Table of Contents

Significance of the Canon EOS 1OD Digital SLR Camera

Some have suggested that the following section about the Canon 10D camera and its photos is too technical and hard to understand, so I have added this introduction to try and make it clearer. Technically astute readers may want to skip ahead to the actual text.

The case against me hangs completely on the last photos I took of Marion on June 3, 2003. Like almost all digital cameras, the Canon 10D records a lot of information along with the image. Each time a photo is taken the camera records what ISO setting was used, what lens focal length was used, whether the in-camera flash fired or not, the image number, the camera serial number, the shutter speed, and many other pieces of information, including the date and time. All of this information becomes a part of the image file and remains with it unless intentionally stripped away. However, this information can be edited with a number of readily-available software applications. Many types of photo software, including the ubiquitous Photoshop, allow this information to be viewed. This additional information is known as metadata or EXIF (EXchangeable Information File) data.

The date and time information encoded into the EXIF data for a photo comes from the in-camera clock, and is only correct if that clock is correct. This clock is manually set by the user,· and must be reset for such things as daylight saving time or time zone changes.

The last photo now on the IBM Microdrive that I used to record my images that day has the correct date and shows a time of 6:56 pm. If the camera clock was set correctly, that means that the last photo was taken only about nine minutes before my call to 911 to report that Marion was passed out and I could not awaken her. But I know that this is impossible because I went out for some dinner after taking that photo, came back to the studio and puttered around for some time, and only then noticed that Marion was in trouble.

So, was the clock set correctly? I had not paid any attention to how the clock on the camera was set, and so far as I know it was still set the way it had been when it arrived for my testing from Canon. I knew when I took the photos with that camera, and was not even looking at the EXIF data.

Fortunately for me, the Canon 10D camera has a couple of qUirks that differ from other Canon cameras. One of these is that when it creates an image file, it does not write a time created to the EXIF data. It leaves that field blank, and puts the information instead into the time modified field. That quirk is not so important to this discussion. The other quirk is that the Canon 10D creates a text file called a catalog file (suffix .ctg) for each folder of images. Those catalog files are saved to a separate folder. Each catalog file has a creation date/time matching one of the images in the folder. Because of the unique way the Canon 100 camera accesses photos when viewed on the camera, the camera requires these catalog files to display the images in the proper order. The catalog files serve no purpose outside the camera, and many users may not even be aware that they exist. Detective Wilburn certainly did not know of them when asked about them at my trial.

If someone resets the in-camera clock and then views the images in the camera, the camera rewrites the catalog files to reflect creation date/time matching when the clock was reset. From this knowledge it was easy at my trial for Mr. Chuck Westfall from Canon to show that the clock on the 10D camera had been reset shortly after midnight, at a time when the camera had been in the possession of the Radford police for more than four hours. Once the clock had been reset and the images viewed, it was completely impossible to know how the clock had been set when the images were taken. Dr. Massello, the Medical Examiner, testified that without knowing the actual times when the photos were taken, the photos were "just pictures" and had no evidentiary value whatsoever.

By insisting that the times on the photos are accurate, the prosecutor is ignoring clear proof that someone reset the clock while the police had the camera, and that this makes it impossible to determine when the photos were actually taken. In the absence of evidence to the contrary, my testimony that the photos were taken about an hour earlier is supposed to be accepted by the court.

Additionally, the camera used by Detectives Wilburn and Trail, the official police forensic camera, had its internal clock set incorrectly. Photos taken after the police came to my studio in response to my 911 call at 7:05 pm show times starting shortly after 4:00 pm. All of their evidence photos have incorrect times, times about three hours off. The prosecution is trying to hold me to higher standards than the police department's official forensic photography. Digital clocks in equipment are often not set correctly. The EKG taken of Marion after she got to the hospital shows a time before 7:00 pm!

But all of this is really academic. since my photos from that day would be meaningless even if the times were right. See the section on Dr. Massello for details on why this is the case.

This camera was introduced in the spring of 2003. The camera I was using in April, May and June of that year was a very early production model of this camera on loan to me from Canon USA for evaluation.

The EOS 1OD can be set to record images in RAW format or in JPEG format. All of my personal shooting was done in JPEG format.

The camera can be set to record all images with sequential file numbers, or to reset itself back to the beginning each time the CompactFlash card is changed. The camera I used was set for continuous sequential numbering (the factory default setting).

When new, the camera begins with IMG_OOO1.jpg. As photos are taken, the camera creates folders and puts the image files in them. Folders are named CAN001, CAN002, etc., sequentially. The camera creates a new folder after IMG0100.jpg, starting the new folder at IMGO1O1.jpg. Each folder can have a maximum of 100 images. Folders have creation times matching one of the images inside.

While it is possible to delete images in the camera, as a personal policy I never do so, preferring to make any deletions after transferring all images to my computer.

At the end of a given shoot, the last folder will normally have fewer than 100 images. At the beginning of the next shoot, a folder will be created to finish off the 100 from the previous shoot.

Photos I took on June 3, 2003 were recorded onto an IBM Microdrive (1 GB capacity). There are now six folders on that Microdrive with 100 images each and a final folder with 16 images. The probability that I finished the previous day's shoot with the last folder holding exactly 100 images is vanishingly small. In fact, there are 27 images missing between the last image from June 2 and the first image from June 3. Also, the first image from June 3 starts in the middle of a sequence and I clearly remember shooting photos of the whole sequence - a fact confirmed by two witnesses.

Every time the camera finishes a folder of images, it creates a catalog file which is simply a text file listing all images in the folder. These catalog files are stored in another folder called CANONMSC. These CTG files have creation times matching those of the corresponding folders of images.

The Microdrive I used that day now has seven CTG files, just as it should have, but those CTG files have strange creation times. The last image on the Microdrive has creation time of 6:57 p.m. However, the CTG me for the folder containing that image shows a creation time of 12:IO·a.m. the following day. This is significant because the police confiscated the Microdrive and Camera around 8:00 p.m. on June 3. At 12:10 a.m. on June 4 the camera had been in police custody for more than four hours. All seven CTG files have similar creation times after midnight on June 4.

The only way the creation times on CTG files for full folders can be changed is by resetting the camera clock while the Microdrive is in the camera and then viewing the images on the camera. The CTG me creation time can also be changed by deleting images. It appears that both were done to the CTG files on this Microdrive while it was in police custody. The police have admitted to putting the Microdrive back into the camera and viewing the images, but deny doing anything else to them.

Clearly, the camera clock was reset by the police very early in the morning of June 4, making it impossible to determine from the images when they were actually created. (The clock was far off the day before, as shown by photos taken outdoors that show shadows directly under subjects when the clock shows those Images as taken at 4:30 p.m. Zenith was shortly after 1:00 p.m. that day.)

The technical information given here on the workings of the EOS IOD has been verified by technical staff at Canon USA who, in turn, verified it with technical staff at Canon in Tokyo. It is conclusive proof that the police tampered with evidence and made innocent photographs appear incriminating. The jury either failed to understand this or simply chose to ignore it.

Mr. Chuck Westfall of Canon USA came and testified at my trial. He brought up all of the technical information above during his testimony. This proved conclusively that there was absolutely no way from the EXIF data to tell when the photos in question were actually taken. The prosecution's main witness, Dr. William Massello, Assistant Chief Medical Examiner, testified that without the exact times, the photos were "just pictures," and told him nothing. In the absence of any evidence to the contrary, my testimony that the photos were taken at least an hour before the EXIF data shows 's the only evidence of the correct time for the photos.