View source for Reports/RMP/Flight Simulator Analysis/1 RMP Forensic Report

{{Template:Menu/Reports/RMP FlightSim Current}}

<h2 style="text-align:center">Royal Malaysia Police Forensic Investigation of Captain Shah's Flight Simulator</h2>
<h3>1) RMP Forensic Report </h3>

<h4>Background</h4>
<p>Malaysia Airlines flight MH370 went missing on {{Day 001}}. The aircraft departed Kuala Lumpur International Airport at 00:42 MYT and was expected to land in Beijing Beijing at 06.30 MYT the same day. Instead, the aircraft diverted west across the Malay Peninsula, travelled north-west toward the Andaman Sea, and then turned south. The flight is believed to have ended in the southern Indian Ocean.</p>

<p>The Pilot-in-Command was Captain Zaharie Shah, a respected and experienced pilot who had been flying with Malaysia Airlines throughout his career. Following the 'disappearance' of flight MH370 the Royal Malaysia Police commenced an Investigation during which they discovered that Captain Shah had a sophisticated flight simulator at his home. Those who knew Zaharie personally, or were friends through a community of flight simulator enthusiasts, knew about the simulator that he constructed, so it was no secret. However, it was of interest to the RMP so the simulator was taken into custody and then evaluated to determine whether there was any data of interest to their investigation into MH370. Of particular interest would be any data that may show evidence of planning for the flight diversion and/or data which could assist in the search efforts which had, by then, included the Indian Ocean.</p>

<p>The term <i>forensic</i> is appropriate when scientific methods are used to solve a crime. Although commonly used in relation to deceased persons, forensic investigations can be undertaken in other contexts, such as industrial accidents, and cyber crimes. Different tools are used in each context, but a forensic investigation always requires suitably qualified persons, standardised processes, and documentation, which would meet the evidence requirements of a Court.</p>

<p>The outcome of a forensic investigation is likely to be a Report, or a compilation of several reports each created by experts in their own field, together with descriptions of the actual evidence, an outline of the process, and a summary or conclusion based on the evaluation of the evidence.</p>

<p>However, the Royal Malaysia Police has <u>not</u> released any report to the public related to MH370, nor are they likely to. When the Australian Transport Safety Bureau wanted to know if any data had been discovered on Captain Shah's personal flight simulator, protocol required that the request be handled by the Australian Federal Police (AFP). The requested information was conveyed by the Royal Malaysia Police to the Australian Federal Police on 19 April 2014, thence to the Australian Transport Safety Bureau and the Australian Maritime Safety Authority. There is no mention of a formal report at that time.<ref name="RMPtoAFP" /></p>

<p>However, it was the ATSB which made public various facts about the data recovered from the [[SIR 2018:1 Factual Information/1.5/1.5.3 Pilot-in-Command/2|Pilot in Command’s flight simulator]]<ref name="PIC_Sim_ATSB" /> when their final report <i>The Operational Search for MH370</i> was published in October 2017. Prior to then there had been rumours, speculation and possibly leaked information, but no official confirmation of the fact that data recovered from Captain Shah's personal flight simulator included two data points in the southern Indian Ocean.</p>

<p>More detail was included in <i>The Safety Investigation Report MH370/01/2018</i> by <i>The Malaysian ICAO Annex 13 Safety Investigation Team for MH370</i>. This Report confirmed the existence of the [[SIR 2018:1 Factual Information/1.5/1.5.3 Pilot-in-Command/2|Royal Malaysia Police’s Report on Flight Simulator of PIC]]<ref name="PIC_Sim_SIR" />, referred to as an <i>RMP Forensic Report dated 19 May 2014</i> .</p>

<h4>Summary</h4>
<ul class="ulNormal">
<li>The Royal Malaysia Police seized a flight simulator from the home of Captain Zaharie Shah, who was the Pilot-in-Command of Malaysia Airlines flight MH370 when it went missing on {{Day 001}}.</li>

<li>The forensic investigation of the flight simulator is documented in an <i>RMP Forensic Report</i> dated 19 May 2014.</li>

<li>Data recovered during the forensic investigation of the flight simulator was provided to the Australian Transport Safety Bureau and the Australian Maritime Safety Authority. The ATSB described that data in the report <i>The Operational Search for MH370</i>.</li>

<li><i>The Malaysian ICAO Annex 13 Safety Investigation Team for MH370</i> subsequently referred to the <i>RMP Forensic Report</i> in the <i>Safety Investigation Report MH370/01/2018</i>.</li>

<li>The <i>RMP Forensic Report</i> has not been officially released to the public.</li>
</ul>

