Kris Kremers and Lisanne Froon were two Dutch women that disappeared in Panama on April 1st, 2014. Three months after they disappeared, their backpack was found on the bank of the Serpent River, 14 Kilometers north of where they were last known to be hiking. Inside of their backpack was numerous items, including the Canon Powershot camera they had taken with them on their hike. The camera was still working.

Investigators found numerous photos on the camera’s SD card – photos that were taken by Kris and Lisanne. However, one photo had been permanently deleted from the camera. Photo #509 was nowhere to be found. This single photo is the subject of much debate and might contain the answer to exactly what happened to Kris Kremers and Lisanne Froon.

Matt is an expert on this case. He purchased the exact same camera model that Kris and Lisanne used on their trip. To date, Matt has tested the camera more thoroughly than anyone, including Dutch and Panamanian investigators. He previously used the camera to replicate similar night-photo conditions (Matt’s other article).

Matt wrote the following technical analysis in order to demonstrate the operations and functionality of the Canon Powershot SX270 HS and the SanDisk SD card that contained the photos.

Missing Photo #509 Analysis

This article discusses the missing photo 509.  In this analysis, the words “photo” and “image” are used interchangeably. There are 133 photos available that were taken on and after 01 April 2014.  Photos 476 to 508 are 33 images that were taken on 01 April. Photos 510 to 609 are 100 images were taken on 8 April 2014.  

The following information is known about the missing photo 509:

  • It was taken after Image 508, which puts the earliest time it could have been taken at 01 April 2014, 13:54:59
  • It was taken before Image 510, which puts the latest time it could have been taken before 08 April 2014, 1:29:32

Image 509 must have been taken between 01 April 2014, 13:54:59 and 08 April 2014, 1:29:32. 

This large timespan that the photo could have been taken leaves a sizable gap of unknown information. Therefore, it’s helpful to try to narrow the potential timespan of when photo #509 could have been taken.

If we look at the pattern of how all photos were taken (see: New Case Data: Timestamps Of Missing Daytime Photos), it becomes obvious that the photos were all taken in groups of at least 2 photos.  If photo #509 was taken as part of the normal pattern of other photos on 01 April 2014, we can determine that it would be likely that photo #509 was taken as part of the group, with 507 and 508, and it would be the third image in this group. Furthermore, it would likely have been taken with a similar time apart as 507 and 508 which would put the timing at approximately 13:55. 

The next significant event is the emergency calls at 16:39 on 01 April 2014.  It is not likely that people take images in distress situations for reasons other than documenting that distressing situation and if that was done those images would more likely have been taken with the cell phone that was already in their hands rather than taking the camera from the backpack and using it.  Therefore, it is likely that 509 was not taken on 01 April 2014 after 16:39.  

There remains the possibility that photo #509 was taken between 02 – 07 April.  However, it is unlikely that the camera was used to take a photo while the cell phones were used during the days until 06 April.  If there was a desire to take pictures it could have been done with the cell phones that were already powered on and available.  It is also more likely that several pictures would have been taken if there was a need to document anything with the camera.  

The next possible time 509 could have been taken is on 08 April when the camera was used to take images 510-601.  Image 509 would have had to be taken and deleted before image 510 was taken, which is extremely unlikely that images were deleted in a stressful situation at night.  

It is not possible to say when image 509 could have been taken but it could be more likely that it was taken on 01 April between 13:55 and 16:39, closer to 13:55. 

Image Numbering

All 133 images are sequentially numbered, just like the Canon SX270 HS digital camera would do.  Out of the sequence of images there is no image 509.  It was not available to the forensic analyst who examined the SD card of the camera.  Looking at the SD card on a Windows computer would look as shown in Picture1 below:

Picture 1 (above): Simulated sequence of images.  Note that those are not the real images nor times and it serves only to visualize the file names.

Note that the camera has 2 methods of numbering images.  “Auto Reset” and “Continuous”.  The differences relevant to this situation is that “Auto Reset” will give the next image a number sequential to the last image taken, regardless if the number was already used before.  If Image 509 was deleted before 510 was taken, the camera would use image number 509 again.  

