: Our team is committed to accuracy of information and respecting the privacy of those involved with this disappearance case. If you have any supplementary information regarding the case, or if you were involved in this case and feel that the information available in this article impacts your privacy, please contact our team.
Thank you for the research! I personally incline to the version of the “Lost in the Jungle” authors’ view that the only plausible technical reason for all visible conditions was changing SD card, taking photo 509 and than returning the initial SD card and continuing taking further photos.
One may ask why the girls wanted to do such unobvious thing as changing the card in such extreme circumstances? The book authors suppose that the SD card was removed in order to extend the battery resource while using flash. But I think we should not rule out the possibility that after some incident the camera was broken and it didn’t work. Lisanne may have tried to do something with that, to fix the camera. May be she took the battery out as well and tried to change the SD card. We all try to do something which is obvious before taking some gadget to specialized repair service, aren’t we? At one moment the camera started working again and the photo 509 was taken while another card was there. Realizing that the camera is now working, Lisanne took that second SD card out and put the initial SD card on its place.
Book authors also mention that Lisanne may have been watching her friends and relatives photos on the camera’s screen. May be it was a way to get a little distraction from the horrors of the night in the jungle for her and Kris. And that fact also may have caused Lisanne to put the initial card on its place. For some reasons that SD card where the photo 509 was, is now completely missing. But of course that is just my presupposition. And only God knows best.
Apart from what I’ve said in the main comment (above) regarding replacing the SD card, we cannot rule out a huge variety of technical glitches and bugs which can not be reproduced deliberately without the risk of brokening the gadget. The authors of this article have done brilliant experimental work, but we must also bear in mind that it is very difficult to experimentally reproduce all the possible conditions affecting the camera at that time. I mean humidity, water drops, wetting of individual elements and contacts, as already mentioned here.
Still, in spite of everything, the theory of replacing the SD card in the process of repairing the temorarily broken camera by Lisanne seems to me the most probable. I wish success to the researchers of this complex topic. And again, only God (SWT) knows best.
Have you tried or will you please try the following:
Test 1a
Take a picture (or series of pictures),
remove the memory card (do not insert it or any other memory card),
take another picture (with no memory card inserted),
take a picture (or a series of pictures)
Test 1b
Take a picture the moment the camera is submerged, or the moment after.
Thank you
I’m replying to my own comment because I forgot that in test 1a you have to insert the original card before taking the second series of pictures. It might go without saying but I wanted to be specific.
Just remarkable research. You and Juan are doing the work the Panamanian officials should be doing. Have you shared all of your info with the families of then missing young women.
If anyone solves this case it will be because of the exhaustive work you have been so kind to share. Do not let anyone take credit for all your work and when this is solved let us know when “the Book” comes out.
Thank you for all your hard work….at least someone cares.
I am awaiting a response from tech support at Canon. The night shots are so nonsensical, and appear to be a malfunctioning camera stuck in a cycle of taking Fotos. Even the time between shots, supports the theory of a battery losing juice, with about 45 minutes between final 2 pics
Hi there,
First of all, my respect for all the work you people do on this case! Impressive!
Here is an idea I like to contribute. Please ignore if this was allready discussed or tested. I’m only recently started on the case of Kris and Lisanne and might have overlooked.
So here is my theory:
There might be another possible explanation to the non existance of photo 509. It could be easely tested by your team as you have the exact same camera as was Lisanne’s.
Let’s asume photo 509 was the first of the nightphoto’s taken but the flash was not enabled so photo 509 turned out pitchblack. Could it be the software of the camera therefore regarded it as erroneous and automattically did not save it to memory, but yet still counted the photonumbers +1?
Maybe taking photo’s with the Canon SX270 HS in pitchdark conditions with disabled flash and with counter set to either -Auto Reset- or -Continuous- is worth trying to see if this theory holds true or not.
Kind Regards, Wim.
I suspect the missing 509 is a photo of one the girls, mortally wounded or already dead; taken by the survivor as something to take back to the authoraties or family. Later they decide that it isn’t something appropriate to keep – maybe they don’t want the last photo of their friend to be one of pain and disfigurement so they chose to delete it. The later night photos are desperate attempts to alert somone in the dark as they grow more desperate for rescue.
Hi, Chris.
I would like to thank you and Matt for your meticulous and detailed research on missing photo 509.
This missing photo is the only item that makes me think the girls were murdered. I can’t imagine the killers hanging around for 10 days and setting up twigs and red plastic on a rock and taking a photo of it, or setting up the paper SOS with the end of a Pringles can and taking a photo of that or taking 100 photos of the night sky.
