The missing Dutch girls in Panama
4 December, 2019 I want to write something about a missing persons case that has kept the Netherlands awake for some time now. It is a relatively "old" case actually, from 2014. But especially in the Netherlands, this disappearance was never really forgotten. I initially got sucked in so bad, that for some time I had nightmares and trouble sleeping and thinking about anything else than what these fellow Dutchies must have gone through. This case is so complex and has so many twists and turns and it will grab you so much emotionally, that I decided by 2018 to write out everything that is known so far in this blog. I am not a professional crime writer or blogger, but I felt this case is so gripping and interesting (and sad) that it deserved recognition outside of the Netherlands. And justice. I'm not a native English speaker, so apologies for any grammar errors or strange sentence constructions I may have made.
When I tried to make some sense out of this disappearance case back in 2018, there was on the one hand very limited public information with regards to what actually happened to Kris and Lisanne, and on the other hand a lot of hard to find local journalistic work, which had not always been highlighted much. Then there were a couple of forums where relevant information was also shared, but outside most of the public's view. I also translated many videos and articles of interest from Dutch to English in order to provide you with the most detailed archive of this case. And instead of having all these pieces of information scattered all over the internet, I brought them together here in a (long) and detailed narrative of what is publicly known about the case by now (call it a form of Open-source Intelligence), with source links provided whenever possible. This includes interviews, journalistic pieces, statements from people linked to this case, investigation results, new findings, leaked photos and files and more, poured in a more or less fluid read. But as this case is so complex and ever evolving still, the blog grew and grew over time. Making it more difficult to wade through. So it will take some of your time to read through it all now.. Over time the accessibility of all this now translated information has led to huge coverage by youtubers, bloggers, on news sites and forums. The many cryptic clues and unanswered questions now give this case almost a cult status. It was clear from the start that the story had some gaping holes and that there was conflicting information out there. Unfortunately there still is. I tried to broaden the narratives about what may have happened to them accordingly. And at times I add my personal opinions as well. In the ultimate hope that when more people know about this case, chances increase of us ever finding more facts and answers. This blog post was originally posted in early 2019, but had to be reuploaded more recently. It took me years by now to write and to update. If you want to use my work for your own publications, please be so courteous to give a shout out or a source mentioning and link back to my blog, thank you :) Now, here we go..
On March 15, 2014, Dutch students Kris Kremers (21) and Lisanne Froon (22) boarded a plane from Amsterdam to Costa Rica. They flew in the morning with United Airlines and made a stopover in Houston. From San José, Costa Rica, they then travelled by bus to Bocas del Toro, Panama. A boat took them to the Panamanian island Isla Colon in the Bocas del Toro archipelago. Lisanne Froon [phonetically pronounced as Frohn, with a hard, trilled 'r'] is tall, 184 cm, athletic and just graduated from her university studies in Applied Psychology. She was born on September 24th 1991 and said to be thoughtful, intelligent, empathetic and a little bit shy. She loved the music of Coldplay and kept a diary, which she also brought along to Panama. Lisanne's brother Martijn has read passages from her diary aloud in a Dutch TV program called Break Free (if you are interested in viewing this program you can find it translated by me here and here. If you want to read the diaries, go to part 3 of my blog series). Kris Kremers [phonetically pronounced as Kreh-mers, with a hard, trilled 'r'], a middle child with an older brother Sjors and a younger brother Tijn, was less tall than her friend, measuring 167 cm. She had just completed her studies in cultural social education at the University of Utrecht. She had decided to start studying art history once she would come back from Panama. She had previously done work in psychiatry, dealing with people with severe addiction diagnosis. Born on August 9th 1992, she was sparkling and extroverted; cheerful, intelligent, spontaneous and outspoken, with striking red/strawberry blonde hair. She loved theater and the artistic world. She also enjoyed festivals and music from Pearl Jam and the Red Hot Chili Peppers. She had a boyfriend in the Netherlands and kept a diary, just like Lisanne. The two friends had saved for a long time for this trip, which was supposed to be part of a gap year. They knew each other from their work in cafe/restaurant 'In den Kleinen Hap' in Amersfoort and they both rented rooms in the same student house - Lisanne had in fact only started living on her own several weeks before her trip to Panama. They planned to not only sight-see around Panama, but to also learn Spanish in Bocas del Toro and to do volunteer work at a local children's school* (also named a nursery or a daycare center in the media, but I will call it a children's school in this blog) in Boquete. They didn't just want to go on one long holiday, but also do something for local children. In Holland they gathered money from friends and family to buy children's toys for the Panamanian kids they would teach. They planned to return home on April 21st. (Although Kris' brother Sjors always mentioned April 29th as their planned return date). Kris developed a love for South-America after a holiday in Peru with her parents. Lisanne had never travelled further than southern Germany with her parents. - Btw: I call kris and Lisanne often 'girls' in this blog, even though they were young women of course. But in Dutch we'd call them 'meiden', which is somewhere in between women and girls I suppose and it is a term of endearment for young women. Here I translate it as 'girls'. 
The girls first visited the coast of Panama and had a good time in Bocas del Toro, learning some Spanish, enjoying the beach, food, drinks, sightseeing and dancing in the evening. Kris and Lisanne stayed two weeks in a hostel called Mamallena, which belongs to the Dutch-ran language school they visited: Spanish by the Sea. They met two young Dutch men there, who they spent a lot of time with, as well as several international young men. Lisanne wrote shortly after arrival in her diary; "Waaaaah what a trip. Luckily I almost forgot about it already upon arrival in the beautiful and cosy Bocas del Toro. I would not want to be found dead in San Jose, although the chance of this is quite high in San Jose. But I could live in Bocas for the rest of my life. Maybe when I ever retire? I am sitting in the sun, which I can't hold out much longer by the way (hot!) and I take a good look around me at my new accommodation for the next two weeks. The heat is already very special by the way, even in the shade I have the feeling that I can still burn alive. But despite this, the sun is actually quite nice. How intensely happy it can make a person. Kittens, stray cats, yes, they are regular customers here. They walk everywhere! Just like mini salamanders, even in the shower! If they manage to keep the spiders away, they could actually become my best friends. We have also seen a dolphin, the ultimate enjoyment. Drinking from a coconut, a real one yes! And getting sunburned, I worked well on my tan, what more do you want?!" - She went on to describe Spanish classes, excursions where they saw dolphins, sloths and bounty islands, and evenings of eating and drinking and dancing with their new made friends. Kris wrote about their travel to Bocas: "The bus trip was an adventure in itself. The bus trip itself went well. But first we had to speed through San José by taxi because we had no cash on us. When we got out in Sixaola, we and two locals were the only ones left. We had to just figure out for ourselves how to get to the border. The bus driver only spoke Spanish. We were sent one way and with our backpacks we really stood out among the locals. We arrived at the border, which consisted of an old bridge. It was very bizarre to cross the border that way. Once on the other side we arrived at a building where we had to pay money for a sticker on a passport (I think we were scammed). When we stood at that real immigration [checkpoint] a man approached us and asked if we had to go to Bocas. We were a bit suspicious because we didn't know very well if we could trust him. All the people were in a great hurry because they thought we would not be able to catch the last boat. For this reason we decided to just jump in the car and hope for a happy ending. And it came. After a hellish ride where the driver was driving so fast that I didn't even dare to look, we arrived at a small stepping stone for the boat to Bocas. After about half an hour we finally arrived."
When Kris and Lisanne arrived in
Boquete two weeks later, on March 29th - a city close to the western border of the country with around 19.000 inhabitants - it soon after turned out that their appointments had changed; staff of the children's school "Aura" (Guardaría Aura) told them that they could not work there that week, as planned. In the media it has been said from the start that school director Maria Elena said that she 'had other things to do elsewhere' and that she had no time or place for them, despite earlier made agreements. But to police, Maria Elena said on April 10th that she "did not offer any internships and did not even know the language school or Ingrid". In general, she had not employed any volunteers "for three years". This completely contradicts what Spanish by the River employee Marjolein claims, namely that she arranged the work assignment for Kris and Lisanne by telephone with Aura daycare center on March 28th. Kris and Lisanne had received confirmation of their agreed volunteer work around that same time. Marjolein told SbtR owner Ingrid Lommers later that Maria Elena had turned her down out of the blue. It is also strange for Maria Elena to have denied knowing Spanish by the River, as they had her Guardería Aura listed on their website at the time as a partner of theirs, offering volunteer work to foreign students. The website stated all the information for Aura daycare center. Which could of course also mean that Ingrid Lommers just chucked whatever she wanted on her site in an attempt to lure tourists to Boquete (we don't know if she had an agreement with Aura or not and nobody has so far publicly questioned her about this). But as you will soon find out, this complex case is full of contradictions and flat out lies.
The head of the school, Maria Elena, also complained later that she could hardly understand Kris and Lisanne, as they spoke no Spanish. Only "the taller one in the flowered blouse" spoke a little Spanish, she says, while the other one didn't. Again, Maria explains that she can't offer her a job. Kris and Lisanne did understand that. Lisanne wrote about this in her diary: "As we arrive at Aura on time, we are not even recognized or given a friendly welcome. The only thing we hear is "no proxima semana"= we are only welcome next week. WHAT?! We returned to the [Spanish] school disappointed and indeed, the daycare only has work for us next week." And Kris wrote in her diary: "When we arrived, we introduced ourselves, expecting the woman to know who we were because she was expecting us, after all. But that was not the case. She showed no sign of recognition and said that it was not possible now [to start volunteer work there] and that we should come back next week. We also did not understand what exactly was going on. Then we went back to the language school to tell our story and to get some answers. It turned out that there was no place/work for us after all this week, so we couldn't start yet. The school also found it very strange, because we had planned things months in advance." So Kris and Lisanne were sent away. All their preparations had been for nothing and all their plans went down the drain at that moment.. Especially Lisanne did not take this setback well, as they planned everything meticulously at home with the help of the travel agency they used, called Het Andere Reizen - roughly translated as A Different type of Travel(ing). Hans Kremers, Kris' father, also stated in a Dutch talk show that staff of the Spanish language school in Boquete - who had helped to organize the volunteer work - had even sent a confirmation email on the Friday, so three days before they were supposed to start their volunteer work. Confirming their start on the Monday. But the reality was that Lisanne texted her parents that day "We have been sent away. I am really very disappointed." A few hours later, Lisanne texted her mother Diny that they were trying to find another spot for them to do volunteer work, and that they would go for that. She started her diary entry for that day with "Yuck! Yuck! Yuck! Our first day was a disaster."
The head of the school, Maria Elena, also complained later that she could hardly understand Kris and Lisanne, as they spoke no Spanish. Only "the taller one in the flowered blouse" spoke a little Spanish, she says, while the other one didn't. Again, Maria explains that she can't offer her a job. Kris and Lisanne did understand that. Lisanne wrote about this in her diary: "As we arrive at Aura on time, we are not even recognized or given a friendly welcome. The only thing we hear is "no proxima semana"= we are only welcome next week. WHAT?! We returned to the [Spanish] school disappointed and indeed, the daycare only has work for us next week." And Kris wrote in her diary: "When we arrived, we introduced ourselves, expecting the woman to know who we were because she was expecting us, after all. But that was not the case. She showed no sign of recognition and said that it was not possible now [to start volunteer work there] and that we should come back next week. We also did not understand what exactly was going on. Then we went back to the language school to tell our story and to get some answers. It turned out that there was no place/work for us after all this week, so we couldn't start yet. The school also found it very strange, because we had planned things months in advance." So Kris and Lisanne were sent away. All their preparations had been for nothing and all their plans went down the drain at that moment.. Especially Lisanne did not take this setback well, as they planned everything meticulously at home with the help of the travel agency they used, called Het Andere Reizen - roughly translated as A Different type of Travel(ing). Hans Kremers, Kris' father, also stated in a Dutch talk show that staff of the Spanish language school in Boquete - who had helped to organize the volunteer work - had even sent a confirmation email on the Friday, so three days before they were supposed to start their volunteer work. Confirming their start on the Monday. But the reality was that Lisanne texted her parents that day "We have been sent away. I am really very disappointed." A few hours later, Lisanne texted her mother Diny that they were trying to find another spot for them to do volunteer work, and that they would go for that. She started her diary entry for that day with "Yuck! Yuck! Yuck! Our first day was a disaster."
Meanwhile the girls stayed with a local host family in Alto Boquete, which is situated south of Boquete, for four weeks; Miriam Guerra often houses international students and had a room for the girls in the main house. Miriam described the girls as smart and shy. In this local newspaper article she also stated that the girls were "restless". She said that on the first evening there, Kris read a book in the girls' bedroom while Lisanne kept Miriam some company in the living room. Despite not speaking very good Spanish, Lisanne managed to explain to Miriam that they didn't yet know what to do with their newfound free time. Miriam suggested the local school Casa Esperanza to them, which requested 'intermediate Spanish language skills'; the same probably applied to the Aura children's school. Casa Esperanza offered similar type of volunteer work, but the girls told her that they had already tried that place in vain. Miriam also recalled to a Dutch newspaper that Lisanne had coughed a lot, as she was "asthmatic". It has not been confirmed as far as I know if Lisanne had actual asthma, or that the journalist just called it asthma but in reality Lisanne had a cold, a sore throat or perhaps even some issues with the higher altitude in Boquete. It seems more likely to have been a cold. Either way, Miriam recalled that Lisanne was not feeling too well and also had a sore throat on Monday evening; Miriam didn't believe they would voluntarily go on a very long hike the next day. But the girls eventually did decide to explore the area the next days. They are claimed to have planned all sorts of sightseeing tours for the next week (starting on Wednesday April 2nd until Saturday), with the help of staff of the local Language school they attended, called Spanish by the River. This Dutch-run Spanish language school has multiple locations, including one in Bocas del Torro, called Spanish by the Sea, and one near Boquete, called Spanish by the River. In fact, this location was situated only a few houses from Miriam's place in Alto Boquete and Kris and Lisanne dropped in there many times, also to check things on the schools computers and to use their Wi-Fi. When replacement volunteer work proved difficult to arrange for the first week of April, the girls showed interest in local day tours, such as climbing the local volcano and visiting a local coffee plantation and a strawberry farm. But for Tuesday they had nothing planned yet. Perhaps to save money, because hiring a guide in Boquete can cost up to $35 or even $45. In this article it is said by a local tour guide that he charged $25 per tourist for a tour on the trails around Boquete.
On Tuesday April 1, 2014 they set out on a hike on the Pianista Trail (Sendero la Culebra), which is a well known path that brings walkers to a summit at around 8 kilometer distance from Boquete, meanwhile passing clouded forests and meadows. Here you can see a post from a hiker who made beautiful photos on this trail, to get an impression of its beauty and here is a video of people walking this trail. The girls wrote prior to the hike on Facebook that they intended to walk around Boquete. And they also sent Kris' boyfriend Stephan an SMS message according to Lisanne's mother, to say that they were going for a hike that Tuesday. A taxi is said to have picked them up and brought them to the start of the trail, which is about nine kilometers north of the Spanish language school and their host family's house. The taxi driver declared that he dropped them off in the afternoon (13:40 PM) and two staff members of the language school confirmed at the time that they had seen the girls leave there shortly after 13:00 PM. But the clock on their digital camera suggests that Kris and Lisanne started their hike around 11:00 in the morning, in fact. This is only one of many inconsistencies in this story, so be prepared for a lot of confusing storylines to come. According to her father and boyfriend, Kris last had contact with Stephan around 14:00 PM that day, by phone (Hans did not specify whether this was a phone call or a text or another form of contact). Lisanne and Kris wore light clothing on the day; shorts and a tank top, and didn't bring much with them other than a light backpack, some money, their mobile phones, a separate digital camera, a water bottle and most likely some food or snacks, although no wrappers of anything but small sweets were found and Lisanne's brother later said he didn't think they brought any food at all. So they were dressed for a short trip. Residents at the start of the trail have later declared to a Dutch journalist as well as atv crew that they warned the girls not to walk up there by themselves and the same had been told to them during an introduction talk by one of the school staff members. But the girls dismissed these worries and there was word that they took a local dog (named Blue, or Azul in Spanish) along, who was from restaurant owners at the start of the trail. Suspicion rose however when the dogs owners declared that Blue returned to Boquete that same day, without the two girls. The host family is said to have searched the area surrounding their home once they realized that their guests had not come back in the evening, but found no sign of the girls. Giving them the benefit of the doubt, the host family decided they would wait until the morning to continue their search. But in another interview the host mother said she was simply unaware that the girls were not home on Wednesday morning and said she left them breakfast before going to work, thinking they were sleeping in. It is often hard to be sure which version of a story found in the media is correct, especially when people provide different details in different interviews. Kris and Lisanne were said to have been scheduled with a local guide for a private walking tour at 8 AM that next day, Wednesday April 2nd, but they never showed up for this appointment. Which makes you wonder why they didn't just wait for this Wednesday tour to venture out with a knowledgeable local, instead of going out hiking alone on Tuesday already. It was at this point that the tour guide went to look for the girls at the house of the nearby host family. And later that day, in the early evening, he and a staff member from the language school contacted the authorities and the girls' families. The next morning, Thursday April 3rd, authorities are said to have conducted an aerial search of the forest, as well as a foot search with the help of local residents. Scroll down here in a follow up blog post of mine for a more detailed timeline that chronicles Kris and Lisanne's known movements as well as all the Sinaproc search activities. Betzaida Pittí has declared to the Dutch authorities that several search operations were conducted by the Civil Protection Authorities of Chiriqui in an attempt to locate Kris and Lisanne, and that these searches covered the area along the Los Quetzales trail that connects Boquete to Cerro Punta, towards the top of the Barú volcano and along the trail known as El Pianista. Without success. 
