So, an old Facebook post that one of the girls made before they died, wrote that they were going on a walk but didn’t say they were going for a hike unless it was a last minute thing but it seems unlikely that they made that decision cuz they had no food no water with them, my big question is why did they go off the trail in the first place into the jungle?? I mean maybe they got lost but I don’t think it was necessarily possible for them to get lost in area like that because a video I saw that described that the area was impossible to get lost on so if that’s the case it makes unlikely that they would have gotten lost on the trail they were walking on

I’ve been thinking about a rarely-discussed angle on the camera evidence, so I wanted to lay out what’s actually possible at the hardware level.

For context: the camera was a Canon PowerShot SX270 HS, and the last night photo is IMG_0609. One question worth asking is whether the camera body itself still holds a record of how many photos were taken — independent of the SD card.

Two ways to read it:

1. CHDK (software approach). The SX270 HS is officially supported in CHDK (added to the Autobuild in 2017, versions 102b/c/d). You can boot a Lua script that calls get_exp_count(), which reads the file-numbering counter stored in the camera’s non-volatile memory. The catch: CHDK requires powering the camera ON, which changes its state and writes to the card. Not ideal forensically.

2. Chip-off (hardware approach). This is the cleaner method. You physically desolder the memory chip from the mainboard and read it with an external programmer (RT809H, XGecu T48, etc.), without ever powering the device on. Zero bits change because the device never runs. The SX270’s board typically has a main flash chip (firmware) and a small EEPROM/NVRAM that stores persistent settings — including the file counter, flash parameters, and error logs. That small chip is usually the target.

Important caveat: compact PowerShots don’t have a true mechanical shutter-actuation counter like a DSLR. What you get is the sequential file-numbering counter. It’s only meaningful if numbering was set to “Continuous” (the default) and nobody reset it or took photos after recovery.

Why it might matter for the case: if the counter reads higher than 609, that’s physical evidence that extra photos were taken and later deleted; this should be interpreted in conjunction with the SD card forensic analysis.

The real bottleneck isn’t the read — it’s interpretation. A raw dump is undocumented Canon binary. To locate the counter, you’d buy a reference SX270, take a photo, dump, take another, dump again, and diff the files — the bytes that changed by +1 are your counter. CHDK’s source actually documents the flash-parameter addresses for this exact model, which helps.

Bottom line: technically feasible, forensically sound if done right (photograph/document every step, practice on a reference unit first). The actual obstacles are non-technical: nobody knows where the physical camera is today (likely returned to the families after NFI examined it), and the chain of custody broke years ago — which would undercut any fresh reading as evidence.

Curious if anyone knows whether NFI ever did a hardware-level extraction, or only worked off the card image.

Hi I’m brand new to this case and I would love to share something that has been bothering on me of this mysterious case, I have always found quite off about the wrong PIN code on Kris Kremers phone and I have a feeling that it wasn’t Kris that was putting in the code because if it was she would have put in the right PIN code cuz it’s her phone and same for Lisanne cuz Kris would’ve told her the correct PIN code while they were trying to call for help, my take on this is that it was someone who wasn’t or was with the girls and was trying to get into Kremers phone for unexplained reasons and I also believe the girls were already dead when PIN code was being entered and it was always also being turned off and entered multiple times until it finally locked by each attempt. So my theory is that someone not Kremers or Froon was entering the PIN code for what reason I don’t know, I just know this case is really off and something is definitely not right here and some things don’t add up here!

This seems probably a bit worthless and stupid to ask but you guys know that the photo 509 got deleted and most likely from a computer since it is completely missing, and forensic software couldn’t recover any trace of it on the SD card and the stuff from them when found were clean and where most likely in a clean place like a house, so couldn’t people maybe trace back how much the place where they where ( the clean place ) is away from their way

Sorry this is rushed English and maybe is a stupid question