“Continuous” will only use one image number once and if an image was deleted, it will give the next image a new number.  If 509 was deleted, the next image would be 510.  

I analyzed EXIF data from the Canon SX270 HS and unfortunately the image numbering method is not saved in the EXIF information.  The default setting is “Continuous” and it was used for all tests performed in this article.  All testing for this article was done with Firmware 1.02 (the firmware that was installed on Lisanne’s camera). 

Possible Reasons For Image 509 Missing

There are two reasons why Image 509 could be missing:

  1. It never existed.

This would be the case if it was not recorded due a camera malfunction, or the camera skipped the number.  This however is not very plausible because the likelihood for a computer to miscount or miss numbers is minute.  This likelihood increases somewhat at number “difficult” for computers and those are binary numbers, that exceed either one or more bytes such as 256 and 65536.  If a counter only uses one Byte to count, it can only hold 256 values and for the next value would likely “roll” over to 0 or 1.  Tests have shown that this is not the case for the Canon SX270 HS but it starts over at Image_0001 after having reached Image_9999.  It does not overwrite images but stores them in a new folder.  No issues with number roll over occur with the Canon SX270 HS.

To determine if the Canon SX270 HS skips image numbers, an experiment was conducted where 522 images were taken on a Sandisk standard speed memory card with camera default settings and as fast as the camera can take the images to challenge it the most into missing images.  No flash was used for this trial.  Taking the images took 15 min and on average it took 1.7s to take each image. No image number was missed by the camera.  

In order to challenge the camera more, a faster SD card (Sandisk Extreme, 90MB/s write speed) was used and 503 images were taken with settings that would result in the smallest possible image size (50-84 kB) so that they would be written as quickly as possible to “trip up” the camera. 

Taking those 503 images took 12 min and on average 1.4s for each image.  Another test with the fast SD card and default settings was done and another 504 images were taken, which took 10 min and on average 1.2s.  The differences in duration for each image are caused by external factors, like focusing and other camera functions, rather than by SD card write speed. In all cases, no image number was skipped. 

A total of 1529 images were taken under conditions that would challenge the camera the most to skip an image number, but not a single image number was skipped. 

Another test was then conducted where the camera was set to burst mode in manual mode and another 13384 images were taken until the battery ran out.  In this configuration the camera took 0.3s per image and it did not skip any image number.  

This establishes that the likelihood for the camera to skip images could occur at most every 1 in 1530 images or 0.07% if images are taken as fast as possible under reasonable realistic conditions.  

If Lisanne’s camera skipped image 509, that would be a likelihood of 1 in 509 or 0.2%.  If this was inherent to this Camera model, 3 images should have been skipped in the series of 1529 but instead none skipped.

If we add the images taken in burst mode, then the likelihood for the camera to skip images could occur at most every 1 in 14914 images or 0.007% and 30 skipped image numbers should have been observed in this trial.  

It can be concluded that the likelihood for the camera to skip images numbers is extremely low with less than 1 in 14914 or 0.007% and was not observed in the experiment. 

2. It was deleted.  

The only other reason why the image does not exist is for it having been deleted.  For this there are two possibilities.

  1. It was deleted by Lisanne
  2. It was deleted by someone else

Before exploring this question further, it should first be examined what was found on the memory card when examined by Dutch forensics:

  • 470 images, 133 of which taken on or after 1 April 2014
  • 7 videos, none of which taken on or after 1 April 2014

With image recovery software 64 images and 4 videos that were deleted and partially overwritten were found.  No trace of image 509 was found or recovered, but 40 JPG images could be recovered. 

All recovered images were thumbnails and other formats of images “IMG_0476.JPG” through “IMG_0609.JPG”.  Forensics commented that those thumbnails were likely created by the camera to preview images when they are replayed in the camera.  However, this is not correct as the camera does not create or store thumbnails and the review images are created from small versions of the image that are embedded in the EXIF information, which can be seen in Picture 2 below.  