{{ShortLine}}

<h3>Document List</h3>

<p>Relevant information contained within the [[Royal Malaysia Police Reports|RMP Folders]] circulated on the Internet is in several separate documents which have been combined with other scanned pages to create larger files. Although appearing genuine, these are <u>not</u> Official documents released to the public with version control and provenance (a chain of custody and guarantee of authenticity). The separate documents are described below:-</p>
<ol>
     <li>A <i><b>Preliminary Examination Report</b></i>&nbsp;<ref name="MalayReport" /> dated 19 MEI 2014 and written in Malay seems to be the first Report. This Investigation was conducted by the computer crime section of the Royal Malaysia Police forensic laboratory and the Report was signed by a single Investigation Officer. It documents the process of discovery of seven data points<ref name="7DataPoints" /> from disk MK 25, including the two data points located in the southern Indian Ocean but does not include the actual coordinates. A diagram does, however, illustrate a possible relationship between the seven data points, using altitude, fuel levels and distance between each location. This report concluded (paraphrased) that the computer was used mainly for playing the Flight Simulator game; inspection of all the disks found that there was no unusual activity; and found no information to show any plan to [get rid of (or) terminate] MH370.</li><br />
     <li>A <i><b>Preliminary Case Report</b></i>&nbsp;<ref name="PreminaryCaseReport" /> dated 19 May 2014 is written in English, apparently by staff of CyberSecurity Malaysia which had been asked to assist the PDRM in their investigation. An <i>Appendix A</i> is attached to the report - see below for details. This report is signed by two analysts, neither of whom wrote the <i>Preliminary Examination Report</i>.<br />
The Investigators assembled a flight simulator from purchased components, less sophisticated than Zaharie's, but sufficient to use the Flight simulator software and verify that the recovered data is from *.FLT files. An additional objective of their investigation was to analyze the seven (7) coordinates found in the MK25 exhibit. A The coordinate data is in a Table, with latitude, Longitude, Altitude, Pitch, Bank and Head (Heading).</li><br />
<li><i><b>Appendix A &nbsp; 7 Extracted Coordinates From MK25</b></i>&nbsp;<ref name="AppendixA" /> is a poor quality scan of a data printout from the MK 25 System Volume Information file included with the <i>Preliminary Case Report</i>. The printout contains 30 pages of data (with no blank pages) so holds more information than <i>Appendix M-1</i> (below). However, there are many lines of unreadable characters which may have been omitted from <i>Appendix M-1</i> because they seem meaningless. The coordinates are the same; parameter values seem the same; but this Appendix contains some parameters and values which are not in <i>Appendix M-1</i>.</li><br />
<li><i><b>Analysis on Simulator Data From Captain MH370 Pilot's House</b>.</i>&nbsp;<ref name="AnalysisSKMM" /> This is a 2-page document with a Table containing six<ref name="7DataPoints" /> coordinates labelled Route A to Route F and data including Latitude, Longitide, Altitude, Speed (No Data) and Fuel. A diagram shows Point A to Point F plotted on Google Earth. It is stated (incorrectly) that:-<br />
<div class="quote">This particular flight path was found in windows restore point file, deleted files and unallocated cluster files of hard disk labelled as MK22 and MK25<ref name="FlightPathSource" />. Detailed extract of this flight path can be found in <b>Appendix M-1</b>.</div></li><br />
     <li><i><b>Appendix M-1</b></i>&nbsp;<ref name="AppendixM1" /> contains the <i>Recovered Simulation Data From Zaharie's Flight Simulator That was taken from his House</i> in 27 pages of data printed from the recovered files. Each data point is labelled Route A, Route B etc to Route F: a total of six sets of data. Data for each 'Route' comprises parameters for the simulated aircraft including latitude, longitude, altitude, pitch, bank, heading, fuel levels and more - approximately 4 1/2 pages per 'Route'. Some pages are blank and some data sets are not complete. </li>
</ol>
{{ShortLine}}

<h4>NEXT: [[Reports/RMP/Flight Simulator Analysis/2 Forensic Investigation Process|2 Forensic Investigation Process]]</h4> 
{{ShortLine}}

<h5>References</h5>
<references>
<!--  Use this syntax in the page <ref name="REF_NAME" />    -->
<!--  And this syntax in the References <ref name="REF_NAME">TEXT or LINK</ref>    -->
<ref name="RMPtoAFP"><i>The Operational Search for MH370</i> (ATSB) Table 15: Second refinement to surface search area (3–28 April 2014)<br />
"MH370 PIC Microsoft flight simulator data analysis provided to AMSA/ ATSB by Australian Federal Police (19 April 2014)".</ref>
<ref name="PIC_Sim_ATSB"><i>The Operational Search for MH370</i> (ATSB) [[The Operational Search for MH370/PIC Simulator|Pilot in Command’s flight simulator]] </ref>
<ref name="PIC_Sim_SIR"><i>Safety Investigation Report MH370/01/2018</i> The Malaysian ICAO Annex 13 Safety Investigation Team for MH370,    
[[SIR 2018:1 Factual Information/1.5/1.5.3 Pilot-in-Command/2|1.5.3 2) Royal Malaysia Police’s Report on Flight Simulator of PIC]]</ref>

<ref name="MalayReport">Source: <i>MH370-RMP-Folder-1-Pilot</i>{{RefID:RMP-Folder-1}}</ref>
<ref name="AppendixM1">Source: <i>MH370-RMP-Folder-Appendix</i> Appendix M-1{{RefID:RMP-Appendix}}</ref>
<ref name="PreminaryCaseReport">Source: <i>MH370-RMP-Folder-1-Pilot</i>{{RefID:RMP-Folder-1}}</ref>
<ref name="AppendixA">Source: <i>MH370-RMP-Folder-1-Pilot</i>{{RefID:RMP-Folder-1}}</ref>
<ref name="AnalysisSKMM">Source: <i>MH370-RMP-Folder-4-SKMM-Analysis-Communications-and-Multi-Media</i>{{RefID:RMP-Folder-4}}</ref>
<ref name="FlightPathSource">According to other documents the <u>only</u> source of data was the Volume System Information file recovered from disk MK 25</ref>
<ref name="7DataPoints">Although seven data points were initially identified, it seems that as the investigation progressed one was discarded. The ATSB report refers to six data points;  the Annex 13 Team referred to the original seven data points. The discarded point was one of two data points at KLIA and therefore not significant.</ref>
</references>

[[Category:Reports]]

<!-- <h5>Note:</h5><p>Although an <i>[[Reports/RMP Forensic Report|RMP Forensic Report]]</i> has not been officially released, a collection of documents from the RMP MH370 Investigation was apparently provided to a journalist who subsequently shared them via Twitter, and other recipients then made them available via other file-sharing platforms on the Internet. The documents appear genuine and selected extracts have been included in pages linked below, for reference purposes.</p> -->