DRY
In the media, the bag was nevertheless described as clean and dry, with dry content.[1,2,3] This was based on the one photo taken by the police that made it to the media. The Panamanian TV station TVN published the above photo of the backpack on June 17. It shows both the rucksack and its contents in almost pristine condition. You can also see this for yourself in the (above) photo of the bag; everything looks dry and clean, aside from some minor discolorations. Authors Hardinghaus and Nenner confirmed that unpublished other photos which investigators took of the backpack also "confirm this impression". And that even the spread-out banknotes, which can be seen in other pictures, "appear to be barely soaked". The money bills inside the backpack were also not decomposed. The cell phones and memory cards showed no signs of water damage and the data from the Samsung and the camera could be read without problem (the IMELCF started its investigation on June 17 and could retrieve the data from the Samsung SIM card and the from camera that same day without any technical effort). The only items that were described to have some water damage were the battery of the Canon camera and the battery of the iPhone. The authors also read a report on the bag and spoke with Irma and Luis, who also confirmed that the backpack showed only minimal damage and was only wet and sandy on the outside, but virtually dry inside. But the backpack looks normal in the photo - not even the turquoise flap of fabric of the bag looks wet or to have sustained water damage - and with this there is no evidence that the bag was ever wet by the time it was found. The backpack was not described as 'wet' (or 'dry') in the police files either (although in the NFI files it is in fact stated that the backpack had been wet before and had been unpacked by several people). It seems therefore unlikely that the backpack was really wet by the time investigators got it in their possession (which was at least 48 hours later), but this is unverified. Irma and Luis recalled to also that the rucksack was slightly damaged and full of sand, but in a passable condition. We also know from the police files and me from having had access to the NFI files and their content, that there was actually some dirt on the bag, as well as some yellowish brown clay at ends of the straps of the bag and some plant fragments and loose sand inside the bag. There were also some translucent plastic fragments found in the bag. Police assumed the bag had drifted by the river to the spot where the local woman noticed it, but the Dutch NFI have never been able to confirm this. It had been raining heavily in the prior few weeks and some people believe that the backpack did not look like it had spent weeks in a wet, muddy jungle and river, having endured 72-something days in a highly humid rainforest in fact. [The photo of the backpack was taken in Luis' house on June 13th 2014].
The police report also mentions several details from the forensic analysis of the backpack. The attachment of one of the straps had partly come loose. The plastic closures contained deep scratches. The fabric of the bag showed some signs of discoloration in various places, possibly by abrasion. A rectangular piece of the fabric of approximately 30 by 15 mm at the top right corner was missing, showing straight edges at the location of the damage. And close-by there was a straight tear in the fabric of the bag of approximately 10 mm. This big tear was located near and parallel to a seam. It was determined to have been caused by a sharp edge. The precise nature of this edge (whether it was a natural sharp edge or a man-made sharp object) has not been determined. But going by the photo taken of the bag, it does appear to hang upside down on a nail in the wall... Within this tear, the material polyester urethane was found. This material is frequently found as foam or elastomer. But the origin of this specific piece of material remains unknown. Matt had access to the official police files and concluded: "Although the damage of the backpack (scratches and abrasion) is consistent with travelling in a river and rocks, the damage is very light and probably not consistent with a travel of many kilometers in a wild river." An inhabitant of Alto Romero, called Guide Tony, was present when police came to Alto Romero by helicopter and opened the backpack. He told podcast makers that he saw it and says that despite being wet, the backpack was in "pretty decent shape". Having extensively been exposed to the jungle for ten weeks, it had held up. It was damaged, but intact. He also mentioned that he saw how the cellphones and money, all those things "were taken out of the plastic bags". It has not been reported on or cleared up since in what sort of plastic bags the phones and such were found, inside the backpack. Or whether or not Kris and Lisanne ever carried their devices in protective plastic bags.
Soon after its discovery, a photo of the backpack started circulating in the Panamanian media. In this Panamanian news item the photo of the backpack was shown on June 17th 2014. It showed both the bag and its content, possibly providing the first real clues about what might have happened to the girls. Everything inside the black backpack (of the brand Burton, with a brown/green/gray diamond pattern and turquoise interior) was "in good general condition", according to the NFI files. "The backpack 1 is in good general condition, but is dirty and contains various damage lesions". In it were two folded up bras: Kris' bra was black and without a visible brand name, Lisanne's was described as having a colorful floral pattern in black/red/green and being from H&M. Two undamaged pairs of sunglasses (one pink, one described as 'black'). Both girls' mobile phones; a white Samsung Galaxy SIII mini from Lisanne with an orange protective cover (police later fixed its battery and SIM card to the device with adhesive tape). As well as a black iPhone 4 with a green protective cover from Kris (police later fixed its battery and SIM card to the device with adhesive tape). Neither phone looked damaged. Two phone SIM cards, one from T-mobile and one from Hi. A black digital Canon Powershot SX270HS camera with battery and without a lens cap which did not look damaged, as well as a 16GB memory card from SanDisk*. (The camera was described as a 'Samsung camera' by mistake in the police files; police later attached its battery and memory card to the device with adhesive tape). A black camera case. A type of identity (insurance) card from Lisanne. One key with a blue key chain and a small padlock [the same type of lock perhaps as we can see lying here in the top right corner on Kris' bed? Found after they went missing]. The bag also contained two small shells (a sea shell and a snail shell), as well as "transparent plastic fragments". Also found inside the bag were 88 American dollars and 30 cents (three $20 bills, two $10 bills, one $5 bill, two $1 bills, five coins of 25 cents and one coin of 5 cents). There were also 'two personal items' found in the backpack according to ImperfectPlan, which have not been further specified. I also could read no mention of these personal items in the NFI files. The photo of the backpack also shows what looks like a wrapped up sweet, maybe a cough sweet or lozenge. The photo also shows an empty water bottle, which was also found inside the backpack. A similar looking water bottle can also be seen in some of the photos the girls took. In fact, photo #491 shows Kris holding two such water bottles. But the local cop who described the bag and its content right after it was picked up, did not list this water bottle in the content list of the original police report, strangely enough. What is inventoried by the policeman is "two personal items packed in accordance with the chain of custody" may have been the water bottle(s) and/or candy wrappers perhaps. Or perhaps these two personal items were something else entirely. It is not known why the police file does not explicitly specifies their nature. The sunglasses with the 'coloured' glasses matches the one Lisanne wears in this photo, taken on the day they went missing. But Kris seems to wear brown sunglasses there, not purple'ish ones like the one pictured with the bags content.. Was its colour somehow bleached by the sun? It also seems that the girls did not bring some items that could have potentially helped them perhaps, such as a compass, an emergency locator beacon, a solar charger/power-bank, a whistle or a reserve battery for their phones. (Obviously no satellite phone either..). No weapons have been found either; no knife and neither a lighter for instance. And was the key with a blue key chain also the key of their room? Surely they brought it with them. Also, the fact that the backpack seemingly travelled so far up the river raises the question how it could have stayed afloat, as opposed to sink and get saturated with water, in a river that winds for many kilometers and is littered with rocks. This river is said by officials to be able to disintegrate whatever falls into it, when the water is high enough. Yet, the backpack was found with almost no damage and with belongings inside that only endured some water damage. The backpack also seems to have travelled surprisingly far, while items that float in a river are normally more likely wash up on the shore sooner than later. Although the mobile phones and camera suffered some water damage, there was no physical damage to the screens of the mobile phones or the digital camera, such as cracks or dents. The SD card of the digital camera could be read out, and contacts, mobile phone connections and text messages were also extracted from the SIM card of the mobile phones. Hardinghaus and Nenner reported: "We locate these in the file and discover that they all date from before the girls' disappearance." The local cop who first made the inventory of the bag and its content reported one SD card, which was also pictured next to the Canon camera together with its battery, taken out to dry. A strange detail though, described by Hardinghaus and Nenner: "The statement [made on June 12th] by Mayor M., who examined the contents of the rucksack before Pittí arrived at 9:20 a.m., does not quite match this account. He noted that the Samsung phone he examined had neither a SIM card nor a memory card. It is unclear whether this discrepancy, which is certainly significant, was investigated by the authorities." But it most likely was just an error from Mayor M, who may not have noticed the SIM card having been taped to the phone instead.
The DNA analysis of the backpack
Fingerprints
Regarding fingerprints, it was also reported in the local media that as many as 34 different fingerprints were found (later edited in the article to 12); 13 on the backpack, 12 on the (scotch tape on the) phones and 3 on the camera, as well as 6 different ones on the bras. However; the NFI investigated the Apple iPhone, the Samsung phone and the Canon camera for fingerprints and in their NFI report there is only mention of 10 fingerprints that were made visible in research: 1 on the front of the iPhone, 2 on the adhesive tape of the iPhone, 1 on the loose battery that came with the Samsung Galaxy phone, 2 on the adhesive tape on the Samsung phone, 1 on the Canon camera battery, 2 on the Canon camera housing and 1 on the adhesive tape on the Canon camera. At least one fingerprint trace could be used for identification. A 'complete profile' could be created with it of at least one person (other than Kris or Lisanne). The NFI placed it in a Dutch fingerprint database, but - probably unsurprisingly - found no match. Panamanian authorities never tried or managed to trace this person. The NFI investigator made the suggestion to Betzaida Pittí and her team to compare the fingerprints in Panama, but this was not done. Pittí failed to document fingerprints of the people involved in the searches and did not do so at a later point in time either, and there is also no mention of her and her team checking the fingerprints with a Panamanian fingerprint database. And because local police did not (always) wear gloves when handling the belongings of Kris and Lisanne, it can't even be excluded that officials were to blame for these fingerprints that were found on the scotch tape with which memory cards were attached to the mobile phones/camera.
The Dutch NFI (through first the Dutch National Police prosecutor) was eventually tasked by Pittí to forensically analyse the mobile phones, the Canon camera, the backpack and both sets of bras of Kris and Lisanne. These items were found on June 11th. Pittí and her team then looked at the phones and camera and in the bag on June 17th. Which is around the time when she and her team also brightened and rotated photo originals. More on this here. Pittí and her team also leaked some photos to the Panamanian press at June 17th, including a photo of the backpack and personal items displayed. Something which hurt the parents of Kris and Lisanne. In one of the first articles on the matter, the families of Kris and Lisanne expressed their disappointment in the leaking of the footage of Lisanne's backpack. "The family finds it very distressing that these photos appear in the media. They also show bras, which is of course not pleasant." Pittí then sent these items and the request for International Legal Assistance to the Dutch forensic institute on June 20th of 2014, asking for a more thorough investigation by the Dutch. Specifically; to look at the phone and camera use by Kris and Lisanne on April 1st and afterwards. (This is probably the reason why we have no data of Kris and Lisanne's comings, goings and meetings before their disappearance...). The NFI received the items at or around June 23rd, brought to them by a team leader of the NFI called Mr. Perlot (who had been in Panama prior together with a colleague and who brought these personal items back to the Netherlands). The items were then inspected for fingerprints, DNA and biological traces. They did did their examinations in a human DNA-free space. They also investigated the fabric of the backpack, the contents of the phones and of the camera. The Dutch NFI finished their investigation and reported back to Panama on August 20th, 2014. On September 4th 2014, the Dutch authorities sent the items back to Ana Belfon, prosecutor in Panama, together with five DVD's with RAW phone and camera data and other findings. The Dutch requested for Belfon to forward these belongings to the relevant authority in order to deliver them to the relatives of Lisanne Froon and Kris Kremers. I will detail the NFI's findings about what was found on the phones and the camera below. The NFI also sent Panama five DVD's, containing the following information: a forensic copy and report of the iPhone 4 of Kris Kremers, a forensic copy and report of Lisanne Froon's Samsung phone. A forensic copy of the memory SD card from the Canon camera of Lisanne Froon. These five DVD's were never further reported on by anyone and it appears that they have not been added to the case file. It is unclear what RAW data of importance may be on these DVD's and whether or not the NFI investigator in charge of the research did a good enough job in analyzing them beyond the superficial. The Police from Midden Nederland also delivered a hard drive, containing the files from the computers that the girls had at home. This had to do with the investigation into the two telephones, although the NFI files don't further elaborate on this link.
DNA
The NFI took samples from both mobile phones (including samplings of the edges of the SIM card, of the edges and buttons on the outside and inside of the phones and samplings of the edges of the batteries). They also took samples from the camera, from the backpack (samplings of the straps, zips and edges of the backpack) and from the two bras. No DNA profiles could be obtained from the samples taken from the phones and from the camera. Six samples were taken from both bras and one of the samples resulted in a DNA profile. Unfortunately, this DNA profile was of no use, as the NFI discovered that one of their employees had accidentally contaminated it. So this DNA profile was in fact from the NFI employee. The other five samples did not result in a DNA profile. Thirteen samples were taken from the backpack. They were taken from the straps, zippers and edges of the backpack. Only three of those backpack samples provided a DNA profile. Samplings #01 and #03 contained the DNA of two unknown women (woman A and B). Sampling #05 contained a mixed DNA profile of two unknown persons, of which at least one was male. The NFI put these DNA profiles in a Dutch criminal database, which provided no matches. There is no mention in their report about having the DNA profiles checked in a Panamanian database, unfortunately. None of the found DNA samples could be matched to Kris or Lisanne, using comparative samples. These comparative samples were for Lisanne hairs taken from the bathrobe she wore and from the floor of her bedroom. Investigators then used reference material from her parents to make sure it was indeed Lisanne's. For Kris the investigators used a sample of a callus file, linked to Kris. But for none of the found DNA samples to match Kris or Lisanne, that seems odd. As they most certainly touched their own backpack and belongings, but their DNA may have been washed off in the river water (and if that was the case, then the DNA of any other potential person handling the backpack before it ended in the water could also have disappeared). Betzaida Pittí 'forgot' to take fingerprints and DNA samples from the people involved in the search for Kris and Lisanne (despite the recommendation of the NFI to do so), so it was also not possible to determine whether or not the found DNA samples matched with people helping in the searches. Shocking. Not even the DNA from the couple who found the backpack was recorded and compared - although in that case there would still be the unidentified DNA of at least one other female left to identify. Local newspapers reported that the woman leading the case, Betzaida Pittí, also never further investigated these leads properly.
The NFI took samples from both mobile phones (including samplings of the edges of the SIM card, of the edges and buttons on the outside and inside of the phones and samplings of the edges of the batteries). They also took samples from the camera, from the backpack (samplings of the straps, zips and edges of the backpack) and from the two bras. No DNA profiles could be obtained from the samples taken from the phones and from the camera. Six samples were taken from both bras and one of the samples resulted in a DNA profile. Unfortunately, this DNA profile was of no use, as the NFI discovered that one of their employees had accidentally contaminated it. So this DNA profile was in fact from the NFI employee. The other five samples did not result in a DNA profile. Thirteen samples were taken from the backpack. They were taken from the straps, zippers and edges of the backpack. Only three of those backpack samples provided a DNA profile. Samplings #01 and #03 contained the DNA of two unknown women (woman A and B). Sampling #05 contained a mixed DNA profile of two unknown persons, of which at least one was male. The NFI put these DNA profiles in a Dutch criminal database, which provided no matches. There is no mention in their report about having the DNA profiles checked in a Panamanian database, unfortunately. None of the found DNA samples could be matched to Kris or Lisanne, using comparative samples. These comparative samples were for Lisanne hairs taken from the bathrobe she wore and from the floor of her bedroom. Investigators then used reference material from her parents to make sure it was indeed Lisanne's. For Kris the investigators used a sample of a callus file, linked to Kris. But for none of the found DNA samples to match Kris or Lisanne, that seems odd. As they most certainly touched their own backpack and belongings, but their DNA may have been washed off in the river water (and if that was the case, then the DNA of any other potential person handling the backpack before it ended in the water could also have disappeared). Betzaida Pittí 'forgot' to take fingerprints and DNA samples from the people involved in the search for Kris and Lisanne (despite the recommendation of the NFI to do so), so it was also not possible to determine whether or not the found DNA samples matched with people helping in the searches. Shocking. Not even the DNA from the couple who found the backpack was recorded and compared - although in that case there would still be the unidentified DNA of at least one other female left to identify. Local newspapers reported that the woman leading the case, Betzaida Pittí, also never further investigated these leads properly.