Picture 2 (above): Preview image and Thumbnail contained in EXIF data. Note: The image is an example only.

Another noteworthy observation are the image names of images 505, 506 and 507, which do not have the expected image name of “IMG_0xxx.JPG” but contain an appended string “~RF1xxxxx.TMP”, e.g. “IMG_0505.JPG~RF17df08.TMP”.  The comment in the forensics report is, that this is the version before rotation of the image.  All three images are taken in portrait orientation and it is likely that they were rotated with image editing software and then saved.  I do not know which software would do this and change the file name like that but I suspect it was Apple software.  It should be noted that those file names appeared first in Panama but it is unknown when and by who they were created.  

It is apparent that someone reviewed and edited those images on a computer. At a minimum those edits consisted of rotating images and deleting thumbnails that were most likely auto generated by the image viewer used.  Unfortunately it was not determined when the edits and deletions were made and if it was done before or after the camera was given to the police.  

With the very limited information in the forensics report it is not possible to determine when all those changes were made.  For this access to the disk image of the SD card would be required. 

Picture 3 (above): excerpt from the Forensic Report, showing image 509 missing.

Forensics also reviewed the sectors on the SD card (on an image of the SD cars) to locate image 509.  Picture 4 shows what was found.  

Picture 4 (above): Sectors on the original SD card as found by forensics.  Comment by forensics. 

To demonstrate better what those numbers mean, lets dive a little deeper into how SDs function.

Kris Kremers Lisanne Froon Camera SD Card

Picture 5 (above): Generic Image of a Sandisk 16 GB memory card (left) and its internal flash memory chip (right).  Note: This is not the real memory card. 

An SD card contains a flash memory chip as seen in Picture 5 and a controller chip.  The flash memory chip has storage bits that are logically assigned to sectors by the operating system.  Each of those sectors holds 512 bytes.  An image that has a size of 1 Megabyte or 1,048,576 bytes would occupy 2048 of the 512 byte sectors.  The operating system (on an empty SD card) will write the data into 512 consecutive sectors.  So this image would occupy sectors 1 to 2048.  The next 1 Megabyte image would then be written into sectors 2049 to 4097.  Every further image would be written into the next free sector so that all images are stored sequentially in the order they were taken.  

The following graphic shows a simplified visualization of a memory card that only contains sectors 1 to 400 for easier visualization.  

Picture 6 (above):  Simplified visualization of the sectors on a SD card.  

If images are written into this simplified SD card, it would look as follows. 

Kris Kremers Lisanne Froon Photo Sequence

Picture 7 (above):  Simplified visualization of the sectors on a SD card with images written on it.  

There are 16 files written into this SD card.  Each color represents a different file with the color not having any other meaning as making it easier to tell the files apart.  

The first file (green) or image 1 occupies sectors 1-6.  The second file written to this SD card would be Image 2 and the OS would have placed it sequentially into sectors 7-10.  This image is a little smaller and therefore only occupies 4 sectors, while image 1 is larger and occupies 6 sectors.  Larger images simply occupy more sequential sectors.  

Rather than visualizing the sectors of the SD card as a square, it can also be visualized as a long chain, which is in a way easier.  Picture 8 below shows the same files occupying the same sectors as in Picture 7 above.  Image 1 still occupies sectors 1-6 and Image 2 occupies 7 – 10 , etc. 

In Picture 8 we see 7 images up until sector 29, where I have made a cut to fit the image into the page.

Picture 8 (above):  Simplified visualization of the sectors on a SD card as a long chain with images written on it.  

This method of visualizing sectors sequentially will be used from here on.  

If we delete image 2 (we remember it occupied sectors 7 – 10), then there will be an empty space, where image 2 used to be.  The other images will not move and Image 1 still occupies sectors 1-6 and image 3 occupies sectors 11-15.  The operating system of the camera will eventually fill the gap with other data or other images but it will not move already used sectors to fill the gap.  Note that Windows would do this on a hard drive, which is known as defragmentation, but the Camera does not do this on the SD card.  