It seems like killers would’ve done their thing and vanished from the scene as quickly as possible and resumed their normal lives.
But, I have watched all the videos taking of El Pianista trail before the Mirador and all of the videos taken beyond the Mirador. I simply can’t understand how they would’ve had an accident or become lost.
Keep up the good work
I found the work done incredible and commendable. Just make a small observation. To maintain the complete smoothness of the procedure in a fully controlled environment, the operating system should be Windows 8.1/8, Windows 7 or lower, as Windows 10 was only released commercially in the year 2015. My attention in this regard should not be to the fact of implementations of new features in the operating system, but rather in the improvement of file systems (FAT 32 and NFTS).
Anyway, I very much doubt that Panamanian criminals, with very low level of education and education, knew how to perform a “Zero Fill” procedure on an SD Card. In this scenario, I think there would be two options: 01. Use some highly regarded software among forensic experts, such as Eraser. 2. Use the command “cipher /w:?” on Windows. Anyway, I reiterate, something a little “complex” for Central/Latin American criminals.
Hugs.
Were there any photos on the phones? I can’t believe there were none
For me deletion with nefarious intent by some unknown ne’er-do-well makes no sense: why go to all that effort when the card could be removed and be gone forever by being broke up and left in the forest somewhere, or even thrown in a fire.
Thinking on, the entire camera could have easily been lost and destroyed.
I see a similar fate for the girls’ phones, smashed up and buried or burned in a fire.
It makes absolutely no sense that someone would kidnap/kill the girls, yet let them keep their phones…even more unlikely they’d let the phones be found.
The girls were missing, no one expected anyone to find something. Why would a bad guy not destroy phones and camera, it’d be so easy… so much area to hide broken portable technology, especially burnt!
509 is a puzzle, but I think it was just incompetence-the Panamanian police were as bungling as Inspector Clouseau!
I think they just fell on the other side of the divide and spent their last days trying to get out.
As for not leaving messages on the phones, quite possible that they believed they get out of the fix they were in, and by the time the calamity was upon them, the survivor was unable to unlock the remaining phone…also, they wouldn’t be the first people in crisis not to leave behind a diary of demise!
Dear Eric,
Objection 01: The card or any device could even be burned or damaged in order to destroy any trace, as long as these devices had no material value and especially if they were not worth thirty thousand dollars!
Objection 02: Consider that you are a resident of Central America – a very poor region with very high rates of criminality of all kinds. A simple mobile phone with the Android system embedded in this region has a highly considerable value. What could we say about the other more sophisticated and therefore more expensive devices?
How about shock to the camera, a drop from high height? Could that cause a glitch in the count? Just a thought. This story hard to get out of the mind isnt it!
Exactly!!! Electronics malfunction in exactly this way. Imagine the lens extending and retracting…my camera vibrates noticeable.if it were on a boulder, stuck in a malfunction cycle, that explains the various changing views too
They took foto’s thumps up. The hike was 4 kms. Did they carry a compass? For only that?
I think they did not. On their phone was maybe a compass.
While sometimes they left their phone on, for no obvious reason, Mostly it was shut. A compleet week later (!) they suddenly made these nightviews.
With not coming in view themselves. NOT EVEN ONE TIME. Exept maybe the deleted pic.
There are a number of nighttime photos that do features parts of one girl’s body. We just can’t actually make out any details.
In the recently published Dutch book on the case “Verloren in de jungle”, a third method to reach the desired ‘missing 509’ end-state is described. This end-state with its contiguously arranged sectors could be reproduced by assuming a second SD-card existed (or exists). The logic is: take all pictures up to the 508. Insert a new SD-card, take the 509 (video or picture), take out the new SD-card and insert back the old one and take the 510.
The key questions that arise from this scenario are: Why would they want/need to swap the cards? What happened to the SD-card with the 509 on it?
You are right. There is no reason why they would suddenly change cards for just 1 pic. And there is no second card with that picture. Do they list other possibilities? I thought if you hit someone with the camera or fall with it, maybe the jolt moves the shutter, and when you power on it resets and skips to 510 without recording a photo. Don‘t know what the mechanism is, if it is possible. If she was still carrying the camera on 1 april, and they were attacked, it would make sense to use the camera as a weapon.
Dear Agno,
You read the book? Certainly the person who compared this hypothesis has a more fertile imagination than a seven-year-old child hiding some mischief from his parents. LMAO.
Apparently, photos from digital camera’s can disappear in similar situations but with a different brand:
https://www.dpreview.com/forums/thread/4357640
Impressive analysis!