Regarding fingerprints, it was also reported in the local media that as many as 34 different fingerprints were found (later edited in the article to 12); 13 on the backpack, 12 on the (scotch tape on the) phones and 3 on the camera, as well as 6 different ones on the bras. However; the NFI investigated the Apple iPhone, the Samsung phone and the Canon camera for fingerprints and in their NFI report there is only mention of 10 fingerprints that were made visible in research: 1 on the front of the iPhone, 2 on the adhesive tape of the iPhone, 1 on the loose battery that came with the Samsung Galaxy phone, 2 on the adhesive tape on the Samsung phone, 1 on the Canon camera battery, 2 on the Canon camera housing and 1 on the adhesive tape on the Canon camera. At least one fingerprint trace could be used for identification. A 'complete profile' could be created with it of at least one person (other than Kris or Lisanne). The NFI placed it in a Dutch fingerprint database, but - probably unsurprisingly - found no match. Panamanian authorities never tried or managed to trace this person. The NFI investigator made the suggestion to Betzaida Pittí and her team to compare the fingerprints in Panama, but this was not done. Pittí failed to document fingerprints of the people involved in the searches and did not do so at a later point in time either, and there is also no mention of her and her team checking the fingerprints with a Panamanian fingerprint database. And because local police did not (always) wear gloves when handling the belongings of Kris and Lisanne, it can't even be excluded that officials were to blame for these fingerprints that were found on the scotch tape with which memory cards were attached to the mobile phones/camera.
This was also confirmed in a local report on the matter, mentioning the fingerprints found on this self-adhesive tape, of which a photograph was sent to the Panamanian prosecutor's office, which could (and should) have been checked in the Panama database. "This fact seems to have gone unnoticed by the prosecutor Betzaida Pittí, who so far has not checked the fingerprint with the locals who manipulated the objects or other possible suspects. According to the lawyer Enrique Arrocha, defense of the Kremers family, the prosecutor has not taken a statement from the people who handed over the young women's belongings to the prosecution, and neither had she collected the DNA found on the clothing and other belongings of the girls, he confirmed." It was later published in local newspaper La Estrella that one of the fingerprints found on the smartphone did match a Panamanian Database. But no updates were ever given on this however. It simply was never revealed whose fingerprints and DNA were found on the items. There is also no explanation given as to why the cellphones contained no DNA traces, but did contain at least six (strange) fingerprints. There were no forensic results presented of the water bottles either: Pittí seems to have never investigated them at all.
Botanical traces
The backpack of the girls was found in good overall condition, but it showed some white discolorations on some places on the fabric (determined to be physical signs of wear) as well as minor botanical traces of leaves and soil material. Kris' dad also shared info early on that there were some minor leaves and sand residue inside the bag. Dutch forensic experts investigated the bag after June 20th and found yellowish-brown clay on the backpack straps, the origin of which they could not determine (it was not determined if the clay came on the backpack on site or after being transported away). Inside the bag were found brown leaf fragments and green plant fragments and loose sand. Both bras were found to contain remnants of sand and of leaf and plant fragments, with the metal parts of both bras showing some slight rust. The NFI also described having found transparent plastic fragments on the black bra (from Kris). No blood traces were found on either the backpack or the bras. The Dutch forensic institute failed to determine the source of all these plant and botanical fragments for lack of reference. The NFI recommended that the specialists in Panama would take soil samples from the locations where the remains were discovered, including from the river in which the bag was discovered by Irma and her husband, and use these as reference and comparing samples. But prosecutor Betzaida Pittí decided against this and to date, there are no reports of Pittí having compared these botanical results with the vegetation at the site where these belongings from the girls were found or the surrounding area.. This is really unfortunate, as the NFI specialist specifically wrote that a reference sample for comparison is necessary when it comes to research of the soil, leaf and plant fragments that were found on the personal belongings.... The research strongly depended on the representativeness of the reference samples, something which Panama had to help with. But alas. Also interesting: I could read in the NFI files that Dutch investigators found a few traces resembling hairs in the backpack. These possible hairs were secured on a hair card and added to the backpack, but nobody ever heard anything more about this finding, or who the hairs belonged to.
The state of the backpack
Looking at the backpack once more, one of its bag straps was also partially detached as the result of a loose seam, which the NFI's fibre and textile expert attributed to "normal use" and the result of "the pulling of the seam". The plastic bag fasteners showed scratches, which are the result of them rubbing against something, according to the NFI researcher. The same is expected to be the cause of various white discolouration patches on the fabric; the colour of the bag is applied as a print and only the surface of the textile is coloured, making it relatively easy for friction and rubbing to remove part of this print and showing the white underground. There was also a rectangular piece of fabric of approximately 30 × 15 millimeters missing from the surface of the bag, with the remaining wire ends looking frayed, seemingly pointing towards damage caused by tearing, a cut, or a stitch with subsequent abrasion. The NFI researcher mentioned here that cutting or stabbing/piercing the textile often leads to straight thread ends. There was also a ten millimeter long cut in the material. The forensic expert in charge suggested here as well that the damage was caused by a sharp-edged object, but added that it is not possible to derive additional information about the nature of this sharp edge from the characteristics of the damage.. The detection of polyester urethane at the puncture site using infrared micro spectrometry also speaks for this. Polyester urethane can be used in foam for instance or in elastomers. But the researcher added in the research conclusion that the origin of this material is still unknown... I wonder if this 'origin unknown' comment means that the polyester urethane was NOT simply coming from the inside material of the backpack... Surely that would have been clear, if that were the case. So is this an foreign substance found on the backpack? While the bag was subjected to effectively knife or other sort of stabbing damage? Prosecutor Betzaida Pittí stepped in and gave her own harmless explanation. She claimed to a local newspaper that yes, the backpack had "signs of dragging". "This suggests - she explained - that the foreigners could have been pushed by one of the tributaries of the river called by the locals as "Culebra", which flows into the Changuinola River, in Bocas del Toro". Talk about trying to steer public opinion..
The backpack of the girls was found in good overall condition, but it showed some white discolorations on some places on the fabric (determined to be physical signs of wear) as well as minor botanical traces of leaves and soil material. Kris' dad also shared info early on that there were some minor leaves and sand residue inside the bag. Dutch forensic experts investigated the bag after June 20th and found yellowish-brown clay on the backpack straps, the origin of which they could not determine (it was not determined if the clay came on the backpack on site or after being transported away). Inside the bag were found brown leaf fragments and green plant fragments and loose sand. Both bras were found to contain remnants of sand and of leaf and plant fragments, with the metal parts of both bras showing some slight rust. The NFI also described having found transparent plastic fragments on the black bra (from Kris). No blood traces were found on either the backpack or the bras. The Dutch forensic institute failed to determine the source of all these plant and botanical fragments for lack of reference. The NFI recommended that the specialists in Panama would take soil samples from the locations where the remains were discovered, including from the river in which the bag was discovered by Irma and her husband, and use these as reference and comparing samples. But prosecutor Betzaida Pittí decided against this and to date, there are no reports of Pittí having compared these botanical results with the vegetation at the site where these belongings from the girls were found or the surrounding area.. This is really unfortunate, as the NFI specialist specifically wrote that a reference sample for comparison is necessary when it comes to research of the soil, leaf and plant fragments that were found on the personal belongings.... The research strongly depended on the representativeness of the reference samples, something which Panama had to help with. But alas. Also interesting: I could read in the NFI files that Dutch investigators found a few traces resembling hairs in the backpack. These possible hairs were secured on a hair card and added to the backpack, but nobody ever heard anything more about this finding, or who the hairs belonged to.
The state of the backpack
Looking at the backpack once more, one of its bag straps was also partially detached as the result of a loose seam, which the NFI's fibre and textile expert attributed to "normal use" and the result of "the pulling of the seam". The plastic bag fasteners showed scratches, which are the result of them rubbing against something, according to the NFI researcher. The same is expected to be the cause of various white discolouration patches on the fabric; the colour of the bag is applied as a print and only the surface of the textile is coloured, making it relatively easy for friction and rubbing to remove part of this print and showing the white underground. There was also a rectangular piece of fabric of approximately 30 × 15 millimeters missing from the surface of the bag, with the remaining wire ends looking frayed, seemingly pointing towards damage caused by tearing, a cut, or a stitch with subsequent abrasion. The NFI researcher mentioned here that cutting or stabbing/piercing the textile often leads to straight thread ends. There was also a ten millimeter long cut in the material. The forensic expert in charge suggested here as well that the damage was caused by a sharp-edged object, but added that it is not possible to derive additional information about the nature of this sharp edge from the characteristics of the damage.. The detection of polyester urethane at the puncture site using infrared micro spectrometry also speaks for this. Polyester urethane can be used in foam for instance or in elastomers. But the researcher added in the research conclusion that the origin of this material is still unknown... I wonder if this 'origin unknown' comment means that the polyester urethane was NOT simply coming from the inside material of the backpack... Surely that would have been clear, if that were the case. So is this an foreign substance found on the backpack? While the bag was subjected to effectively knife or other sort of stabbing damage? Prosecutor Betzaida Pittí stepped in and gave her own harmless explanation. She claimed to a local newspaper that yes, the backpack had "signs of dragging". "This suggests - she explained - that the foreigners could have been pushed by one of the tributaries of the river called by the locals as "Culebra", which flows into the Changuinola River, in Bocas del Toro". Talk about trying to steer public opinion..
The data on the mobile phones
showed that within hours after the start of their hike, the girls were in trouble. The Samsung phone could be accessed without problems by investigators, while the iPhone suffered water damage, but its memory card could be accessed in a separate device. This data of the registered mobile phone use was investigated by digital experts from the Central Netherlands Police, it was published in the report of the Dutch Forensic Institute (NFI) and it was confirmed by the lawyer of the Kremers family. The NFI determined that Lisanne's Samsung Galaxy phone had been opened prior to it being sent for investigation to the NFI (and after the backpack was discovered). No more details were published by the NFI, but this incident may link to the June 17th viewing and altering of some of the digital photos on the Canon camera, by Pittí and her team. The Dutch digital specialists used UFED Physical Analyzer, version 3.9, from Cellebrite and Encase, version 6.19, from Guidance Software for the investigation, as well as FTK lmager Lite from AccessData. Below I write down all the data. No GPS location data or coordinates of the geographical location was logged by either phone. The Dutch specialist failed to report whether both phones should have normally have GPS location data logged or not. Or whether both phones logged GPS location data before April 1st... (The specialist will probably say to this that he was only asked by Betzaida Pittí to investigate the phones for the time of their disappearance). I do find it strange though, that this case was presented by Panama to the Dutch prosecution as a kidnapping and a crime at that point in time, and yet... somebody decided that there was no need to look into these phones and into the geographical movements of these girls in the days leading up to their disappearance? If such data exists, it was not added in the NFI files.
Time zone settings and Dutch wintertime/summertime
Both the Canon camera and Kris' iPhone had their times set to the time zone Europe/Amsterdam. So Kris's phone were still set to Dutch time during her stay in Panama. The Canon camera was also incorrectly set to 2013 instead of 2014. Both devices were therefore not set to the local Panamanian time zone. Meaning the iPhone hadn’t automatically reset itself to Panamanian time when it was in Panama, something which the iPhone's operating system iOS 7.0.6 has the ability to automatically do, based on the current date and time setting of the telecommunications network of the provider to which the SIM card of the device is connected at that moment. Although Apple says on its support website that "the option to set automatically might not be available on all carriers in all countries". Another possible explanation is that Kris had deactivated this option. In any case, she did not manually reset the time either while in Panama. The Dutch digital specialist writes in the NFI files that there was a time difference between the local time in Panama (EST) and the local time in the Netherlands (CEST) of 7 hours on April 1st and after. The iPhone hád correctly adjusted from Dutch Wintertime to Dutch Summertime on March 30th, but the Canon SX270 HS camera had not. You can manually set the time and date on the Canon SX270 camera (which did not have GPS functionality, whereas the SX280 model which is almost identical in construction díd have GPS functionality..). Whereas the phone adjusted to summer time automatically. Therefore the digital specialist had to subtract 7 hours from the iPhone (photo) times to come to the correct local Panamanian time at the time of phone use, and subtract 6 hours from the Canon camera (photo) times to come to the correct Panamanian time at the time of camera use. The Dutch digital investigator verified this by taking digital photo IMG_0167.JPG, which Lisanne took at Schiphol and of an American Airlines plane. It's EXIF data showed the date of March 15th 2013 and the time of 07:17 AM. It was a known fact that Kris and Lisanne took that very plane in March 15, 2014. So the year of 2013 was determined to be set one year off. In photo IMG_0248.JPG the investigator noticed a wrist watch, which showed the time of 13:32 PM. But the EXIF data of this photo read: DateTimeOriginal - 2013:03:21 19:37:57. Even though the time is 5 hours and 57 minutes off here, the investigator deduced that the Canon camera took this photo in fact at the local time of 13:32 PM. Meaning he had to deduce 6 hours (and add 1 year) for all other Canon photos. [Unfortunately this photo was never made public and in the existing photos of Kris and Lisanne, which can all be seen here, neither of the girls ever wears a wrist watch]. The date and time of the Canon camera had to be changed manually and Kris and Lisanne seem to not have done so.
Observation: What strikes me here is how minimal the info provided is. Unfortunately it is not specified in the NFI report itself who's Wi-Fi was used for instance, or what sort of iPhone use there was until 19:07, and whether or not Kris perhaps received an incoming call while she was at Sigrids place for a massage then. And if so, who called her. This must be documented in the RAW data on those DVD's nobody had access to yet. But this appears not to have interested the digital specialist. There clearly was this idea with Dutch investigators that they mainly wanted to look at April 1st and onward. But given that this case was presented to them as a crime case/kidnapping, they should have had more interest in the timeline and comings and goings before the disappearance date. It is incredible to me that the Dutch police specialists didn't put together a much more detailed picture of Kris and Lisanne's movements on the day leading up to their disappearance and the morning of their disappearance... But on the other hand, these files do give us other insights. Lisanne used her phone pretty extensively. She used the Samsung phones gallery function, the memo app and the calendar app. Lisanne knew how to make a memo on her phone (and this is no excuse for her not having left a memo note after going missing). She had downloaded TripAdvisor and Skype on her phone. She was making a Photo-journal of her and Kris' time in Panama. She needed to use public Wi-Fi, but was not reliant on the actual computers of the language school for instance, in order to surf the net. She could take her photos on her phone, edit them in 'Gallery', use WhatsApp and Skype and SMS to stay in touch with family at home. Look up TripAdvisor, check things on Google-Maps. And all of this in light of course of the strange Phone use after April 1st...
Days before March 31st
In the NFI files one can also find information about the apps used on the Samsung before March 31st. For the period between March 15th and March 31st (so the period in which Kris and Lisanne were holidaying in Panama) they include the use of the calculator app, email, Google Talk, multimedia messages, Youtube, Contacts, videoplayer, Facebook, Google Play Store, Chrome, polarisviewer, PopupuiReceiver (on March 24th), an app which runs when mobile data is turned off. The app has to run in order to receive calls/texts/etc over WiFi only). The Hi.mijn iPhone app was activated on March 23rd; this app shows how many calling minutes, text messages and MBs you can still spend within your subscription this month. On March 30th, Lisanne also viewed the gallery app on her phone at 21:52 and 21:57 PM. On Thursday March 27th Lisanne was on her Samsung phone in the middle of the night (possibly while out clubbing in Bocas del Toro); she used the Contacts app at 03:43 AM.
