Reports/RMP/Flight Simulator Analysis/1 RMP Forensic Report/Document List

Jump to navigation Jump to search

Royal Malaysia Police Forensic Investigation of Captain Shah's Flight Simulator

Document List

Relevant information contained within the RMP Folders circulated on the Internet is in several separate documents which have been combined with other scanned pages to create larger files. Although appearing genuine, these are not Official documents released to the public with version control and provenance (a chain of custody and guarantee of authenticity). The separate documents are described below:-

  1. A Preliminary Examination Report [1] dated 19 MEI 2014 and written in Malay seems to be the first Report. This Investigation was conducted by the computer crime section of the Royal Malaysia Police forensic laboratory and the Report was signed by a single Investigation Officer. It documents the process of discovery of seven data points[2] from disk MK 25, including the two data points located in the southern Indian Ocean but does not include the actual coordinates. A diagram does, however, illustrate a possible relationship between the seven data points, using altitude, fuel levels and distance between each location. This report concluded (paraphrased) that the computer was used mainly for playing the Flight Simulator game; inspection of all the disks found that there was no unusual activity; and found no information to show any plan to [get rid of (or) terminate] MH370.

  2. A Preliminary Case Report [3] dated 19 May 2014 is written in English, apparently by staff of CyberSecurity Malaysia which had been asked to assist the PDRM in their investigation. An Appendix A is attached to the report - see below for details. This report is signed by two analysts, neither of whom wrote the Preliminary Examination Report.
    The Investigators assembled a flight simulator from purchased components, less sophisticated than Zaharie's, but sufficient to use the Flight simulator software and verify that the recovered data is from *.FLT files. An additional objective of their investigation was to analyze the seven (7) coordinates found in the MK25 exhibit. A The coordinate data is in a Table, with latitude, Longitude, Altitude, Pitch, Bank and Head (Heading).

  3. Appendix A   7 Extracted Coordinates From MK25 [4] is a poor quality scan of a data printout from the MK 25 System Volume Information file included with the Preliminary Case Report. The printout contains 30 pages of data (with no blank pages) so holds more information than Appendix M-1 (below). However, there are many lines of unreadable characters which may have been omitted from Appendix M-1 because they seem meaningless. The coordinates are the same; parameter values seem the same; but this Appendix contains some parameters and values which are not in Appendix M-1.

  4. Analysis on Simulator Data From Captain MH370 Pilot's House. [5] This is a 2-page document with a Table containing six[2] coordinates labelled Route A to Route F and data including Latitude, Longitide, Altitude, Speed (No Data) and Fuel. A diagram shows Point A to Point F plotted on Google Earth. It is stated (incorrectly) that:-
    This particular flight path was found in windows restore point file, deleted files and unallocated cluster files of hard disk labelled as MK22 and MK25[6]. Detailed extract of this flight path can be found in Appendix M-1.

  5. Appendix M-1 [7] contains the Recovered Simulation Data From Zaharie's Flight Simulator That was taken from his House in 27 pages of data printed from the recovered files. Each data point is labelled Route A, Route B etc to Route F: a total of six sets of data. Data for each 'Route' comprises parameters for the simulated aircraft including latitude, longitude, altitude, pitch, bank, heading, fuel levels and more - approximately 4 1/2 pages per 'Route'. Some pages are blank and some data sets are not complete.

  1. Source: MH370-RMP-Folder-1-Pilot
  2. 2.0 2.1 Although seven data points were initially identified, it seems that as the investigation progressed one was discarded. The ATSB report refers to six data points; the Annex 13 Team referred to the original seven data points. The discarded point was one of two data points at KLIA and therefore not significant.
  3. Source: MH370-RMP-Folder-1-Pilot
  4. Source: MH370-RMP-Folder-1-Pilot
  5. Source: MH370-RMP-Folder-4-SKMM-Analysis-Communications-and-Multi-Media
  6. According to other documents the only source of data was the Volume System Information file recovered from disk MK 25
  7. Source: MH370-RMP-Folder-Appendix Appendix M-1