Lets visualize the images and sectors that were found on the original SD card. Note that for simplicity sector numbers are started at 1 and each image occupies 10 sectors:

There is no gap or empty sectors between any image.  

To determine how this arrangement of images can be achieved, a series of tests was conducted, and the results analyzed.  If a simulated test results in the same arrangement of images and sectors, it can be a possible true event and otherwise it can be discarded as a true event.

A Canon SX270 HS with Firmware 1.02 was used.  This is the same firmware as Lisanne had on her Canon SX270 HS, which is known by EXIF data published by Juan (link to Juan’s website).  All camera settings were set to default and the file numbering method was left at default (“Continuous”).  

After images were taken, the SD card was opened with a Windows 10 PC and the sectors on the SD card examined with WinHex/X-Ways Forensics 20.1. 

Below is an example of the data given by WinHex on a test run where Image IMG_0009.JPG was deleted.  Note that deleting an image on a FAT32 SD card will not actually delete the image itself, but it will only delete the directory entry to the file.  The file is still on the SD card and is recognized automatically by WinHex and displayed as “?MG_0009.JPG”.  This image could easily be recovered since it is still on the SD card, which is what image recovery software does.  It looks for such image remains and restores an entry for the directory so that it is shown by the operating system.  This however is irrelevant for this experiment and is only mentioned since WinHex shows this deleted image instead of a simple gap (Picture 9).  

Picture 9 (above):  Example of sectors and files as given by WinHex. This is not the real SD card.  

WinHex also displays the first sector that is used by the file.  Unfortunately, it does not display the last sector but for sequentially written files the last sector can be determined by the first sector and the file size.  For example IMG_0001.JPG has a file size of 7.1 MB.  The FAT32 formatted SD card holds 512 Byte per Sector, so the 7.1MB image file will occupy 7.1MB / 512Byte or 14,541 sectors.  IMG_0001.JPG starts at sector 8384 and will end after 14541 sectors on sector 22925.  The next image would then start at sector 22926.  In the example above this is not the case as IMG_0002.JPG starts in sector 23040.  The difference comes from the fact that the image size shown by WinHex is the net image size, while the image actually occupies a little more space on the disc as not just image information but also other meta data from the Operating System is stored.  

In order to determine the size, the image occupies on disk, one can view this information in the file properties in Windows.  Picture 10 below shows the difference between image size and file size for a random image.  

Picture 10 (above):  Windows file properties.  

For simplicity and since the difference is very small, I used the net image size and not the image size on disk in order to look for gaps between images.  If there is an actual gap from a missing image it is in the range of thousands of sectors while the small error from using image size vs size on disk accounts to only a few sectors difference and allows to collect valid results with this simpler method.  

Camera Functionality Tests

I conducted eleven tests to see how the camera operates in terms of number photos.

The following summarizes tests that I conducted and their results in regard to gaps between image numbers.  All test results are simplified to sector numbers starting at 1, one image taking up 10 sectors and image numbers changed to the real images.  This does not change any results and is only done to simplify the results and their visualization.  


Test 1: 
  • Take six (6) images:  504, 505, 506, 507, 508, 509
  • Delete the last image (509) in Camera
  • Take two (2) images: 510, 511

Test 1 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO image 509
  • There is NO gap between images 508 and 510


Test 2: 
  • Take six (8) images:  504, 505, 506, 507, 508, 509, 510, 511
  • Delete image (509) in Camera

Test 2 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO image 509
  • There IS a gap between images 508 and 510


Test 3: 
  • Take six (8) images:  504, 505, 506, 507, 508, 509, 510, 511
  • Delete image (509) with a Windows 10 PC

Test 3 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO image 509
  • There IS a gap between images 508 and 510


Test 4: 
  • Take seven (7) images:  507, 508, 509, 510, 511, 512, 513
  • Delete image (509) in Camera 
  • Copy all images onto a Windows 10 PC
  • Delete all images from their folder on the SD card with a Windows 10 PC
  • Copy all images back into their folder on the SD card with a Windows 10 PC