Day one: April 1st. Around 16:39 PM Panamanian time, when it was still light, a first attempt was made to call emergency services on the day of their disappearance. This call was made with the iPhone, which had no contact with the GSM network at that moment. Around ten minutes later, at 16:51 PM, a second attempt was made with the Samsung phone, also without GSM network connectivity. Both times the Dutch emergency number 112 was dialed. 112 is a European emergency number that is also used in some countries outside of the EU. If needed, it automatically switches you through to the emergency number of the country you are in. It also works in Panama. But due to poor reception, these calls didn't go through. Then the phones were both powered off, at or just after 17:52 PM for both the iPhone4 and the Samsung phone. (Notice here that both phones only log certain events. The iPhone 4 for instance doesn't log whether the phone has been switched-off: just when it is powered on ("Device start-up" is visible in the lockdownd log file). While power offs were not recorded, the investigator would be able to tell from the gap in date/time when the phone was last shut-down. and then the NFI investigator deduced the power off time based on the subsequent lack of changes in the phone's file system). It took 14 hours for another attempt to be made to call emergency services. In fact: it took 14 hours for the phone to be powered on again at all. The iPhone's battery level was 42,18% by the time it was powered off at 17:52 on April 1st, and when the phone was powered on again on April 2nd at 08:12 the iPhones battery level was 42,98%. - In the days that followed, more attempts to dial emergency services were made. Not only through 112, but also by trying to call 911. That isn't only the American emergency number but also Panama's emergency number for ambulances. Neither of the phones ever made a cell network connection again after April 1st. Some more details for this first day:
The iPhone of Kris, at the start of this day, had 50,91% battery by 11:05 AM, so roughly by the time that Kris and Lisanne are estimated to have started their Pianista hike. The iPhone was at 11:05 in contact with a 2G/GSM cell GSM network, was not set to airplane mode and had a GSM reception signal strength of -82 dBm with the phone showing 5 bars connectivity. The available log files do not contain information about which cell-id this was. The iPhone was still in contact with the GSM network at 11:20, but no longer at 11:49. Even though there was still a signal strength of -82dbm mentioned, the iPhone by now showed only 1 bar connectivity on the screen, meaning that the communication was weak. By 12:33 the iPhone had regained contact with the GSM network, but there was only 1 bar indicated, indicating weak connectivity. Between 13:14 and 13:16, around the same time when Kris and Lisanne take photos with their phones on the Mirador (photo files IMG_2125.JPG to IMG_2128.JPG were created), the GSM network signal was better, with successive bars shown of 3, 4, 3, 5 and 4. These variations in reception strength may perhaps be due to movement or trees or hills obstructing the signal. By 13:38 the iPhone had no contact anymore with the GSM network and only 1 bar was shown on the screen. The NFI files give information about the powerlog file that was made for the iPhone at 13:38 and that showed the investigator that at that time the phone had no contact anymore with the GSM network.** When the iPhone tried to call 112 at 16:39, there was also only 1 bar and no GSM network connectivity: the iPhone had a battery capacity was at that moment of 42,18%.
The Samsung phone of Lisanne started this day of the disappearance at 64% battery by 00:40. It was not charged over night. The Samsung phone received Whatsapp communication at various times between 02:12 and 7:52 AM. (It is not detailed in the NFI file itself who Lisanne communicated with through Whatsapp on the morning of her disappearance; was this with someone at home - meaning that Dutch person was communicating after midnight local time - or perhaps with someone in Panama?) At 08:10 the clock app was used. Battery level was by then 60%. At 09:07 and 09:09 Whatsapp was used through Wi-Fi connection. Battery level was by then 57%. The Samsung phone used Wi-Fi (not specified in the NFI files what the Wi-Fi source was) between 09:07 and 10:10 AM. I don't know why the Dutch digital specialist does not mentioned whose Wi-Fi was used by the Samsung phone at this point, as it would be of interest for sure to know if Lisanne used the Wi-Fi of Spanish by the River for instance, or from Cafe Nelvis, to name a place... But this is not mentioned in the files. At 09:32 the Facebook app was used. At 09:38 the NOS (Dutch news) app was used. Battery level was by then at or around 55%. The internet was browsed on the Samsung phone at various times between 09:48 and 10:16 AM. Battery level was by then around 51%. At 10:16 the Google Maps app was opened on Lisanne's phone. The NFI file reports that this Maps app was last viewed at 13:14 PM. (Indicating also that it was 'last paused' at that time). By the time Lisanne had started the Pianista hike, around 11:00, her Samsung phone's battery level was at around 49%. Between 13:14 and 13:15 PM five photos were taken with the Samsung phone (on the Mirador). By 13:40 the Samsung had a battery level of 41%. As you already know, the Samsung phone was used at 16:51 to try to call 112. By 16:53 PM the Samsung had a battery level of 22%, which further dropped to 19% at 17:40 before the device was powered off at or around 17:52. The Samsung was not charged this day.
The Samsung phone of Lisanne started this day of the disappearance at 64% battery by 00:40. It was not charged over night. The Samsung phone received Whatsapp communication at various times between 02:12 and 7:52 AM. (It is not detailed in the NFI file itself who Lisanne communicated with through Whatsapp on the morning of her disappearance; was this with someone at home - meaning that Dutch person was communicating after midnight local time - or perhaps with someone in Panama?) At 08:10 the clock app was used. Battery level was by then 60%. At 09:07 and 09:09 Whatsapp was used through Wi-Fi connection. Battery level was by then 57%. The Samsung phone used Wi-Fi (not specified in the NFI files what the Wi-Fi source was) between 09:07 and 10:10 AM. I don't know why the Dutch digital specialist does not mentioned whose Wi-Fi was used by the Samsung phone at this point, as it would be of interest for sure to know if Lisanne used the Wi-Fi of Spanish by the River for instance, or from Cafe Nelvis, to name a place... But this is not mentioned in the files. At 09:32 the Facebook app was used. At 09:38 the NOS (Dutch news) app was used. Battery level was by then at or around 55%. The internet was browsed on the Samsung phone at various times between 09:48 and 10:16 AM. Battery level was by then around 51%. At 10:16 the Google Maps app was opened on Lisanne's phone. The NFI file reports that this Maps app was last viewed at 13:14 PM. (Indicating also that it was 'last paused' at that time). By the time Lisanne had started the Pianista hike, around 11:00, her Samsung phone's battery level was at around 49%. Between 13:14 and 13:15 PM five photos were taken with the Samsung phone (on the Mirador). By 13:40 the Samsung had a battery level of 41%. As you already know, the Samsung phone was used at 16:51 to try to call 112. By 16:53 PM the Samsung had a battery level of 22%, which further dropped to 19% at 17:40 before the device was powered off at or around 17:52. The Samsung was not charged this day.
**Additional info for the iPhone: This was indicated by the log line "camped_rat=Unknown" and "bars=1". Radio Access Technology (RAT or rat) refers to the underlying physical connection method used in a radio-based mobile communication network, which is essentially how devices like iPhones connect to a network over radio waves. "Camped" means that the iPhone is currently connected to and actively listening on a specific cell tower within that network, essentially staying tuned in to receive signals from that tower when idle. When the iPhone is "camped" on a cell tower, it is essentially waiting for a signal while not actively making a call or transferring data. "Unknown state" in this context means the network cannot currently identify which specific RAT a device is using, leaving its connection method unclear. It doesn't mean that is not connected, it simply cannot identify the connection method in this instance. So the investigator is informing the reader that since he does not see, perhaps, something like this: camped_rat=GSM and instead sees "Unknown", he has deduced that it did not connect to the GSM.
Controversy.
The NFI specialist did not flag this rapid and excessive Samsung battery level drop (from 41% at 13:40 to 19% at 17:40) as peculiar. Which I consider an error on his behalf. The NFI specialist neither tried to explain this remarkable battery drop, in light of there having been no background activities logged for the phone during these hours... I can see from the Samsung data in the NFI files that this phone had previously drained at a much slower rate, when not used actively. Looking at the breakdown of the Samsung's battery for the Tuesday, the drain begins at around 11.40 AM and drops fast through the rest of the day... But for the previous two days (April 1st and March 31st), the chart is showing a slow and natural battery drain. Not even Lisanne's Internet browsing for an hour uses more than 7% battery. So the one thing that comes to mind is that her phone is possibly draining power through a Tuesday afternoon searching for signal? The alarming snag here is that the (inactive) phone would be draining more power in doing so than it had used from 6:00 to 10.40 that morning. So it is interesting to see how fast the battery drained on the afternoon of their disappearance, in the absence of any phone or app activity. I hoped the specialist would have flagged and explained this professionally.
The NFI specialist did not flag this rapid and excessive Samsung battery level drop (from 41% at 13:40 to 19% at 17:40) as peculiar. Which I consider an error on his behalf. The NFI specialist neither tried to explain this remarkable battery drop, in light of there having been no background activities logged for the phone during these hours... I can see from the Samsung data in the NFI files that this phone had previously drained at a much slower rate, when not used actively. Looking at the breakdown of the Samsung's battery for the Tuesday, the drain begins at around 11.40 AM and drops fast through the rest of the day... But for the previous two days (April 1st and March 31st), the chart is showing a slow and natural battery drain. Not even Lisanne's Internet browsing for an hour uses more than 7% battery. So the one thing that comes to mind is that her phone is possibly draining power through a Tuesday afternoon searching for signal? The alarming snag here is that the (inactive) phone would be draining more power in doing so than it had used from 6:00 to 10.40 that morning. So it is interesting to see how fast the battery drained on the afternoon of their disappearance, in the absence of any phone or app activity. I hoped the specialist would have flagged and explained this professionally.
The iPhone of Kris. At 08:14 the iPhone had a battery level of 42,98% then, so slightly higher than its battery level around the time when the iPhone was powered off the day prior. Phone batteries can slightly recover itself after being turned off and remaining in idle mode for a while, which probably explains this. So the iPhone of Kris was powered on at 08:12 on April 2nd and right away the log data shows that the iPhone was then manually switched from 2G-network to 2G+3G-network, via the settings of the mobile network. Perhaps this was done by whomever handled the phone at that moment to increase the possibility to get a network connection. Right after that, at 08:14 AM, the emergency number 112 was called with the iPhone. There was no connection with the GSM network at that moment and only 1 bar visible on the phone's screen. The strength of the GSM signal was "-113dbm", which represents the lowest possible value. Dutch officials also determined that Kris changed some settings on her phone by 08:14 AM, allowing its control panel to be used without the need to first enter PIN codes. The phone's control center was opened and a feature got activated that allows someone to swipe in order to access the system and applications from a control panel, so without having to enter an unlock code. It requires quite a few (I'd say intricate) steps. It is not known if Kris herself did this, or somebody else (reminder: Kris had not even set her phone's time correctly, and neither girls used the Canon camera to its abilities, sticking to the automatic setting). The now enabled control panel feature made it much easier for anyone to access the iPhone, especially for those who did not know the phone's PIN and SIM codes, or who could not remember them. The Samsung phone never needed a PIN/SIM code for access to start with. While doing this action to the control panel, a screenshot photo was made from the telephone screen. The operating system apparently automatically takes a screenshot of this action when closing this Control Panel, showing the control panel configuration screen - the setting that was last selected. It appears as if the person handling the phone wanted to make the iPhone easier and quicker to access and handle. But at 8:14 AM the iPhone was turned off and was not used again for the rest of the day, implying the person handling the phone was planning further ahead..
The Samsung phone of Lisanne. At 06:58 someone tried to call 112 with the Samsung phone of Lisanne. The call failed and just under a minute later the phone was powered off again. It had 19% battery. At 10:53 PM someone tried to dial the emergency number twice with Lisanne's Samsung phone; first the Dutch number 112, then 20 seconds later the Panamanian number 911 for the first time. The phone had 19% battery at that point. Seven seconds later the Samsung was powered off again. At 13:50 PM the Samsung was only powered on and powered off again, without making a call. It had 18% battery by then. At 16:19 PM the Samsung phone was powered on (it had still 18% battery life then) and this time the phone was left powered on. At 16:45 the Samsung phone had 16% battery. At 17:52 its battery dropped to 15%. By 20:15 battery had gone down to 13%. At 20:58 it was 12%, at 21:40 it was 11%, at 22:23 it was 10%, at 22:44 at 9%, at 23:05 at 7%, at 23:26 at 6% and at 23:47 the Samsung phone had still 6% battery left. The Samsung phone was then also left powered on all through the night of April 2-3. It was left powered on for over fifteen hours straight in fact.
The Samsung phone of Lisanne. At 06:58 someone tried to call 112 with the Samsung phone of Lisanne. The call failed and just under a minute later the phone was powered off again. It had 19% battery. At 10:53 PM someone tried to dial the emergency number twice with Lisanne's Samsung phone; first the Dutch number 112, then 20 seconds later the Panamanian number 911 for the first time. The phone had 19% battery at that point. Seven seconds later the Samsung was powered off again. At 13:50 PM the Samsung was only powered on and powered off again, without making a call. It had 18% battery by then. At 16:19 PM the Samsung phone was powered on (it had still 18% battery life then) and this time the phone was left powered on. At 16:45 the Samsung phone had 16% battery. At 17:52 its battery dropped to 15%. By 20:15 battery had gone down to 13%. At 20:58 it was 12%, at 21:40 it was 11%, at 22:23 it was 10%, at 22:44 at 9%, at 23:05 at 7%, at 23:26 at 6% and at 23:47 the Samsung phone had still 6% battery left. The Samsung phone was then also left powered on all through the night of April 2-3. It was left powered on for over fifteen hours straight in fact.
Controversy - April 2nd was also the only day when one of Kris and Lisanne's calls apparently made a short connection at 13:50 PM. *The official police files do not mention this important detail that Lisanne's Samsung phone managed to make a connection with 112 for 1 to 2 seconds, but this leaked phone log from a local Panamanian newspaper (La Estrella de Panamá) does, they say it happened at 13:56.. They also based themselves on police files at the time and have all the other details correct.. I do not know if they are correct or not about this connection however, but I will keep it up here with a source link. Translated: "1:56 PM - The phone turns on. Call to 112 for help in Holland and 911 in Panama. It connects to the GSM and then shuts down." And in this local article that leaked the phone log data, it is stated: "on some occasions the devices managed to connect to the GSM or mobile communications system [..] according to the forensic reports of the Dutch Institute." Then the phone was powered off. If true, it is not clear why exactly the call was disconnected; probably because the connection was too poor, or possibly because the connection was broken off by someone. But then this someone also purposely switched off the phone shortly after. It appears that this media information was incorrect. In the NFI files, the Dutch digital specialist writes that the Samsung phone was simply powered on and powered off again at 13:50, without making a phone connection to emergency services.. Between the last call of day 2 and the first call of day 3 sit 22 hours.
On day three, April 3rd of their disappearance, on Thursday, the Samsun phone from Lisanne has been powered on throughout the night. At 00:04 the Samsung phone had 6% battery left. At 02:21 AM the Accuweather арр was opened for 13 seconds on the running Samsung phone and then closed again. This may perhaps be linked to some mild rain that fell in the area at the time. But the phone was not powered off, despite having been on for 10 hours and 2 minutes straight at that point. The battery level is then 5%. Then at 02:46 AM applications of the Android OS were used for 41 seconds, but it is not specified which ones. At 02:47 AM an Android app launcher is started and it keeps running until 07:36 AM. The Samsung phone had 4% battery left by 04:18 AM, 2% by 05:33 and 1% by 06:18 AM. By 07:20 AM the Samsung had still only about 1% battery left and the device was most likely (manually) switched off by then, around 07:36. The Samsung had not been connecting to a mobile network nor to Wi-Fi and there were no logs of it having been connected to a charger. The iPhone of Kris. At 09:32 the iPhone4 was powered on and 911 was called twice at 09:33 AM. The iPhone had no contact with a mobile network and the calls did not go through. The iPhone had battery capacity at the time of 41,62% Then the iPhone was powered off right afterwards. When the caller screen was closed manually, an automatic screenshot was taken ("DefaultDialer-Portrait@2x.png"). Such a snapshot can be created by the iPhone when someone closes the application (the dialer screen here). At 09:33 the iPhone was powered off. At 11:47 the iPhone was powered on and then powered off again. At 15:59 PM the iPhone4 was powered on and at 16:02 the address book on the phone was opened and the contact “Mytiam, 00 507 679xxxxx” was looked up on WhatsApp (this is not a typo). The number corresponds with host mother Myriam's phone number. A screenshot generated when the dialer screen is closed shows this contact "Mytiam" and her corresponding phone number. But the number was not actually dialed and there was no contact with a telephone network. (It is clear from this screenshot that it is indeed the Contacts page someone looked at and that this someone then closed the App, judging by the fact this page was saved by the phone in the background. If someone had tried to message or dial Myriam then the message- or dial page would have been the screen that was saved in a screenshot. So someone is refusing to either write, or dial...). Then the phone was powered off at 16:02 PM with 39% battery capacity remaining. Interestingly enough, this was the last time the iPhone logs indicated the iPhone's battery levels. After this moment there was no more information logged about the battery status. The Dutch digital expert wrote about this in the NFI files that "Mytiam" was the last (and possibly only) contact that was checked before the application was closed. And that it seems very likely to him that this happened as a result of deliberate action by the user of the phone.
