This is the translation of the expert computer witness Martin Bajjada. It is as true to the court-recorded transcript as possible. His expert witness confirms that there was no evidence to connect Joseph Ellul-Grech to this crime. It also confirms that the magistrate and the prosecution neglected to conduct a proper and impartial investigation. The evidence always proved that there were a number of people involved. It was also evident that the defendant did not have the financial and printing resources needed to commit this crime. However, the prosecution and the court chose to overlook this.
Magistrates Court
Magistrate Dr. N. Cuschieri LL.D.
Today 2nd December 1999
Police Inspector Raymond Cremona
Vs
Joseph Ellul Grech
Martin Bajjada, son of late Albert. Born in Valletta and resides at Qormi.
In Maltese and under oath in the presence of the defendant.
On instructions given to me by the duty Magistrate on the 16th November 1999, (the day after Ellul-Grech was arrested) I was appointed as forensic computer expert. I followed the instructions given to me and I am presenting this report that is being marked by the court as docMB. During this appointment I examined a computer, floppy diskettes and tapes. I was to establish if the computer was used to produce two documents that are attached and marked as docJEG01 and JEG02 and to also see if the floppy diskettes, compact diskettes and tapes had a copy of these documents.
I confirm under oath that I performed my duty in a faithful manner and to the best of my ability.
On the 16th November 1999 at about 7.00pm I went to the Economic Crime Unit where inspector Cremona gave me more information about what had happened that day. On that same day I went to Inspector Cremona’s office where in the presence of PC689 and PC_____. I made a list of the items seized by them. I took these and the computer. One CD not all of them diskettes and tapes. I took one CD only because this was the only one that could be written on, the others were original and impossible to write on. Between the 17th November and the end of November I conducted all the possible forensic examinations on these which between them they had a capacity of 6.8 gigabytes with no less than 265 files. I conducted several forensic examinations on these files, on the free space on the hard drive and floppies and I also checked if there were any deleted files. A forensic search on all the media for a number of stages of doc JEG01 and JEG02, these are exhibited with my reactions. From these documents I conducted different stages and searched for these in the computer and all the media. The Computer system was created between 10th and 11th October of this year, on this system there are only two applications installed that are Windows 2000 excluding the operating system and Sage for Windows. The Windows 2000 is an incomplete system.
The conclusions are that from the forensics that took place on the computer hard drive, the floppy disks, the compact disks and tapes nothing was found with reference to doc JEG01 and doc JEG02, also that the hardware and software have the capacity to produce or modify the attached documents JEG01 and JEG02, However no evidence was found that this computer was used for this purpose because at its present state this computer is not configured for this purpose. Meaning it could have been used before October but from October onwards it wasn’t. The computer is not new and is made of many parts. For some reason there was an installation that took place between the 9th and 10th November. From 9th to 10th November nothing has taken place, before it could have.
Magistrates Court
Magistrate Dr. N. Cuschieri LL.D.
Today 2nd December 1999
Police Inspector Raymond Cremona
Vs
Joseph Ellul Grech
Martin Bajjada, son of late Albert. Born in Valletta and resides at Qormi.
In Maltese and under oath in the presence of the defendant.
On instructions given to me by the duty Magistrate on the 16th November 1999, (the day after Ellul-Grech was arrested) I was appointed as forensic computer expert. I followed the instructions given to me and I am presenting this report that is being marked by the court as docMB. During this appointment I examined a computer, floppy diskettes and tapes. I was to establish if the computer was used to produce two documents that are attached and marked as docJEG01 and JEG02 and to also see if the floppy diskettes, compact diskettes and tapes had a copy of these documents.
I confirm under oath that I performed my duty in a faithful manner and to the best of my ability.
On the 16th November 1999 at about 7.00pm I went to the Economic Crime Unit where inspector Cremona gave me more information about what had happened that day. On that same day I went to Inspector Cremona’s office where in the presence of PC689 and PC_____. I made a list of the items seized by them. I took these and the computer. One CD not all of them diskettes and tapes. I took one CD only because this was the only one that could be written on, the others were original and impossible to write on. Between the 17th November and the end of November I conducted all the possible forensic examinations on these which between them they had a capacity of 6.8 gigabytes with no less than 265 files. I conducted several forensic examinations on these files, on the free space on the hard drive and floppies and I also checked if there were any deleted files. A forensic search on all the media for a number of stages of doc JEG01 and JEG02, these are exhibited with my reactions. From these documents I conducted different stages and searched for these in the computer and all the media. The Computer system was created between 10th and 11th October of this year, on this system there are only two applications installed that are Windows 2000 excluding the operating system and Sage for Windows. The Windows 2000 is an incomplete system.
The conclusions are that from the forensics that took place on the computer hard drive, the floppy disks, the compact disks and tapes nothing was found with reference to doc JEG01 and doc JEG02, also that the hardware and software have the capacity to produce or modify the attached documents JEG01 and JEG02, However no evidence was found that this computer was used for this purpose because at its present state this computer is not configured for this purpose. Meaning it could have been used before October but from October onwards it wasn’t. The computer is not new and is made of many parts. For some reason there was an installation that took place between the 9th and 10th November. From 9th to 10th November nothing has taken place, before it could have.