Test 4 Result:

  • On the SD card are images 507, 508, 510, 511, 512, 513
  • There ARE random gaps between random images


Test 5: 
  • Take six (8) images:  504, 505, 506, 507, 508, 509, 510, 511
  • Delete image (509) with a Computer
  • Copy the main image folder “DCIM” with all image sub folders onto a Windows 10 PC
  • Delete main image folder “DCIM” on the SD card with a Windows 10 PC
  • Copy the main image folder “DCIM” with all image sub folders from the Windows 10 PC back onto the SD card

Test 5 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO image 509
  • There is NO gap between images 508 and 510


Test 6: 
  • Take six (6) images:  504, 505, 506, 507, 508, 509, 510, 511
  • Delete image (509) with a Computer
  • Copy the main image folder “DCIM” with all image sub folders onto a Windows 10 PC
  • Format the SD card with a Windows 10 PC
  • Copy the main image folder “DCIM” with all image sub folders from the Windows 10 PC back onto the SD card

Test 6 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO image 509
  • There is NO gap between images 508 and 510


Test 7: 
  • Take four (4) images: 505, 506, 507, 508
  • Take one (1) video: MVI 509
  • Right away take four (4) images: 510, 511, 512, 513

Test 7 Result:

  • On the SD card are images 505, 506, 507, 508, 510, 511, 512. 513
  • There is NO image 509
  • There IS video 509
  • There are NO gaps between images or videos
  • The video 509 is not stored in the sequence it was taken

The video was most likely not written right away as the camera does some processing to it and if images are taken before the camera is finished with the video, it is saved at that time and not necessarily in order.  


Test 8: 
  • Take four (4) images: 505, 506, 507, 508
  • Take one (1) video: MVI 509
  • Wait then take three (3) images: 510, 511, 512

Test 8 Result:

  • On the SD card are images 505, 506, 507, 508, 510, 511, 512. 513
  • There is NO image 509
  • There IS video 509
  • There are NO gaps between images or videos
  • The video 509 is not stored in the same place, image 509 would be stored.  


Test 9: 
  • Take four (4) images: 505, 506, 507, 508
  • Take one (1) video: MVI 509
  • Turn Camera OFF and ON
  • Take three (3) images: 510, 511, 512

Test 9 Result:

  • On the SD card are images 505, 506, 507, 508, 510, 511, 512. 513
  • There is NO image 509
  • There IS video 509
  • There are NO gaps between images or videos
  • The video 509 is stored in sequence and in the same place, image 509 would be stored.  


Test 10: 
  • Take eight (8) images:  504, 505, 506, 507, 508, 509, 510, 511
  • Secure Erase image (509) with a Windows 10 PC and Eraser 6

Test 10 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO image 509
  • There IS a gap between images 508 and 510

Secure erase does not simply delete the directory entry like the Windows 10 file delete does, but it overwrites the actual image file with random data.  This makes the image unrecoverable but does look very differently on a sector basis when compared to a file deleted with Windows 10. 


Test 11: 
  • Take six (6) images:  504, 505, 506, 507, 508
  • Take video 509
  • Turn Camera off / wait until buffering is complete 
  • Take two (2) images: 510, 511
  • Delete video 509 in camera or with Windows PC

Test 11 Result:

  • On the SD card are images 504, 505, 506, 507, 508, 510, 511
  • There is NO video 509
  • There IS a gap between images 508 and 510


General observations:
  • Rotating an image on the SD card with a computer will not move it out of its location since only an EXIF flag is changed and not the image rewritten.  Note that some old software may still rewrite the image.  
  • Using Auto Reset file numbering does not change anything in principle as of how the images are stored on the SD card.  It would only change the way the files are numbered.  If Auto Rest was used, then there would be no missing image name 509 if the image was deleted before image 510 was taken.
  • There is no principal difference if 509 was an image or a video.  For that reason it will only be discussed as if it was an image
Test Summary

Out of all test runs there were three (3) that matched the configuration that was found on the original SD card: Test 1, Test 5 and Test 6.  All other tests resulted in different configurations., See Picture 11.   