Controversy - So someone has watched the Samsung's power ebb away since yesterday afternoon. By 7 AM it is finally all but spent, with 1% battery left, and the wording from the Dutch digital technician seems to show he believes the phone was manually powered off, rather than from an automatic power-down due to the battery failing... An automatic power off would also have been logged. Call me cynical, but the battery conservation theory used by both this Dutch digital guy as well as those believing this was just a case of Lost/Accident... is surely obliterated by this single ongoing action by either Kris or Lisanne. Why wear down the strongest link to the outside world? We could see in all of Lisanne's usage of the Samsung on March 30th and 31st, that her phone was literally the extension of herself and her connection/lifeline to the outside world. So why would Lisanne run down her Samsung phone's battery on day 2 of their disappearance? With Lisanne presumed to have been still alive at this point. Why would she drain the Samsung with all the intimate data on it to help her? Just so that she can now depend on the iPhone, for which she had to recall two passcodes? The fact that the NFI guy nevertheless seemingly deems this behaviour rational and fails to flag it as a point that needs exclamation marks is highly disappointing. It makes zero sense in an Accident/Lost scenario.
We know from supreme sleuth Power-Pixie's extensive testing of the iPhone and the Samsung phone that these lightning fast switch ons and offs (some under one minute) would not have given the phone enough time to properly load the main screen, and arguably neither to do a signal check. From tests it was demonstrated that the timing between switch-on, entering a SIM code, and switching off, took just under two minutes for the iPhone. If this technician's estimate of roughly 1-minute switch-ons is correct, then the person handling the phone is barely even getting the time to glance at the main screen before switching the phone off. It seems someone doesn't want this phone on any longer than absolutely necessary. So the question arises at this point what these strange, short powering on and off's of the phone actually achieved? The NFI investigator seems to think that this may have been done to slightly boost battery life.. But boosting battery life for what? The person(s) handling the phone(s) did nothing with the phones that could have helped them, let alone save them, after April 4th.
Odd. Unlike with the iPhone of Kris, we don't see any evidence the Samsung had its settings altered; no upscaling to 3G for example. Someone very intentionally altered the settings of the iPhone to make it more simple to access. Maybe this hints at this person planning on using the iPhone primarily in the future? It does not seem logical, but what is done to the Samsung phone subsequently isn't logical either. Because then the person(s) switched to using the Samsung for the rest of the day. Seemingly deciding to empty its battery..? (And it does sometimes feel to me like only one person is handling both these phones at this point). After draining the Samsung's battery overnight (we know someone was awake between 02:21 and 02:46 at the very least, as apps were used on the phone during that time), the person(s) moved to the iPhone and it is a mystery why the Samsung was left powered on for a whopping 15 hours and 17 minutes while its battery drained away and not a single call attempt was made. No draft messages were made either, no photos were viewed on the phone, no video was recorded. Nothing, except for a short weather app activation and an unspecified Android app launcher running in the background. I do not understand why the NFI specialist did not further specify which app this entailed. Then on Friday the Samsung is quickly drained of its last 1% of battery by powering it on and off twice. And that was it for the Samsung :(
On day five, April 5th, Saturday, the iPhone4 was powered on and off at 10:50 AM. This was the last time the SIM PIN** was entered correctly. From then onward, the wrong PIN code or no PIN code was entered. Until then the phone had successfully received both a SIM pin (0556) and a login PIN to unlock the screen. The SIM PIN code is linked to the SIM card and only needs to be entered when starting up (power on) the device, if this is set up that way. This is a different code than the device code or 'swipe code' that needs to be entered every time the device is locked, if this is set up that way. So the iPhone 4 from Kris has to be unlocked every time with a 4-digit device security code (0556) and then afterwards the SIM PIN code has to be entered. (Apparently this first code needs to be entered in order to be able to see information such as the phone's signal strength). If entered incorrectly, the phone will be blocked ultimately. This code entering happened correctly until April 5th, 10:50 AM. The Dutch digital specialist could only see in the phone logs when the SIM PIN code was entered correctly, not when it was entered incorrectly or not entered at all. At 13:37 PM the iPhone4 was powered on and off, but the SIM PIN code was not entered correctly. Meaning (with the minimally available logged info) that the SIM PIN codes were either not entered, or not entered correctly (this cannot be determined). The Dutch digital specialist described it as "the failure to enter the PIN". But whoever entered the SIM pin not/incorrectly must have known the Login pin to unlock the phone. Whomever entered these incorrect PIN codes failed to activate the phone, but in theory phones can still make emergency phone calls then; there is just no access to the phone data itself.
Samsung. For the Samsung phone the Dutch digital specialist found a file with the name usage-20140405 for April 5th. (Despite the Samsung's battery hoovering at 0%). At 13:14 PM a log file was created on the Samsung, which is only possible if the phone had power. However, the phone's files don't show a log for the Samsung powering up. This file contained no data and was supposedly opened/ created/ modified at 13:14 PM. It was the only file with a timestamp on April 5th 2014 and the only file visible since the Samsung was last powered off at 05:00 AM on April 4th. The specialist himself does not seem to understand either what this file is or if it really meant the Samsung had been opened. Or whether the device was still switched on on 5 April 2014.
**Additional info, thanks to Power-Pixie: Each time the iPhone is switched off and on, someone is required to enter the passcode and SIM PIN. You have the option to turn off the SIM PIN and also the passcode. Turning off the passcode however compromises your phone in a major way. Both codes being turned off would generate an event in the logs, as this is an explicit security event that would log various information of the turning off of these two code. To add or remove apps to/from this Control Panel, you have to:
1. Enter passcode
2. Go to Settings -> Control Center
3. Add or remove whatever apps you want to control from the Control Panel when you swipe up the screen at the passcode screen to access it.
On day six, April 6th, Sunday, at 10:26 AM the iPhone4 was powered on. The SIM pin was not entered or not entered correctly. An automatically generated screenshot ("UIApplication-AutomaticSnapshotDefault-Portrait@2x.pn9") was created at 10:27. It shows that the clock application page was used, showing the world times of Amsterdam, Panama-City and San José. The screenshot may have been taken when the person handling the phone closed this clock application. The user of the phone had access to this clock application directly from the access screen, without first having to enter the device code or 'swipe code'. (So someone entered the Clock App, went to the 'Worldclock' page, despite Kris' phone already showing Amsterdam time on her main screen anyway. Which makes you ask what someone is doing entering this particular page?). At 10:27 the iPhone was powered off again. At 14:35* PM the iPhone4 was powered on and off without a correct SIM/PIN code. 14:35 is the corrected time; Dutch NFI professionals/digital specialist officially wrote 13:37 down as the time, for a second day in a row. This has created a lot of attention and debate over time, because what are the odds really of powering your phone on 13:37 exactly, twice, without having access to a clock or a watch in the supposed jungle? But the authorities eventually cleaned this odd detail up years later, as being a presumed human error in the (NFI) case file. It will be April 11th, so five days later, that the iPhone is powered on next. It still has some battery life left at this point. On day seven, eight, nine and ten, no activity of either phone could be found. However, the Dutch digital expert did report that there were logs on the Samsung phone for 2 Whatsapp files, with a time stamp on April 10th: [root]\data\com.whatsapp\lib\whatsapplib.so and the file [root]\data\com.whatsapp\lib\libqcom.so. But there were no other files or registrations found on April 10, 2014, nor any indications that the Samsung phone had been powered on that day. The Dutch digital specialist wrote that he found that these files did not contain relevant data and were modified on April 10th at 05:15 AM. He also didn't find any other files that had been created/ opened/ modified between 13:14 PM on April 5th and April 10th. He could not determine whether both files were actually changed on April 10th and whether the device was still switched on on April 5, 2014.
Observations: The two .so files are interesting. As I understand now, they are "shared object files" that Android WhatsApp, or any Android app uses, and that allow the app to utilize high-performance functions from the operating system or external libraries. Not only WhatsApp using these files, though WhatsApp may have been left active as these two files became active. The question is (not answered in the NFI files by the digital specialist...) if this means that something on the Samsung or if someone was trying to use the phone on April 10th? With the dead battery having just enough spark to leave these strange readings? Or was this more of an independent tech spasm at a time when the Samsung phone's battery was emptying completely? - It is also interesting that we know that on the night of April 8th, around 90 nighttime photos were made by someone. But this person did not activate or use the phones then. It had been merely between day four and six that there was a specific pattern of daily times when the phones were switched on and off. The iPhone from Kris was however switched on and off until day eleven, April 11th, which seems a long time for a smartphone (anno 2014), battery wise. Especially considering Dutch Forensic investigators have confirmed that both the phones had only 51% and 49% battery life on day one, by the time the girls walked up the Pianista Trail at 11:00 AM. Even though the phone was not used on days 7-9, phones even lose a certain amount of battery life when they are switched off.
Observations: The two .so files are interesting. As I understand now, they are "shared object files" that Android WhatsApp, or any Android app uses, and that allow the app to utilize high-performance functions from the operating system or external libraries. Not only WhatsApp using these files, though WhatsApp may have been left active as these two files became active. The question is (not answered in the NFI files by the digital specialist...) if this means that something on the Samsung or if someone was trying to use the phone on April 10th? With the dead battery having just enough spark to leave these strange readings? Or was this more of an independent tech spasm at a time when the Samsung phone's battery was emptying completely? - It is also interesting that we know that on the night of April 8th, around 90 nighttime photos were made by someone. But this person did not activate or use the phones then. It had been merely between day four and six that there was a specific pattern of daily times when the phones were switched on and off. The iPhone from Kris was however switched on and off until day eleven, April 11th, which seems a long time for a smartphone (anno 2014), battery wise. Especially considering Dutch Forensic investigators have confirmed that both the phones had only 51% and 49% battery life on day one, by the time the girls walked up the Pianista Trail at 11:00 AM. Even though the phone was not used on days 7-9, phones even lose a certain amount of battery life when they are switched off.
So after a five-day break, someone was busy on April 11 with the phone for 65 minutes. But we don't know what phone services were used. As super-sleuth Dave M. describes it: "Someone activates the Phone and leaves it on for an hour, there has to be a reason for that, but whatever this person is doing in this time the log isn't capable of registering it". "It might be an attempt to drain the battery, but for whatever reason, when they see it is retaining power longer than expected they abandon the idea." - That may be an explanation perhaps for that weird last hour long activation of the iPhone on April 11th.. Something was done with it during that hour, but the NFI guy could not make cheese of that either, unfortunately.. The experts virtually rule out the possibility however that the file manipulation could have been caused by an automated process. Someone must have operated the cell phone. Or have the investigators/prosecutor Pittí/someone else messed with the log files somehow? The Dutch digital specialist also tested on a similar iPhone device whether or not Kris' iPhone may have powered itself off on or after April 11 due to low battery. But this cannot have been the case. If the iPhone 4 had automatically shut itself down due to low battery voltage, a so-called "plist file" (.plist) with the file name "LowBatterylog" would have been created in the logs on the date and time of automatic shutdown. The Dutch digital specialist found no such file for April 11 or a later date. He did find such a plist file for March 24, 2014, showing that the iPhone of Kris functioned normally in that respect. Therefore the digital specialist concluded that an automatic shutdown due to low battery could NOT have been the reason why the iPhone was ultimately powered off with an estimated 22% battery left. (There are a total 6 log files however that can get written to when looking at battery information; 1 on the iPhone (iOS) and 5 on the Samsung (Android). So we don't know if this investigator could see any of these files as he mentions a log file called "LowBatterylog", or if he looked at anything else to come to his conclusion which we don't know about).
************
The NFI report on the telephone data analysis was unfortunately having some errors (think of the 13:37 time duplication error), but it also "appears incomplete and selective overall" according to authors Hardinghaus and Nenner, who had copies of the files and did a thorough and scientific analysis of them. And I have to agree with them. having read the files myself now, I can say that the Dutch digital specialist at times made too many unwarranted detective-style assumptions. I am surprised that the NFI was told in an introduction letter by the Panamanian prosecutor that they considered the disappearance of Kris and Lisanne an "offence of deprivation of liberty". So by mid June 2014, in Panama's view this was a kidnapping case... I always assumed that tour guide F. influenced Betzaida Puittí and that it were the Panamanian investigators who pushed for this case to be seen as an accident. But this came later. It was in fact the Dutch forensic and prosecution team who first interpreted the forensic research in a very one-sided manner. Both the NFI, their digital specialists and Frank van der Goot. Everything was automatically interpreted in an Accident light and only in an Accident light. Think of the unusual use of the phones as well as the discontinuing of the entering of the correct SIM PIN numbers: none of that swayed the digital specialist, or even tempted him to suggest more than one interpretation: these were Kris and Lisanne out there, trying to 'boost the phone's battery'. I find this shocking. The fact that the Dutch nowhere leave the explicit option of an actual kidnapping or crime open is the most shocking thing to me of this entire NFI file. - Although we know that the mobile phones did not log events religiously and were pretty irregular in what they did log (powering on of phone for instance) and didn't log (powering off of phone, for instance). Notice that after Tuesday April 1st, 13:00, the two phones are never used at the same time. While at the same time, both phones are used in similar fashion: very briefly powering them on and then off again within a 1 to 2 minutes timeframe. These incredibly brief switch on and off's are identical for both phones. This combined makes it plausible to believe that one person was using both phones. Something which the NFI investigators seem to completely miss, or fail to mention.
NFI BIAS
So, from 13:37 PM on April 5th onward, the iPhone of Kris was activated four times without entering the SIM PIN codes, or by entering the wrong codes. But there are purposeful actions in the phone logs, such as the swiping of the telephone screen and the opening of its control panel. The Dutch digital specialist concluded that he cannot think of any technical reasons for this to have happened, but that he in fact believes that the reason for this changing of the login patter is due to a purposeful decision to do so by the person handling the phone. "A user who did not know the SIM PIN code". Given that Kris is the one who had until then unlocked her own phone, he assumed that it continued to be Kris who handled her iPhone after April 1st. The Dutch digital specialist noted that the correct entering of the SIM PIN code each time the device was started, from 1 April 2014 up to and including the morning of 5 April 2014, was a continuation of the normal usage pattern of the iPhone in the period before Kris Kremers went missing. He saw this as actions by a user who had good knowledge of the SIM PIN code. In other words: Kris herself, or perhaps Lisanne. I think this may sound logical, but that the Dutch digital specialist should have kept an open mind and should also have left open the theoretical option that another person tried to get access to the iPhone by April 5th. A user who did not know the PIN code. It may even be possible theoretically that all these attempts to call emergency services were mostly done by a 3rd party altogether, to create a fake trail and to drain the phone battery, for instance. More on all that later. Also, with the security code feature already having been disabled on the morning of day 2 (Wednesday April 2nd), all the person had to remember was in fact one SIM code. The fact that a 3rd party theory is not even mentioned once in the entire NFI file, makes me really think that these investigators were set in their Lost 'logic' early on, at a time when Pitti herself was still calling this a kidnapping.. Not even when the technicians found the missing file 509 vector on the camera and noticed the lack of GPS and Cell tower tracking from Panama, did this open the door with them for a critical footnote. My impression from having had access to these NFI files, is that the NFI cast the kidnapping indication aside and immediately worked on the basis of an Accident. There is not a single explicit indication that the Dutch digital specialists were willing to contemplate a crime angle when analysing the phones/camera data.
The Dutch digital specialist also leans towards only one specific possible explanation of these short powering on/powering offs of the phones, namely that this was done to slightly boost the battery life. (I think this is only one of several possible explanations of this strange phone use though, and that the Dutch digital specialist already shows some mild bias by writing only this down as a possible explanation). But it is clear that this investigator was himself often limited by the two phones' own limitations: not a whole lot was being logged on these phones. For instance, the Dutch digital specialist often had to make an educated guess about when the iPhone was 'probably' switched off, as the phone didn't log an actual switch-off. Wi-Fi SOURCE WAS ONLY ONCE SPECIFIED
There was also an unexplained lack of GPS data and Wi-Fi source logged. The Dutch digital specialist detailed only once in the entire NF files what Wi-Fi source was used by Kris and Lisanne: on Monday March 31st the NFI records that Kris' iPhone connected to the Wi-Fi of Spanish by the River. And this is the only Wi-Fi specification in the entire NFI file. Even though the specialist writes about many more internet use events, he never specifies the Wi-Fi source for any of those sessions, other than this one. I truly had expected to see in these files whether or not they used Wi-Fi at Miriam's place or not... Or whether or not they used public Wi-Fi in cafes in Boquete. But we still don't know how they connected to the internet throughout their stay in Boquete, or while staying at Miriam's place (such as in the early morning, clearly before leaving the house). So were these phones just really lame and sketchy with logging such data? Or did the Dutch digital specialist not bother to write this all out? Or did he leave important details about Wi-Fi use out of the report deliberately?! (Was the NFI perhaps asked to redact this information or provide the least bit of explanation? Leaving it vague?) We can only guess at this point. But the fact that the iPhone logged the name of the Wi-Fi of Spanish by the River is enough evidence to prove proves that Wi-Fi router names were in fact logged by the phone. It is not known however why this Wi-Fi router name is not logged more often for Kris's iPhone or Lisanne's Samsung.