(Confirmation that there was no evidence that Ellul-Grech was involved in producing and sending these anonymous letters. Finding evidence on the computer was crucial. The public was still receiving the letters during the time he was in police custody. Thereafter he and his family were under police surveillance for a long period of time. Despite this the magistrate allowed the case to continue.)
Magistrate: Meaning that the hardware and the software had the potential to produce or modify these documents, is that right?
Magistrate: Meaning that the hardware and the software had the potential to produce or modify these documents, is that right?
M. Bajjada: Yes, when I examined it, I established that the system was put back in its place between the 9th and 10th October. From that day until November the computer was not in use. Anything previous to that cannot be determined because there are things missing.
(This is another confirmation that Ellul-Grech was not involved in this crime. In his first witness on 13th November 1999 in front of Magistrate Antonio Mizzi,John Dalli had already confirmed that the letters were being delivered by post prior to the 13th November. Therefore the team of people that produced these letters were at work when Ellul-Grech’s computer was not in use).
Prosecution: There was also a scanner?
M. Bajjada: Yes, but I did not take that because a scanner alone cannot do anything.
Prosecution: Did the computer look as if it had anything missing?
M. Bajjada: Yes, I opened the computer to check and see what it was made of.There are two empty bays. These empty bays does not seem to have had anything in them, a new computer is made of stainless steel and if any screws have been tightened one could tell.
Prosecution: There was also a scanner?
M. Bajjada: Yes, but I did not take that because a scanner alone cannot do anything.
Prosecution: Did the computer look as if it had anything missing?
M. Bajjada: Yes, I opened the computer to check and see what it was made of.There are two empty bays. These empty bays does not seem to have had anything in them, a new computer is made of stainless steel and if any screws have been tightened one could tell.
Prosecution: Could you analyse if the computer has been fixed or if it had a virus recently?
M. Bajjada: No. First of all I did not have the opportunity to speak to the defendant and ask him any questions in this regard, secondly my terms of reference were completely different. They were to establish a connection to these documents only. (Confirmation that there was no evidence to connect the defendant to the letters).
M. Bajjada: No. First of all I did not have the opportunity to speak to the defendant and ask him any questions in this regard, secondly my terms of reference were completely different. They were to establish a connection to these documents only. (Confirmation that there was no evidence to connect the defendant to the letters).
Cross-examination
Defence: Is there an alternative exercise that you could do in connection to this alleged virus?
M. Bajjada: No, as an expert I give an opinion on what the defendant said what may have and not have happened. If it was the hard drive I would be able to find the previous files forensically.
Defence: Did you find these previous files?
M. Bajjada: There isn’t any because the hard drive has been changed.
M. Bajjada: There isn’t any because the hard drive has been changed.
Defence: So it’s like a new computer?
M. Bajjada: Yes.
Defence: Meaning these things could happen?
M. Bajjada: Yes, they could. (In this case nothing happened, no evidence).
Defence: Did you find any accessories missing from the computer?
M. Bajjada: The accessories that are missing could have been in the two empty bays but it is difficult to say.
Defence: I would like you to look at doc Y and RC17. Is RC17 a scanned version of RC4?
M. Bajjada: As per interest I saw the documents. This is something that I cannot give an exact reply.What I can tell you as per personal interest. I was instructed to examine the positioning of the account numbers, the currency and date, this does not result that a typewriter was used.
Defence: Could they have been done with a computer scanner?
M. Bajjada: Possible but they are angled, it was not a typewriter.
Defence: If you took a photocopy with the defendant’s computer could doc RC17 be scanned and
obtain a result?
obtain a result?
M. Bajjada: You do not need to use his computer; we will get the same result because it is the
programme that is being used. To establish if it was a scanned image or not an original of the statement fromMidland Bank Trust Corporation is required, several different photocopiers will be needed to make copies because there is a reduction when a photocopy is made, a scanner does the same thing and it could be established if it is a photocopy or scanned image. This is a profound examination and it could be established for certain if one thing or the other was used. What I am saying is that with the facilities the defendant had he could have reproduced RC17 and RC4.
(The computer expert could not confirm which equipment was used to scan and print such a large volume (80, 000 A4 sheets) of copies. The police seized an Epson 1250 colour printer. This printer holds 50 sheets.For the defendant to print such a high volume alone would have taken weeks and a large amount of ink would have been needed. The police did not find any evidence at the defendant’s home to confirm that a large amount of printing had taken place. To produce such a large volume of photocopies a large photocopier or two would be needed. Ellul-Grech did not have such equipment. However, John Dalli, Joe Gaffarena and Joseph Mary Scicluna had access to such equipment. They also had the interest and all the resources needed. The police failed to obtain an original bank statement to make comparisons. John Dalli,by his own admission, must have had originals. Despite this the magistrate did not instruct the police to investigate further and find out which type of copier and printer were used).
Cross examination reserved.
This is the substance of the witness expert Martin Bajjada as dictated by him.
I declare that I transcribed faithfully, honestly and according to the transcript witness tape.
Ivan Ghio.
Transcriber
Transcriber
No comments:
Post a Comment