Just a thought on the option “Camera malfunction. The likelihood for this to have occurred is 0.007%”
There is a possible contextual reason that might induce a higher likelihood for this option. What I’m thinking of is the following:
* the photo sequence stops after the 508 and before the first emergency call attempt.
* the emergency call must have been triggered by an emergency event,
* this could be as simple as a “trip & slip” whilst trying to take a picture,
* and this was whilst taking a selfie, i.e. the carrying band was not around the girl’s neck,
* and this resulted in e.g. a twisted ankle or some broken foot bones and a severe camera fall maybe even in some water.
Now, the camera malfunction is the one that is obviously the most difficult (and probably expensive) to try to reproduce. Don’t think you guys would like to ‘drown’ your test camera to assess what happens…;-) Also, it would be very difficult to reproduce the impact of e.g. moisture causing a short-cut on the SD-card or even only one of the copper contact pads of the card malfunctioning. To properly analyse this would require a deep dive in the camera’s OS and the interface protocol for the SD-card. Crucial is to establish how the OS determines that a write to the disk has been successful or not (SD-card presence is easier to establish)
I could imagine it works like this:
* OS recognises a new picture has been taken;
* OS displays the picture on the screen;
* OS increases the photo-counter (it has to, since the incremental filename needs to be generated before writing it to the disk);
* OS writes to the SD-card using the SD-card protocol.
I looked bit into the SD-card writing protocol (e.g. CMD25) and actually couldn’t find any final acknowledgement from the SD-card that the write has been successful. The camera OS just seems to push data through a serial interface to the card and assumes it to be correct (with CDC checks on the serial data to preserve the integrity). The OS obviously would give an error code if it couldn’t see the SD-card at all, however surprised to learn that their doesn’t seem to exist a “successfully written” acknowledgement step (but I might have overlooked something and I did focus on the slower SPI-protocol). https://openlabpro.com/guide/raw-sd-readwrite-using-pic-18f4550/ and https://openlabpro.com/guide/interfacing-microcontrollers-with-sd-card2/
Wonder what happens if one of the serial data pins is “taped off” to simulatie a poor contact. Would the OS still think the writing was progressing successfully, yet nothing is actually being written?
Every image from 506 was taken by the third party. Image 509 didn’t suit him, so he erased it with a software. Image 499 was surely manipulated with photoshop, so it’s obvious that the third party edited the SD card content too.
I believe what happened with image 509 is that it was taken on one of the wire bridges by one of the girls (probably Lisanne) who then fell because she was holding on with one hand to take the photo. She pressed the shutter button and fell at the same instant down onto the rocks and the camera was bashed or jolted which interrupted the flow of data from the camera sensor to the SD card. The camera had dispatched the image to the card but it never got there, hence why the sequence continued from image 510 in the night photos. Essentially the photo was lost in the flash circuitry of the camera before it reached the SD card, but the operating system in the camera regarded it as dispatched.
The other girl was also on the bridge at the same time and also fell in this incident and both girls sustained broken bones and were badly injured. They took some time to climb out of the river and then the two emergency calls were made from each of their two phones. If only one girl had been injured the other one would have left early next morning to seek help. Neither did, so they were both incapacitated
The camera fell into the river and was recovered, but took several days to dry out and become usable again. Hence the gap between 1st April and the night shots on the 8th. This was the first point after the accident at which the camera became usable again, and one of the girls used the flash to try signal for help.
After so long the girls must have decided nobody was looking for them and the pain and swelling from their injuries subsided enough for them to try and walk/crawl to help. Unable to cross the swing bridges again to return to Boquette, they made the fateful decision to head upstream along the river where they never found help and were eventually killed by wild animals or feral dogs. Help was however on the way and they would have been found had they remained where they were.
It’s a sad tale, but I do believe this explains the mystery behind the missing image 509, the strange night photos, and the discovery of their remains far away from the search area.
The first emergency calls were made 2 hours after image 508 was taken. It takes more than 2 hours to get to the first monkey bridge from the location seen in 508. This was proven and even filmed. I can’t remember the exact time it takes but it wasn’t even close to 2 hours. Then they take pictures while standing on a rope? Then the camera falls from a hight that cracks bones direktly on a stone and still works (takes no considerable damage)? You can see the camera in the pictures taken by the police. Doesn’t look damaged to me. So I don’t think any of this is a thing.
You would also have to be really stupid to stand on a monkey bridge with 2 people and take pictures. I don’t think they were that stupid.
But it doesn’t matter, since this scenario isn’t possible anyway.
They could have gotten to the monkey bridge earlier if they were jogging.