AIRPLANE MODE OR NOT
There was also a sketchy logging of airplane mode being activated or not. For the iPhone it is said explicitly in the NFI files that airplane mode was not activated, but for the Samsung phone of Lisanne there is no such data. Log lines in the files such as "wifi_enabled:"true". wifi_connected:"false" for April 1 onward however seem to indicate that Lisanne's phone was not set to airplane mode either. As Airplane mode being turned on will shut off everything, including the Wi-Fi option on the phone. Power-Pixie noted that this is another clue that Lisanne (or whomever else handled that phone) was not interested in saving her phone's battery, or else she would have turned off the Wi-Fi option. "Because you cannot move the goalposts and state that they were brilliant in boosting signal, but were foolish to not turn off Wi-Fi while "lost in the jungle"." Power-Pixie experimented extensively with the same phone models which Kris and Lisanne possessed, and he did a lot more testing than the Dutch digital specialist did. Power-Pixie showed for instance that with the iPhone, after pressing the power button down it then takes at least 30 seconds for the interface to boot and load and for the main screen to appear. That's quite a long time. To then unlock the control panel or access the SIM, takes at least another ten seconds as you tap in the number and the phone unlocks. So again this is time consuming - at least ten seconds for accessing the control screen, and then at least another ten seconds to unlock SIM.. This makes the super short powering on and offs of the phone interesting. Just like it makes it peculiar that on April 3rd a screenshot is made during such a very short power on/power off event, showing that the contact "Mytiam" was opened. It may very well mean that the person handling the phone had the intention to check Myriam's number.
QUICK ACCESS FEATURES THAT WEREN'T USED
Also, the Dutch digital specialist described how the user of the phone had access to the iPhone's clock application directly from the access screen, without first having to enter the device code or 'swipe code'. This brings up thoughts about whether there also was such easy and quick access to the Camera and Video functions of the phone? Given that the iPhone had battery life left even when it was last powered off, does this mean that right up until the 11th of April, this person could have taken pictures with this phone, made a video or voice recording, written a message in the 'Notes' function, and easily used the 'Torch' function? Why was none of this done? (The Samsung phone would have logged the use of 'Assistive Light', which was not the case according to the NFI files). We know none of this was done, as there were no phone logs for any of these actions. Why not? - As for Lisanne's phone, Panamanian investigators initially incorrectly listed the Samsung as having Password requirements, but the Dutch digital specialist subsequently found this was not the case. Lisanne's phone did not need a PIN code to operate it. There seem to be detailed logs lacking for her Samsung phone as well. - I also wonder why no mention is made by the NFI in their NFI file about this (by now admitted) June 17th viewing of the phones and camera by Pitti and her team? OR of the photoshop date of June 17th, which was visible in the EXIF data of various night photos.... Very very strange that this isn't mentioned or noted at all by the forensic experts of the NFI. Just like it's a little frustrating to think that the two phone's call logs should have shown whether Marjolein called one of them on Monday evening, for instance. And once switched on and reconnected to signal on April 17th, did any 'missed calls' from SbtR (Eileen) show on the call logs? It feels like the NFI purposely left out the full call logs.
Also, the Dutch digital specialist described how the user of the phone had access to the iPhone's clock application directly from the access screen, without first having to enter the device code or 'swipe code'. This brings up thoughts about whether there also was such easy and quick access to the Camera and Video functions of the phone? Given that the iPhone had battery life left even when it was last powered off, does this mean that right up until the 11th of April, this person could have taken pictures with this phone, made a video or voice recording, written a message in the 'Notes' function, and easily used the 'Torch' function? Why was none of this done? (The Samsung phone would have logged the use of 'Assistive Light', which was not the case according to the NFI files). We know none of this was done, as there were no phone logs for any of these actions. Why not? - As for Lisanne's phone, Panamanian investigators initially incorrectly listed the Samsung as having Password requirements, but the Dutch digital specialist subsequently found this was not the case. Lisanne's phone did not need a PIN code to operate it. There seem to be detailed logs lacking for her Samsung phone as well. - I also wonder why no mention is made by the NFI in their NFI file about this (by now admitted) June 17th viewing of the phones and camera by Pitti and her team? OR of the photoshop date of June 17th, which was visible in the EXIF data of various night photos.... Very very strange that this isn't mentioned or noted at all by the forensic experts of the NFI. Just like it's a little frustrating to think that the two phone's call logs should have shown whether Marjolein called one of them on Monday evening, for instance. And once switched on and reconnected to signal on April 17th, did any 'missed calls' from SbtR (Eileen) show on the call logs? It feels like the NFI purposely left out the full call logs.
FALSE CLAIMS
Two Dutch authors on the other hand, have amateurishly and falsely written and claimed that a second SD card was found with the Canon camera and the phones. They believed at the time that they were the only ones with copies of the case files and they used this invented second SD card to try to explain away the missing file #509 in a way that did not make Betzaida Pittí or anyone else suspicious. They also mistakenly claimed that a second phone battery for the Samsung phone of Lisanne was found in the backpack, But we now know that the local policeman who first made a written inventory of the backpack and its content, right after it was brought in around June 13th, did not write this info down. No second SD card or battery was reported, neither by the Dutch NFI, and nowhere in the phone log info shows it anywhere that Lisanne replaced her phone battery with a second one. Also, there were no unsent text messages found in their phones and no 'goodbye' messages in any shape or form, which the Dutch duo also cruelly suggested. This was confirmed by Dutch investigators and the parents. The NFI forensic experts did not find a single explanatory word, message or draft on either the cell phones or the camera. The Dutch authors also wrote that on Tuesday April 1st, Kris and Lisanne used the Wi-Fi of Cafe Nelvis, before embarking on their Pianista hike. This is nowhere written in the NFI files however. I have no idea where they got this info from, and since these authors refused to write down any professional source links or even explain where they got controversial info such as this from, we just don't know. Meh.... Unfortunately, the writing Dutch duo has tried to sensationalize things and has insinuated that a (conveniently) anonymous cop has seen attempts of the girls to send text messages after they went missing, which is also made up and incorrect. The investigators who checked the phones, the case files and the parents and their representatives have all and always confirmed that no text messages were found, drafted or attempted to be written or sent by Kris and Lisanne. Luckily reliable people have since published thee real case facts and I summarize and write out every case fact in a comprehensive matter for you, in this blog series.
So summarized, the phone logs (which we just have to trust to be correct and complete, although we cannot be 100% sure of that even) show that the phones of Kris and Lisanne only called 112 and 911 during the first three days of their disappearance. No further attempts to call 112 or 911 were made again after day 3. Check part 4 of my blog series for more details about the specific phone use on April 1st, including apps that were used.
77 attempts to get into the phoneAccording to some sources, no less than 77 attempts to get into the phone were made between the 7th and 10th of April. Others claim that the wrong PIN code was entered that many times. In this news article, former detective Dick Steffens has been quoted in that there were 80 attempts to log in on the phones of the girls. Wikipedia states [at the moment that I write this] that 77 actual emergency call attempts were made between April 7-10. However, according to others these '77 times' could also refer to the amount of times someone just tried to activate the phone. Matt had access to the police files and revealed in March of 2021 that the info about the 70-something attempts to enter the SIM pin in Kris' iPhone4 was measured over a much longer time period: from March to April. Therefore it is not relevant for the situation after April 1st, he says. I now understand myself from the NFI info that these "70-something times" that the SIM PIN codes were not entered correctly in the iPhone of Kris, do indeed count for a much longer period, and not for the weeks in which Kris and Lisanne were missing. The NFI investigator has been misrepresented in the media it seems, and in fact discovered that Kris Kremers' iPhone had been started up (powered on) 74 times since July 31, 2013, of which 70 times the PIN code had been entered correctly each time and that the PIN had only four times not been entered or had been entered incorrectly: and those four times all all occurred after April 5, 2014, 13:37 PM. So this was not something Kris was in the habit of doing.. (Although truth be told: I don't understand this NFI file information.. Isn't that very few times to power on a smartphone for that long a time period?)
I found out where exactly this "77 wrong attempts" statement came from (aside from wikipedia stating it). In this episode from RTL Late night, on October 1st 2014 - unfortunately no longer playing for some reason -, presenter, Humberto Tan discussed the case again with Independent Criminologist Dick Steffens. Tan had already covered this disappearance case of Kris and Lisanne in multiple shows by then. You can find a selection of them, translated, on my youtube case-playlist. Humberto Tan asks the parents in this TV episode if they have any questions, to which the father of Kris, Hans Kremers, asks right away, at the 4 minute mark: "That for 4 days there were logins with the correct PIN code, and then for 4 to 5 days there followed attempts to login with the wrong PIN code." Then presenter Humberto Tan says that there were 80 attempts to get into the phone between April 6-10 without or with the wrong PIN code. Nobody at the table corrects him on this. Not the investigator who starts talking afterwards, not the parents. So this is where viewers took this detail for the truth. On forums some people thought that Humberto referred perhaps to the 70 nighttime photos made. Which argument didn't convince much as there were over 90 nighttime photos and not 70. But three days after this TV show, the (160 pages long) report of the Dutch Forensics Institute (NFI) was published and they stated that there were 4 attempts to get into the phone with the wrong PIN code. However, not everybody will automatically trust all the information in this official report. It were the Panamanian officials who first handled the phones and checked their data, before sending them to the Netherlands. Just like Pitti's Panamanian team were the first to read out the Canon camera that was found. Unfortunately they made some changes to the photos on the memory card. More about that later. This is why manipulation of the phone and camera data cannot be ruled out 100%. Others may have handled those devices before them. It is incredibly easy to manually change the time and date in such phones, then make call attempts and afterwards restore the right time. And so change the whole narrative with incorrect log data. Nobody expected at the time that one day, half the world would be eagle-eying the details of this case. People go missing all the time, and their files end up on a big pile usually. Please note: For the iPhone 4 running iOS7, which was on Kris's phone, six failed attempts gets you a one minute lockout. Seven failed attempts gives you a five minute lockout, eight gives a fifteen minute lockout, and nine failed attempts a full hour lockout. After ten failed attempts, the system will either lock you out completely or erase your data, depending on your settings. Once locked out, you will need to sync with iTunes to restore things. Based on the phone logs, that did not happen.
Smartphones have Emergency Call on the lock screen nowadays and also already in 2014
so I wonder why someone was trying so hard to unlock the phone. You should be able to contact emergency services without unlocking the phone if there is cell phone reception. Maybe a third party wanted access to the phone, and not just to call emergency services but to see what was stored inside the phone, such as photos or messages. Maybe Kris was incapacitated and Lisanne had not memorized both her friend's PIN codes in advance, but still tried to gain access to the iPhone. Or perhaps both the girls got confused, forgot half their codes, but wanted to send a text message suddenly (although.. why didn't they do so the first four days then..?). They are claimed to have connected to emergency services once for over a second before the connection dropped, so maybe if they had tried to send a text message and let it pending, this short connection would have been enough to send it, and we could have had some clues now about what happened. Cell phone text messages may go through even when there appears to be no signal, in part because text messaging is a store-and-forward service. Lisanne's parents stated in the press that they communicated with their daughter mostly through whatsapp and SMS text message. Both Kris and Lisanne kept a diary, so they were naturally prone to documenting things in writing, but apart from the photos that were found, no personal messages were left behind. Or perhaps they did and a third party removed them again, just like one specific photo was erased - more on that missing photo further below. Some local guides stated by the way that there is only one spot of around 20 meters in size on the highest hilltop in that jungle-like terrain north of Boquete. Only there, on the Mirador, there is cell phone coverage they say. And you not only need to know which mountain, but also which specific 20 meters on it, the guide claims. Even a satellite telephone does not always work in the cloud forest, when the clouds are too heavy and thick for instance. It remains unexplained how Kris could have received a phone connection with her boyfriend around 14:00 on the day they went missing, considering they were behind the Mirador already by then, a zone without cell reception.. *By the way: If you need to place an emergency call, all networks will accept 911 (or it's equivalent). Even if there's no signal that your phone uses without roaming (which is practically moot domestically, but relevant internationally) and even if your phone has been disconnected for non-payment or currently isn't attached to any provider. You can still make an emergency call.
Also, this Dutch newspaper mentioned early on already that the phone screen was 'swiped', with a finger
more than once. Which we now know to be correct info. But without having access to the phone's content at some point, when no or incorrect PIN codes were entered, what was there really to swipe? Maybe Kris did it purposely or accidentally and it is nothing of importance. Or could this perhaps mean that someone who did not exactly know how the phone worked tried to swipe it? I think the chance of that is vastly smaller than Kris doing it herself for whatever reason. But a possible yet far-fetched lead: in the small youtube video added below this paragraph, someone explains one possible reason for swiping an iPhone 4 (the same on that Kris had) when you do not have its PIN code. The video is from 2011 - so it was available in 2014 - and has millions of views. It's quite an extensive order of things that you need to do, but it shows that swiping by itself, IF you combine it with all sorts of other steps, could have gotten the person who wanted access to the phone after April 5th actually into the phone. Back in 2014 it was theoretically possible therefore to find out about this hack pretty easy online. I doubt that the girls themselves would have known about this, or had been able to memorize all these steps by day 5 of their disappearance, if they even knew about this hack option at all. But anyone else at that time could have found this information easily if they had internet. Again, it seems not very likely or logical, but when thinking of all possible explanations, it is something to know about..jpg)
OFFICE HOURSWhat doesn't seem to be a coincidence however, is that there was a 'preference' to call in specific time blocks: roughly speaking between 10:16-11:00 AM and then between 13:00-16:00 PM. This is remarkable, because these very regular call patterns are not related to sunrise, sunset and zenith times, making them all the more.. striking. Why didn't Kris and Lisanne ever try to call in the quiet evening or night? All these phone calls - except for two which were made at 04:50 and 05:00 AM on Friday morning - were made during daylight. And what happened on April 5th, when Kris' iPhone suddenly no longer received the correct PIN codes? (Big thank you to Jeremy S. who made me this image of the 'working hour' phone call times. I updated the image on March 21st '21, based on new information, Scarlet).
Update: It is disputed by now if there truly ever was a 1 to 2 second connection made with the cellphone of Lisanne. This was reported to have happened on day two and possibly more often, when Lisanne called 112 with her phone. A local newspaper who had all the finer details of the phone logs correct and who had been leaked this information, also mentioned this short connection to have taken place. This map with the phone data, published in a Panamanian publication, says that the phone shortly connected to the GSM then. The rest of their detailed information seems to be 99% correct, including the info about a screen capture, which the official case files confirmed to me to be true. Only their mentioning of a short connection cannot be found in the official case files. So, this supposed super-short connection has not been proven and it also does not feature in the official phone analysis results. It may therefore have been an error of the newspaper. Investigators in the case state that the local telecom company Movistar was asked on April 8th to share every detail they had about the girls' phone use during the first week of April, but that this resulted in nothing. Or perhaps the connection wás in fact made, but was too short to register in the phone's operating system or with Movistar? There was no GSM connection seemingly, but you can never rule out that on one particular freak stretch, there wás a short connection possible after all. Gaetan wrote me and stated that if a cell phone connects to the network for 2 seconds [as was claimed by some to have been the case here], the operator automatically knows many things. Because when a mobile phone connects to a network, many data are checked: first, once the pin code is entered, the phone connects to the nearest cell tower. Your phone number is verified by the servers to know which operator you can get access to, then your subscription plan (or prepaid plan) is checked and once deemed valid, you can access the network. All this takes a few seconds. Then you see the network operator’s name on your cellphone. Considering that on April 2nd, Lisanne's Samsung phone had a few seconds of connection that day, this means that the phone was actually connected to a specific cell tower. Meaning that Panamese cell operators should be able to know which cell tower was used when this specific 112 dial was made. Of course, a cell tower doesn’t give you a precise localization like GPS. The accuracy depends on whether or not you are in an urban area (more towers, more accuracy) or in the countryside (less towers, larger radius). In the case of Kris & Lisanne, it would have helped to know if the calls were made from a city or a forest. It would also be good for us to know if a tower near the Pianista Trail pinged, or one near... let's say the Caldera swimming area. However, Panama supposedly found no info on this. Even though cellular tower companies should keep records or logs of established connections. But Betzaida Pitti and her team failed to get this information. The Dutch investigators as a result had nothing to work with. - Gaetan also confirmed that if somebody needed to access the iPhone, a code and pin code were required. At that time, to charge or to connect the iPhone to a computer, you needed its non-standard 30-pin connector to usb-a cable Kris certainly left in her room. Another thing which Gaetan told me, is that in 2014, the iPhone4 (which Kris had) used iOS 7. Even now, people usually leave the tracking location services on by default. It means the iPhone regularly pinpoints your location using either cell or gps. There was even an app showing on a map where you’ve been to. It could be interesting to know where the 112 calls have been made. Unfortunately investigators could not find or extract ANY GPS data from both phones.... Very peculiar and it raises the question whether or no the GPS function was manually disabled. This was not further investigated, so we don't know what happened there.