Test 1 consisted of deleting Image 509 in camera BEFORE image 510 was taken. 

Test 5 consisted of copying the image folder DCIM on a computer, deleting the image folder DCIM with a computer, deleting image 509 and copying folder DCIM without image 509 back onto the SD card

Test 6 consisted of copying the image folder DCIM on a computer, formatting the SD card, deleting image 509 and copying folder DCIM without image 509 back onto the SD card

Kris Kremers Lisanne Froon Test Camera Photo 509 Chart

Picture 11 (above):  Summary of test to evaluate how images appear on disk.  

Note that the possibility that 509 was a video does not change anything in principle and therefore only the possibility that it was an image will be further discussed.  

Since Test 5 and Test 6 are essentially the same and require a computer the copy and delete images they can be pursued as one option, which leaves us with essentially those two possible events:

  1. Lisanne took image 509 and deleted it before taking image 510
  2. A 3rd Party deleted image 509 with a computer

It would likely be possible to determine which event took place by examining the SD card or the SD card image that the forensics had available.  Unfortunately, the forensics report does not go into more detail as is shown in this article and therefore Event 1 or Event 2 cannot be distinguished based on evidence.  

The only remaining option is to estimate the likelihood with which those events could have taken place and select the more likely one as the true event.  

Event 1: Lisanne deleted image 509

Possible reasons for deleting the image are:

  1. Accidental deletion
  2. Intentional deletion by Lisanne

Let’s discuss these possibilities:

1. Accidental Deletion

Assuming the camera is turned on, a total of 4 small buttons have to be pressed in the correct order to delete an image, this includes one button press to acknowledge a prompt.  If the camera is turned off stored away, it would also have to be turned on first, requiring 5 buttons to be pressed in the correct order.  

To do this inadvertently while operating the camera is nearly impossible.  It is also possible that the camera is put away while turned on and before the camera shuts off by itself, buttons are randomly pressed by movement.  It is not very likely to put the camera away while turned on, but maybe possible in a stress situation.  However then buttons still must be activated in the right order.  The camera was likely designed to prevent exactly those things from happening and it is essentially impossible to happen. 

2. Intentional Deletion by Lisanne

Image 509 would have had to be deleted by Lisanne before 510 was taken, which is possible, but the question is how likely it is.  Of all the images that should have been deleted is image 495, which is a not published Mirador selfie in which Kris has her eyes closed.  They spent a minimum of 15 min on the mirador which allowed for enough time to review images and deleted bad ones but this was not done, which suggests that Lisanne was not concerned about reviewing and deleting images that day.  As the day went on, fatigue and stress would have increased which will make it much less likely that thought was spent on reviewing and deleting images.

The likelihood of Lisanne having taken, reviewed and deleted image 509 is probably less than 50%.  It a possibility that images were deleted to make space on the SD card for more images.  However if it is considered that 508 images were taken at the time and the 16 GB Sd card can hold upwards of 7000 images at highest resolution, this becomes unlikely.  

Event 2: A 3rd Party deleted image 509 with a computer

  1. Accidental Deletion by a 3rd Party
  2. Intentional Deletion by a 3rd Party

Let’s discuss these possibilities:

  1. Accidental Deletion by a 3rd Party

It is known that there was access to the SD card that was done in a careless way, such as:

  • Software was used on the SD card that created thumbnail images
  • Thumbnail images were deleted from the memory card
  • Images were rotated and saved back onto the memory card

This is an incredible amount of manipulation on the SD card that destroyed evidence.  Whoever performed those manipulations on the SD card was extremely careless and it is not impossible that when the thumbnail images were deleted, also inadvertently image 509 was deleted.  However, simply deleting image 509 was not done and the person doing it would also have to copy the entire image folder to a computer, accidentally deleted image 509, and then moved the folder back to the SD card.  It seems unlikely that a person who carelessly works on the SD card would have gone through the trouble of also copying the images to a computer and then back onto the memory card.  This sequence of events is somewhat unlikely.  