First and foremost, the author has done a meticulous analysis, and nothing I write detracts from it.. I am still curious. Does the camera store an image when its metadata is corrupted? It was suggested that a confused time -zone border led to an invalid geotag. Indeed, the jungle abuts a border with Costa Rica, so software might have been unable to resolve the time-stamp at moment of image capture. Thus, it was treated as a corrupted file and not saved. Is that technically plausible?
I congratulate you on your effort.
Hi Chris,
the camera has no geotagging, therefore it is not able to adapt to a change of time zone. If geotagging would be available in the camera, we would know where the night pictures were taken (from the entries in EXIF data)
The camera has no gps. So this can’t happen.
Great analysis of the photos. A lot is made about photo 509, and it may be something of great significance, but equally it may be something of almost 0 importance. The thing I have never heard anyone suggest is that one of the girls could’ve took a personal picture of the other girl. People fool around a lot with cameras and you could easily imagine one of them taking a personal picture and the other girl saying “delete that delete that now“ the kind of joke that many people do, particularly those who are used to taking hundreds and hundreds of photos as the girls did. Some discussion has been made about the sequence requiring 4 buttons to delete the picture. I remember when I bought my first digital camera and I had to learn how to do this it was no big deal and I’m a point-and-shoot kind of person. Therefore for me this doesn’t seem like it would be any difficulty and I also left the date and time as original for quite awhile lik Liz and kris. If it’s anything like my old Panasonic the menu guides you through.if the Canon has the same facility it would be child’s play.
A guy did an analysis on the light of the photos at the top of the mirador. They were ok.. The phone records seem to tie in. For the record I’m almost certain that they got to the stream at the dates and rough time stated and that something happened shortly after, some kind of accident or incident. After that I have my own thoughts. Well an extremely interesting thing to know would be the area that the Sinapoc helicopter flew over Think about that……
That’s exactly what I was thinking. Everybody needs to pee sometimes for example. Between good friends there is a good chance that one takes a photo of the other while at it. Just as a joke. And of course it is deleted shortly after.
But for the hard deletion it would have to be via a computer, not the camera’s operating system, right?
The only reason that no trace of 509 is found is that the investigators messed up by
Manipulating the SD card content
They also could be responsible by accidentally deleting 509. But as we have seen by this article the files were “without a gap” – this would not be the case if someone just deleted 509 from the card as there would be a “gap” and data remnants .
Since there is no “gap” between 508 and 510 this indicates that the SD card isn’t the original – by that I mean the content not the physical card.
The fact that there are remnants of smaller files, aka thumbnails, is proof that the SD card was connected to a computer – cameras make no thumbnails.
This leaves 2 scenarios :
1 – A Programm to organize photos was used which created the thumbnails, and then the images were copied to the PC and removed from the SD card – some programs do that, but most just copy and leave the data on the card
2 – instead of copying the images someone made a “cut and paste” operation
After realizing that the SD card was empty at some point the content was copied back to the card – hence there is no gap and no data left from 509 since everything was nicely sequential written.
(this includes the thumbnails – it would be interesting to know if the thumbnails were in between the images or at the end)
What they should have done, and what is common procedure :
Make a 1 to 1 copy on block level, so a 100% clone from the original without touching and looking at the images.
Once you have the clone you can do whatever you like with it and leave the ordinal card untouched
A criminal can by utmost certainty be excluded with what we know now.
Anyone who would just want to delete that file would use a data eraser tool and we would see that.
Argumenting that a criminal did the copy operation to cover its tracks is ridiculous as it would need a really decent amount of knowledge on file system operation which just a fraction of ppl know, especially back then in boquete
For some reason this case came into my mind the other day. It’s amazing to see the work you are doing on it.
The photo of one of the girls in a weird pose bending always troubled me. What was she doing? Is it a cave? I wondered if she was beconing her friend to go with her instead of having a hand blocking the light. Also she looks like she is bending under to go in.
Has this place ever been found? Could it be she followed someone in who has told her there was something cool on the other side.
https://www.reddit.com/r/KremersFroon/comments/n8vfwr/does_anyone_know_if_the_area_in_this_picture_was/
the place is known
Hi Andrew,
this picture has been discussed about a lot in internet. People named it mysterious, frightening and whatever…
Kris is a funny girl and liked to goof around, make grimaces. You can find several pictures, not only taken in Panama, that show her making grimaces.
In the picture you see her tongue. Maybe she was inspired by the cave-like background…
She’s making some sort of hand salute to the photographer. Her right hand is very clearly visible up near the side of her head. Most likely the photographer (Lisanne) is asking her to slow down and not keep on going so fast and she’s turning back and giving a sort of joking “Yes, ma’am!” kind of response.