Gaetan also wrote that the iPhone 4 battery cannot be compared to an iPhone 5C, as these two phones are a few generations apart (iPhone 4 from 2010 and the iPhone 5S/5C from 2013). He owns an iPhone 4 and after seven years of use, he now manages to keep its battery alive by charging it at 85% every 1 or 2 months. In the meantime, the phone is totally switched off. When he restarts it, the battery lost about 20 or 30%. But in his case, after ten years the battery is still working fine. Translating this to the Kris and Lisanne case, it is apparently not that strange that Kris' iPhone 4 was able to be switched on and off for eleven days, starting with 51% battery life, and with over an hour of phone use time left by day eleven. Matt made a good graph of the decline in battery of both phones. He agrees however that it is strange that the iPhone had still enough battery by day eleven to be powered on for over an hour, and then have what he estimates to be around 22% battery left still.. I'm tempted to argue that the phone that afternoon drained so quickly because it was searching for signal, but on the other hand; does a dormant phone searching for signal drain its battery strength so steeply?
Scarlet: it is true that the NFI investigator admits in the files that the iPhone did have a GPS function, and that Kris' phone did in fact register traces of geographical locations or recorded routes before. Her phone last did so (according to the NFI investigation) on March 22nd 2014 and that concerned a Dutch location. The NFI investigator found no traces however of coordinates or geographical locations in the reports, log files and file system of the telephone that could be linked to the period after the disappearance on 1 April 2014. This seems odd. Kris and Lisanne arrived in Panama at March 16th and started their trip on March 15th 2014. So how is it possible that the iPhone of Kris logged a DUTCH geographical location on March 22nd of 2014? Is this another NFI error? And why didn't the NFI investigator delve deeper into why the iPhone stopped logging the GPS coordinates? Why it wasn't functioning in Panama? Was the function deactivated? Or did the iPhone 4 fail to log such info as well? Or are we dealing here with someone who removed all GPS data from both phones? Or was this guy's report edited? Or was he asked to ignore the GPS data for some reason? It is a very important detail, but it gets no further attention or explanation from the Dutch digital specialist :(
The other question relates to whether or not the Flight Mode was switched on on April 11. There is no answer to that either. It is simply not mentioned in the NFI report. Which is strange enough, because for all other moments when the cell phone was on long enough, it is recorded that the flight mode was off. For the last day, however, this information is missing, the log does not show it either. We can't say why, only suggest, that it was not able to extract this information. Like so many other things, it remains unanswered." And as I already mentioned above: The question arises also what those one minute or less powering on and powering off exercises achieved with the iPhone? It would not give the phone enough time to properly load the main screen, and arguably neither to do a signal check? The NFI investigator seems to think that this may have been done to slightly boost battery life... This reads like an attempt by the NFI researcher to explain away those irrational seeming super short phone activations and powering offs... At most this tactic boosted the phone with 0,8% of battery life or something... So is this a rational explanation? To me it is a feeble one, especially given how consistent the phone user(s) did this: from day 2 onwards. It is directly contradicted by the unused draining of the Samsung battery during the night of April 3rd, as well as by the handling of the iPhone by April 11th. Doesn't this useless powering on and off within a minute or so match a staged attempt by a third party to make it look like Kris and Lisanne were lost? Even of the iPhone no longer required a SIM PIN code, how much could that phone truly show the user within a one minute timespan? We know from Power-Pixie's tests with the phone model that it wouldn't have been much...
Then there was the digital camera in Lisanne's backpack which had not the same battery problem as the mobile phones, so could be used for a much longer time. In fact, the battery life of this Canon SX270 HS digital camera is amazing, and if the camera is not used it is known to last for a whole year even. The camera was also reported to have been found in relatively good condition and its 16 GB SD card was accessible for researchers. No traces of coordinates or geographical locations were found on the Canon camera or its SD card that could be linked to the period after the disappearance on 1 April 2014. The Canon camera was investigated by the Dutch NFI forensics institute, and it was completely taken apart during the digital examination. The printed circuit boards were secured and separated for further digital examination. The parts were examined with white light and with the light of a forensic light source and treated with the vapour of cyanoacrylate. They were also treated with a basic yellow reagent and re-examined with the light of a forensic light source. The adhesive tape on the camera was treated with methyl violet reagent. Four fingerprint traces were found on the camera.
Investigators were able to view around 133 photos on the Canon camera for the period of April 1st and onwards. Only one file was missing (more on that later). The photos that were published look sharp and fine, in the sense that there is no seeming (water) damage to these files. This camera has no GPS location option, so investigators could only establish or guess the location of the photos based on the visible surroundings. A Dutch "highly qualified digital forensics expert" also analyzed the camera and its SD card, and discovered a total of 470 photo files in JPG format and seven video recordings in PMB4 format in total on the memory card. They were stored in a main folder with the name "DCIM". Inside it were 4 folders with the names "100__01", "100__03", "100__04" and "CANONMSC". IMG_0167 to IMG_0609 were identified as related to their holiday in Panama, meaning that at least 342 photographs were taken by Lisanne and Kris while travelling to and in Panama up till the point of their last daytime photo taken on April 1st (not counting the Night Photos here, which are dubious). The Dutch digital specialist also found traces of 64 photo files and 4 video files in these folders that had been deleted and (partially) overwritten. The photo image of a number of these deleted files had been retained in whole or in part. No more information is known by me about the precise nature of these deleted photos and video files. But we know now that Lisanne made and deleted at least 4 videos with the Canon camera.. She knew how to make videos with it clearly. - So, back to the most important part: a total of 134 photos were created after March 31st, numbered from #476 to #609. They fall into two categories: daytime photos from April 1 (33 in total - and possibly a 34th in the form of deleted file #509 - of which 23 have been leaked to the public over time, one way or another), and nighttime photos from April 8, (100 in total, of which we know and have seen 50). The NFI only examined image files that were taken after March 31, 2014, i.e. after the girls' disappearance. No video files have been created on the Canon camera after March 31st 2014. The last video file that was created on the data carrier dated (converted) March 28, 2014, which was Kris and Lisanne's last day in Bocas del Toro.
THE TRAILHEADThe first inspected photos showed the girls in good spirits on April 1st, confirming that the women had taken the Pianista trail and wandered into some wilderness, hours before their first attempt to reach 911, but with no signs of anything unusual. The girls took photos of each other and the weather was good; sunny and no rain. These first sets of photos show them walking up the trail, as well as showing the scenery around the trailhead. As this blogger who took the same route (but on a more cloudy day instead) describes this old cattle trail: "El Pianista Trail is one of the moodiest cloud forests I have ever adventured into. Rain droplets falling to the ground from every leaf and branch while mist floats through dramatically. The early stages of the hike are open fields, with mountains on all sides. You can already see the clouds hugging the summit of the mountain. You know what you are heading into. I enjoyed the early parts of this hike with the beautiful hills on either side and the sounds of the river cascades to the right." And in this blog the Pianista Trail is described as follows: "The trail can be broken into three "sections". In the first 45 minutes, you will walk through open area pasture land with gorgeous views of the surrounding mountains and downtown Boquete. Second you enter a dense jungle* surrounded by lush vegetation, birds and insects. In here you will walk for about 1.5 hours and enter the cloud forest where it is very humid and magical, as you are literally walking in the clouds! Finally after another 30 minutes climbing the mountain, you will reach the top and will be fully enveloped in the cloud forest. It's really an amazing experience!" - *People often call it 'jungle', but Boquete locals tend to correct this notion and describe the nature surrounding the Pianista trail as a highland forest. "Only the highest part is jungle. Like maybe 5% of the presumed "lost" area. The rest is a tropical highland forest with people, large pastures and well hydrated cows. It is not anywhere near as wild as those hyping for click bait and book sales would have you believe. The settlement of Alto Romero where some of the items were found nearby even has cell service."
.jpg)
HALFWAY UPPhotos #481-486 show the girls just about halfway up the Pianista trail. Photo IMG_483 shows Lisanne and photo IMG_486 shows Kris and Lisanne posing together in a meadow area of the trail. Photo IMG_489 shows Kris on the trail. Photo IMG_491 shows Kris with a stern look on her face, holding two water bottles in front of her. This picture was taken a little bit before the summit, at 12:03 PM. Photo IMG_493 is said to show the trail up the Il Pianista, around 700 meters before the highest point: the (Mirador) summit. It was taken at 12:42 PM. That is the recalculated time; the official time stamp on that photo was 18:42 PM, but all these times were recalculated by investigators because the girls seemingly never adjusted the time or even the correct year in case of the Canon camera, with the camera being set to 2013 instead of 2014 and to Dutch wintertime.. Meaning investigators had to subtract 6 hours to get to the correct local time. Then the next set of photos on the girls' camera established precisely that they were at El Mirador (a lookout) on the El Pianista Trail, at the summit of the Continental Divide on April 1st, the day they went missing.
THE MIRADORThe Continental Divide is a long string of mountain ranges that run all the way from South America to North America. This specific mountain range is called the Cordillera de Talamanca, summarized the CD. At this lookout point you can see both the Pacific Ocean and the Caribbean Sea on clear days. It is not rarely windy here and the high mountain range catches often clouds and holds on to them as well. But today the girls had clear skies and great vistas. Experts have said that they could determine from the sun’s angle that the photos were taken at approximately 13:00 PM. But there is some controversy about these times, due to multiple important witnesses placing the girls around 14:00 PM at the start of the Pianista trail. More on that later. Then followed a string of selfies on the Pianista summit. Mostly all these selfies have been made public by now, through leaks or through public use of them by family members. Photos IMG_495 (taken at 13:00 PM) until IMG_504 (taken at 13:06 PM) were all taken from the Pianista summit. Photo IMG_499 shows Lisanne smiling on the top of the mountain at 13:01:38 PM. Some people commented on the strange way in which her body seems stretched in this photo. Especially her left breast looks a bit out of proportion suddenly - and only in this photo -, making some people believe this photo could have been photoshopped. Although smartphones also can distort photos around the edges sometimes due to their specific lens. However, this photo was not taken with a smartphone. This Dutch photo specialist has looked into the case and tells you in his video the extent of photoshopping he thinks he detected in the leaked photos of the girls on their trip, which have also been shared in this blog post of mine. Some more about this photo #499; the photo setting is set to landscape, not auto face detect. Yet we see Lisanne's face large and in focus. We can also see clearly in this photo that Lisanne is wearing the same bra that was found in the backpack. This photo with photo number #496 was the second photo the girls took on the summit, at 13:02 PM. The first photo on the summit (#495) has not been shared publicly, but we know from people who have seen all the photos that it is a similar style photo. Just like photo #497 and photo #498, it shows Kris and Lisanne looking proud and elated.
Within the time frame of two minutes, the girls made a string of eight photos on the summit of the Pianista. Sometimes there were only six or eight seconds between shots. The photos are all taken on the East side of the summit, facing the east to South-East. This older type of camera does not show you what is in your photo frame, so you need to aim it correctly. Six seconds after a portrait photo of Lisanne was shot (#499), photo IMG_500 was taken, at 13:01:44 PM Not only must they have taken sharp photos from different positions and spots in quick succession; the clouds also look different at times. Two photos of the girls stand out from the rest in that respect, showing this thickly clouded background. This is all the more striking, because these summit photos were taken within a six minute time frame (and these two specific photos within 6 seconds of one another). Near blue sky with a thin cloud on one and near covered clouds on the next. There was seemingly not much transition space left for the blue to drift gradually over in full clouds. But from what I read it is not uncommon on this stretch of land to have dramatically different skies over the Continental Divide. Which seems the most obvious explanation here and in this photo from the girls, taken a couple of days before their hike, you can also see compact cloud masses above the mountain. But I also won't exclude the possibility that, regardless of what we have been told are the official photo times, both photos were taken at completely different times in fact; one during the ascent and one later when they may have returned there for a possible descent (in which case someone must have messed around with the photo numbering). This photo of Kris is made around the same time.Both Lisanne and Kris also have their hair tied back in some photos, and loose and windswept in others. They must have rushed around to shoot all these photos on different spots, with different hair styles and all within minutes/seconds. There were also nine photos taken with their smartphones on the summit between 13:14 and 13:15 PM. So again a lot of photos rushed and taken within little over one minute. You can read about them here. At this point they were over 4,5 kilometers away from Boquete. This site tells us that going up the Pianista until the Mirador summit, and then back down to Boquete again, takes the hiker 9,3 kilometers and around 5 hours and 40 minutes on average, depending on your speed and level of fitness. Local tour guides do it a lot faster however and can walk up the mountain in about an hour. Lisanne's brother Martijn retraced his sisters steps later (full TV show on this can be seen here or here) and it took him and a local guide 3 hours to climb the Pianista up to the summit. The girls reached the summit by all accounts in just less than 2 hours time, making them fast walkers. But they also had excellent walking conditions on April 1st of 2014, with sunny dry weather and it had been dry for a long time, so the trail was easy to walk. Other fit hikers also managed to reach the summit (well) within 2 hours, often in rainy and muddy conditions. This hiker for instance who is in good shape, reached the Mirador summit in 1 hour and 20 minutes he stated (and one hour to go back down again).
THEN THEY KEEP WALKINGNormally tourists turn around at this lookout point at the top of the Pianista trail, to walk the same path back to Boquete again. These days there are signs at the top - placed there after the tragedy of Kris and Lisanne - warning people not to walk further without a guide because there is more treacherous terrain ahead. But also a small waterfall... Based on police investigation into their computer use and online search history, we know that Kris and Lisanne had researched the Pianista trail prior to their hike. Please notice here that public prosecutor Pittí only decided to have the computers at the language school examined and to have a digital image of the hard disks and server created on April 29, so 28 whopping days after Kris and Lisanne disappeared! Panamá América reported that: "An inspection of the computer of one of the Dutch women, made by the authorities of that country, showed that hours before her disappearance they were looking for information on the internet about the El Pianista trail." And Dutch digital newspaper RTL Nieuws also reported that Lisanne Froon and Kris Kremers searched on April 1st for info on how to enter the trail, its extension and the conditions of the terrain. The information that most caught the attention of the young women was apparently that there were three sections of the trail that could be covered in three hours, two hours and an hour and a half, the newspaper added. The language school also had a copy of Lonely Planet, in which they read the information that it was necessary to turn around and walk back to return to Boquete. Language school staff member Marjolein also told them explicitly on Sunday March 30th that they had to turn around on the Mirador and had to walk back down again if they ever chose to walk the Pianista trail.