The unknown person could have been anybody involved in finding the backpack and camera or it could have been anybody withing the police forces who had access to the SD card.  

An inadvertent deletion would look like what was done in Test 2, where a gap was left:

As compared to what was found on the SD card:

It is also possible that several events occurred.  If image 509 was inadvertently deleted and subsequently by someone else for any reason the images were taken off the SD card and copied back on, it would have removed the gap that can be seen in Test 2, and the sectors on the SD card would be arranged as they were found.   

With access to the original SD card or the disk image taken from the SD card, it would likely be possible to reach further conclusion if those events could have happened or not.  

2. Intentional deletion by a 3rd Party

It is possible that a 3rd Party intentionally deleted image 509.  The question would be for a motive.  What would motivate someone to delete an image and intentionally or unintentionally do it in a way that the image can not be recovered?  

The answer can only be that there was something in image 509 that was not desirable for the others or the police to see.  The only thing that this could be would be an indication of a suspect or a crime.  It is possible that image 509 showed a person who is not involved in any wrong doing, however just by being in this image this person would be exposed to police scrutiny and they would have to undergo questioning and they may even be accused of criminal wrong doing by the public, as has happened with other local people.  If anybody might have been shown in this image, they would have found themselves in constant questioning.  First by police and then by the general public and news media.  

Therefore, someone may have decided to simply delete this image and end any speculation about a possible person shown in the image.  

The person deleting the image would have had to employ the methods described in Test 5 or 6.  This could have been intentionally if the person possessed the knowledge how to ensure the image can not be recovered or unintentionally.  The majority of people are probably not aware that deleting an image does not actually fully delete it to the point where it can not be recovered and they may not have the knowledge of how to permanently delete the image.  Therefore it could only have been a lucky and unknowledge person or a knowledgeable person.  

It is furthermore possible that image 509 showed something that would reveal something highly undesirable or incriminating about the disappearance or a person that was shown committing an illegal act.  Someone could have just decided to simply delete image 509 by employing the methods described in Test 5 or 6 to avoid any suspicion against themselves or others.

It is difficult to assign a probability to this, however it is probably more likely than Lisanne having deleted the image.  However it is not easily possible to assign a probability to this and it is left to the reader to form an opinion.  

Conclusion Of Image #509 Analysis

The following are possibilities for why image 509 does not exist:

  1. Camera malfunction.  The likelihood for this to have occurred is 0.007%
  2. Inadvertently deleted by Lisanne.  This is nearly impossible.
  3. Intentionally deleted by Lisanne.  This is probably less likely to happen than it was to happen.
  4. Intentionally deleted by a 3rd Party.  It is not easily possible to assign a probability to this.  
  5. Unintentionally deleted by a 3rd Party.  It is not easily possible to assign a probability to this, although it is a possibility.  

At this point it must be left to the reader to decide which possibility they accept as most likely. 

Further research could be done if the disk image of the SD card was available.  Until then it is only possible to rule out certain events from possibly having happened and confirming other events.  Another problematic fact is that if any 3rd Party involvement in the disappearance of image 509 is accepted, it would also allow for the possibility that there were images or videos after image 609 that were also lost.  

Final Comments

I’d like to thank Matt, as always, for his excellent research and contribution to this disappearance case. His diligent commitment to finding answers and moving this case forward is tremendously valuable. We all want more answers and offer our respects to these two girls and their families.

To reach Matt directly, please feel free to send an email to: researchtt2@gmail.com

For all of our articles related to the disappearance case, please visit the Case Articles page.

Thank you to all our supporters and readers!

Resources

Canon User Manual Library – The Canon Powershot SX270 HS is not found.

Wikipedia – Canon PowerShot S Series

Official Camera User Guide – Canon 2013. Local copy that was found online.

Please note: Our team is committed to accuracy of information and respecting the privacy of those involved with this disappearance case. If you have any supplementary information regarding the case, or if you were involved in this case and feel that the information available in this article impacts your privacy, please contact our team.