Desktop Computer
If the facts don't fit the theory, change the facts.
( Albert Einstein )
Was the desktop computer clock manipulated?
Mark and Christine Lundy operated a business called Marchris Enterprises from their home at 30 Karamea Crescent in Palmerston North. An office was set up in a bedroom in the house for this purpose.
They had two computers, a desktop computer and a laptop computer. The desktop computer was mainly used by Christine, who maintained the company accounts, used email and liked to play the occasional card games. The laptop was used mainly by Mark on his business trips to prepare quotes and update financial spreadsheets, but Christine also used it to do her brother's accounts. Both computers were in the office at the time of the murders.
The desktop computer was seized by the Police during the murder enquiry and the hard disk forensically copied then examined by the e-crime laboratory.
It was determined that the computer was last shut down at 10:52 pm on 29th August 2000. This was the time on the Windows 98 swap file and registry file. It was also determined that the clock was accurate by reconciling the time of computer modem calls to the Internet with Telecom call logs.
The Police theory for the murders was that Mark drove from Petone, arriving at his home around 7 pm on 29th August 2000, and adjusted the computer time to 10:52 then shut it down to make it appear that the computer was running until this time. It is alleged that he then murdered his wife and daughter and returned at high speed to his motel in Petone.
Police computer expert Maarten Kleintjes put forward methods by which the computer clock could be manipulated without leaving any evidence. He also testified that the registry backup files were out of sequence indicating "extensive manipulation" of the computer clock.
There was no evidence that the time on the computer clock had been changed, it was purely a theory to explain why the computer shutdown time was inconsistent with the alleged time of death. The last time the program was used for changing dates and times on the Lundy computer was several months previously, so the Police theory required Mark to have a copy of this program from another computer on a diskette.
The registry backup files are automatically updated the first time Windows 98 is started each day. Altering the time of day without changing the date does not affect the sequence of these files.
The defence provided several legitimate ways in which the Windows 98 registry backup files can get out of sequence, including the practice of holding back the date before closing accounting files at the end of a month, a flat clock battery, and the effects of virus activity. There was an active virus on the computer disk, which was apparently not detected by the Police laboratory.
The other assumption of the Police theory is that Mark had the necessary knowledge and skill to carry out the computer clock manipulation in such a way as to avoid detection, and this is strongly doubted by those that know him.