But perhaps they reckoned, while on the summit that afternoon of April 1st, that they still had time to walk on towards this waterfall. This is an assumption because we don't know why they didn't just return to Boquete the same way they came. We can only see the photos they kept taking, showing that they wandered on to what is called the Caribbean Descent. Not that walking on was some sort of abnormality, or risky business by the way, despite what the Panamanian press wanted the world to believe shortly after this disappearance case. Only after this drama did the narrative start that you risk your life if you keep walking from the summit on. But in reality, the trail has been used for decades, centuries in fact, by locals and their cattle and tourists alike, leading to some local beauty spots; from quebrada gully-tunnels to natural streams and a small waterfall to cable bridges. It is a normal continuation of the trail that leads to the Mirador - which is simply the summit - and the streams further down are where you collect fresh water. But it was not the way back to Boquete, but instead a road further away from it. This explorer and writer actually walked the same Pianista Trail after learning about the disappearance from Kris and Lisanne, and he wrote about the situation at the Mirador summit: "Finally the Mirador was reached, very obvious by all the food wrappers left about by the previous searchers, it had taken exactly two hours to reach this point without stopping all the way from the restaurant. [..] Could they have become turned around thinking that the direction toward Boquete was in fact toward Changuinola to the North? It seemed really unlikely as the Mirador had the section with the view to Boquete cut back on the right hand side, with few trees rising above the path level, yet to the North it remained thickly wooded, even in the thick cloud it seemed unlikely, but of course not impossible." It looks like Kris and Lisanne also pictured Boquete laying behind them in the background on a photo they took at the summit. It is the last photo they took with their digital Canon camera while on the Mirador, taken at 13:06 PM, but they continued taking some more photos on the summit with their mobile phones after that (Lisanne's Samsung phone recorded the times of 13:14 and 13:15 PM for these photos). And they took multiple picture of this sight of Boquete in the distance behind them, also at least one with their smartphone. In this video, shot by Kris' father, you can also see the same place in the distance at the 07:50 mark. We can determine from the footage that this place (Boquete and surroundings) faces the south/south-east and that the trail that goes on beyond the summit faces the north. Considering that the trail continues in a more or less straight line, I personally do not believe that these girls ever believed that the ongoing trail allowed them to loop or to eventually see Boquete looming in front of them again if they kept walking on to the north: a theory that has been suggested at times by people following this case online. Not only had language school staff member Marjolein informed them beforehand that they had to turn around, but unless you are in very disorientating, uniform stretch of nature (such as dense woods or plain desert terrain), it is also not that easy to become so disorientated that you forget that the way home is laying straight behind you. We all have a built in sense of direction and granted, some have a better or a lesser developed sense for this, but given that Lisanne or Kris took an actual photo of Boquete laying down there behind them, there is simply no evidence or indication that they believed the trail would somehow loop back home. They would also have seen on this clear sunny day that ahead of them was nothing but nature. No villages. No civilization. Lisanne even checked Google Maps at this point, still standing on the summit. (Earlier that day. she had activated Google Maps on her cell phone at 10:16 AM). A summit which, being the highest point in the area, also could act as a trail marker of sorts. It seems most likely that they kept following the trail north, because it was a glorious day and not that late yet and because there was more nature to be seen ahead.
THE LAST PHOTOSSo, by the time they were done taking summit selfies, the girls did not return to Boquete, as advised. Instead, they continued to walk on, past the summit: Photo IMG_505 shows Kris bent in a specific way, with one hand used to shield her eyes, looking back. She seems to stick her tongue out. This picture was taken after they walked straight on beyond the summit, following the trail downwards again, further into the tropical forest. It was taken at 13:20 PM. Photo #506 was taken six seconds afterwards and appears to show the infamous 'wall of moss' just behind the summit, something which this matching gif image seems to confirm; it was taken by a youtuber and appears to show the location of photo 505. At 13:38 PM the GSM network connection of their mobile phones was cut off as they had ventured too far from the summit. Then IMG_507 shows Kris crossing a small stream, seen from the back again, at 13:54:50. The back of her jeans shorts shows a mud stain. Authors Hardinghaus and Nenner possess the case files and the normal sized photo copies and they claim that "There is also a small hole in her jeans". This could be of interest, given that the jeans shorts was eventually found by rescuers with similar damage to it. If the authors are correct, this damage may have already been made by Kris before photo #507 was taken and not be any indication of what may have happened after their disappearance. Eight seconds after photo #507 was taken, IMG_508 is said to be taken. It is the last known photo taken by the girls that day. However, strangely enough there are two versions of photo #508: one shows in its metadata that it was taken 8 seconds after photo 507, but another version of the same photo circulating in online media and such, states that this last photo of Kris looking backwards was taken 50 seconds before the previous photo of her passing the creek. Of course, with her general direction of movement being forward and not backwards, this makes no sense. It is strange that two different versions circulate. This photo specialist explains that he thinks that he can link it to photo manipulation by a 3rd party. So far, this is a subjective explanation of events, but interesting nonetheless. The fact that no more daytime photos were taken on April 1st, could implicate either that they kept walking and that something unexpected happened, which prevented them from taking any more photos on the trail leading deeper into the forest. Or it is also possible that they returned at this point, back to the summit of the mountain and that they did not feel like taking more photos of the same scenery they had already seen. They had already taken pictures of that same route, after all. The girls would have probably only needed approximately one hour or less to walk from the location of photo 508 - the 1st quebrada/stream - back to the summit. And to then walk further downhill, back down to Boquete, would have probably taken them 1 (maybe 1,5 hours if they were very slow) at most. They could have been back at the trailhead by 15:30 or 16:00 then. And with the sun setting around 18:40 PM that day, depending on their location beyond the Mirador Kris and Lisanne would have had to turn around at the latest at 16:00 PM, in order to make it home before dark. Although that would have been already tight and 15:00 PM would have been a better time in fact. It is one theory that the girls kept walking after having reached the summit ("plenty of time") around 13:15 PM, but panicked by 16:39 PM. If they had indeed kept walking on and on for all that time, they would never make it back to Boquete before dark then.. More theories will follow. Please check out my entire and comprehensive oversight of all the photos taken by Kris and Lisanne, put in chronological order and with the known photo numbers and times attached here. Update: many of the remaining photos taken by Kris and Lisanne have been made public. You can see them all here or here.
ANALYZING THE LAST PHOTOOn April 1st, 33 pictures were taken with the Canon digital camera. Photo #476 was probably the first taken that day, at 11:18 AM (17:18 data time). Left you see the last known photo taken by the girls on April 1st (photo 508). It shows Kris in what’s being called a “Quebrada”: a gully or ravine which you can walk through in the dry season, but in the rainy season they can be knee deep covered in mud. The term can also be used, confusingly, to describe a small stream of water. The photos also show what is said to be a barranca, also a gully or ravine, but with steeper sides, and also treacherous in the rainy season. On the photo of Kris crossing the small stream, the main trail she follows leads to the earlier mentioned small waterfall. They never pictured it however. The girls no longer made smiling selfies at this point, but instead someone - assuming it was Lisanne - took photos of Kris walking some distance in front. Kris looks back and her facial expression has been called slightly worried by some, although this is open for interpretation. The camera point is quite high, indicating that Lisanne may have climbed up onto something perhaps, or that the road itself was making a descent towards the creek. Something I couldn't verify in the videos featuring this stretch of the track.
WHAT HAPPENED THEN?
The question everyone is asking now is: what could have happened to the girls after photo 508 was taken? Their photos show that they had left the Pianista trail and crossed over to the other side of the Divide. The Pianista trail is a clear path, but once you walk on, paths eventually become small trails, poorly maintained and the forest closes in. But not unless you walk on for a very long time; initially the ongoing path is clear to follow and partly surrounded by stone walls that make it nearly impossible to unknowingly divert from this one and ongoing trail. You cross a small stream twice, the second time also passing a very small waterfall of sorts. These trails are said to be used mostly by locals, tourists and indigenous people living within the forests; some walk their cattle there, others use the trails to walk to their coffee plantations. This includes the Ngobe people, who’s village is approximately 12 hours by foot from the Continental Divide, and in whose territory the girls’ backpack was found. But despite this clear to follow trail going on for a long time after the El Mirador, it is a frightening thought that the girls were in distress relatively shortly after they crossed onto this side of the mountain and that they started to call emergency services so soon, while it was still light. And they called those emergency services in vain... The reason why they started calling 112 has never been discovered. Some people think they called for help because they thought they were lost.. Or because one of them had an injury. Being born and bred in the Netherlands myself, I like to stress here something that's a Dutch fact of sorts: every child is thoroughly made aware by their parents and by the state that one does not call 112 for anything short of an immediate life-threatening situation. Think of heart attacks, critical car accidents and being threatened by someone with a gun. You can get punished for abusing the number and even in actual life-threatening situations, many people are hesitant to call 112, unsure if their issue is 'serious' enough. I am extremely weary therefore of the theory that Kris and Lisanne would have called thát Dutch number by 16:39 already when it was still light, simply for fearing they could not make it back home in time or felt lost. That is not usually a good enough reason to call 112 in our country.
Lisanne had activated google maps on her phone, but instead of checking it (which can be done offline), she closed google maps on the Mirador. Why didn't she look at it when feeling 'lost'? Even when offline, it would have identified their location on the map, and given a general indication of where Boquete was situated.
Others* think that the reason why Kris and Lisanne started calling emergency services shortly after 16:30 PM, was because they were followed by someone, who forced them deeper into the woods. (*I refer here to some of the forums, comment sections and online discussion places I follow). Because if they had been 'lost' at that point - which seems quite difficult to achieve given the one embedded trail that is followed and the density of forest growth off trail - then the obvious and most logical thing to do for them would have been to simply turn around and backtrack. Earlier that day. Lisanne had activated Google Maps on her cell phone, but instead of checking it (which can be done offline), she closed google maps on the Mirador. Why didn't she open it back up when feeling 'lost'? It would have identified their location on the map, and given a general indication of where Boquete was situated. There was one clear path to follow and no clear reason for leaving it, to battle through thick growth while wearing shorts. So why didn't they? Did the narrow passages near the summit scare them and did they not want to turn around to pass them another time perhaps? There were also no photos found of anything that could have explained the emergency calls; no photos of an injury, of a strange person or of them being lost in hostile territory, away from the main trail. The photos simply stopped. And another thing; they also didn't use the digital camera's video option. People have said that they may not have wanted to let their relatives know what was going on, but that would be in very stark contrast with their usual behaviour: the girls shared their adventures with their parents and were in daily contact with them while in Panama. Why couldn't they have simply kept taking photos after their first call attempts? To document what was happening to them? Other people argue they probably wanted to spare the phones' batteries, which makes sense considering how vital those emergency calls were, but the digital camera (Canon powershot SX 270 HS) didn't have that battery issue, as its battery is sturdy and long lasting. And it also enabled them to record videos. When investigators checked its battery, 10 weeks later, it still wasn't 'dead'. So one would assume that in a situation of panic or danger, it was much easier to make a video recording or take some pictures. And if they truly got lost, photos or videos could also serve as a vital reminder of the trail they came from, helping to document landmarks and so on. So why didn't they? 
The girls were said to have been avid mobile phone users and eager to stay in touch with their family. They also took photos every single day of their holiday, often several dozens. Like most young people do these days. Makes you wonder why they díd not create a single normal selfie, photo or message about what happened to them during the entire 11+ days of their disappearance. Wouldn't they want to get a message out, or document their journey/ordeal? They wrote in their dairies most days, normally. Kris had a boyfriend in the Netherlands, but didn't try to contact him even once through messaging or phone after April 1st....Very strange. This young woman from New Zealand for instance fell in the desert of the US and broke her hip. Her phone had no cell coverage and she thought for days that she would die there. She said: "I was filming little videos from the moment I fell just in case anyone found me, to explain what happened. I haven't watched them yet [after she was found and saved]. I'm unsure whether I want to." Here you can see some of her self made videos, while laying isolated, thinking she would die there. And Robert Scott, to name just one of many other examples, was stuck in his tent in a snowstorm on Antarctica in 1912, knowing he would not make it out alive, and he used his last powers to write letters to loved ones and last lines in his diary. Leaving some message or some update of what is going on, can work very soothing for most people. Many people do. So the fact that Kris and Lisanne didn't record anything or leave a single message for their beloved parents, while normally in the habit of doing so, is out of character. The question is: did they opt not to because they were physically or mentally unable to, or because they didn't have the freedom to do so? If you want to consider foul play a possible factor in this disappearance, then it isn't far-fetched to imagine how anyone can make fake phone call attempts in a region where not even your GPS location is establishable, let alone a phone connection. But a 3rd party cannot fake someone else's voice messages and personal videos, and cab neither fake Dutch draft text messages. And regarding these emergency calls: David wrote me under one of my youtube videos about this case, that he thinks you would normally only call emergency services as a desperate last resort. It's an important point to bear in mind he thinks, because if someone merely gets lost, in daylight still, his own experience has been that people are inclined to first try to find their own way out. To walk around the area until you find something that looks familiar. Not to start calling emergency services right away. Which seems a valid point to me. Although we need to remember that this was a foreign country, foreign terrain for these girls. Who were just 22 and 21 years old. So they may have panicked faster than they would have done at home, in the Netherlands. But David's point is that it's quite an extreme measure, calling 911 (or 112 in this case). So it is hard to say what triggered Kris and Lisanne to call emergency services themselves at 16:39 PM already. I personally think that it was because they experienced something frightening. Something very acute. Fear of being stalked, or fear of being unwantedly chaperoned by some men they were afraid of perhaps. Of course, one can imagine many possible reasons. They may have endured an injury perhaps. I lean away from that scenario personally, because in such a situation search troops should have found them a day or two later sitting alongside or near the trail, logically. And if they hád called 112 because they had just realized that they wouldn't make it back to Boquete before the evening fell (which I do not believe considering the time of day and the normal Dutch hesitancy to call 112 for anything that isn't directly life-threatening), why didn't they also try to call their host family nearby? Miriam's number was in their WhatsApp contact list. She would be a more reliable source to try to contact, being able to direct police or volunteers up there to guide them back home in the twilight or dark. What would emergency call center staff in the Netherlands be able to do, practically, in this situation? And Miriam would have also waited for the girls in the evening with dinner.. Wouldn't Lisanne have tried to call Miriam therefore, when things went wrong? But they didn't try to call the host family... Nor their own family.
Another waterfallNot only is there a small and narrow waterfall beyond the Mirador, which the girls would have passed if they'd continued to walk the trail. But there is also another, larger waterfall beyond the Pianista summit. But it is harder to find. (See part 3 of this blog series for the aerial 3D photos proving the waterfalls existence and where exactly it lies in relation to the small stream of photos 507 and 508). Kris' mother Roelie said in a Dutch interview about the plans of Kris and Lisanne (as far as the parents were aware): “They had made a plan for that week. They were also going for that volcano…but they were going to do that later on Saturday. They were also going to see the waterfalls in that area later, but they had all planned that.” Marjolein and Eileen also emphasized that the girls were interested in seeing local waterfalls. And Kris and Lisanne told their Dutch friends Bas and Edwin on March 31st that "they were going to the cascades". Could Kris and Lisanne have aimed at hiking to waterfalls that Tuesday April 1st? Is it possible that the girls deviated from the main path at some point to find this waterfall? The Hidden Waterfalls had been on their wishlist. Is it possible that they believed they could reach them through this trail and that they got lost along the way?
Calista Hart wrote this about the girls' disappearance in her blog: "In April my Spanish teacher told me that two young women had gone missing from the sister school in Boquete, Panama. They had left all of their belongings, and not told anyone where they were going that day. The last anyone saw of them they were talking to two strange men, making plans to see the waterfall." With which men they talked, and which exact waterfall they wanted to see? We don't know. There are several in the area. And this blog post has a description of how to get to this one specific waterfall, pictured on the right. It is considered 'the hidden one', as there is no official description of how to get there. Quote: "The Pianista really is a knockout, winding through meadows with stunning mountain vistas along the rushing Rio Pianista, and with an abundance of lush cloud forest vegetation. This trail goes up to the Continental Divide (a more ambitious hike that we did with a group last year), and if you’re especially adventurous, it can take you all the way to Bocas Del Toro on Panama’s Caribbean coast. (CAUTION: no one should EVER go beyond the Continental Divide without an experienced guide. Just Google “Dutch Girls in Panama.”) Today we had something much more mellow in mind – we wanted to get to the “secret” waterfall that Susan and I had not seen yet, but the others in our group had been raving about. The trail begins at the Il Pianista Ristorante (outstanding Italian food, BTW) in the Alto Lino area just north of Boquete. You need to wade across the Rio Pianista after 200m, but then it’s a steady, leisurely incline for 2km before you start to climb a steeper, narrow path. Today, we were accompanied by two young guides, Jefferson and Miguel (as it happens, these cousins are nephews of our gardener, Sergio) – and it was a good thing, because finding the waterfall required us to get off the trail and take another cow path that leads into the cloud forest. We could not have found it on our own. Since we’re right in the middle of the rainy season, it was a pretty muddy slog – but not too bad." Source: blog Latitude Adjustment.
Authors Hardinghaus and Nenner also describe this secret waterfall on the Pianista, the Cascada el Pianista, and place it roughly at the same height as the house of Pianista resident 'Mister M'. It is extremely difficult to find, they write. "It can be reached after a long hike along the Rio Pianista if you walk through the "dangerous triangle" between M.'s hut, the ex-president's dairy farm, and the sugar cane field where the bodies might have been buried." This may be the Hidden Waterfall, also described here. It lies on the Boquete side of the Pianista trail however, and not beyond the Mirador. Update: Romain has explored the Pianista trail and beyond a second time recently and has confirmed to me that there IS really a waterfall behind the Mirador, but that it isn't the one mentioned above. That 'Hidden Waterfall' lies only at 1 hour and 50 minutes from the start of the Pianista trail, and still on the Boquete side of the mountain, but out of sight. Below a couple of other waterfalls in and around Boquete, including the Three Waterfalls, photographed by tour guide Plinio
