SEREMBAN (Bernama): The Coroner’s Court here was told that an e-mail account used to send a purported ransom demand to Nora Anne Quoirin’s family on Aug 7,2019, had been deactivated.
Police witness DSP Hazizi Abd Samad, 42, from the Commercial Crime Investigation Department (CCID)'s Cyber Crime Investigation Division in
Bukit Aman said that the account status was obtained when a check was conducted on Sept 14 this year, soon after the email address was obtained on Sept 11.
"In this investigation (of the e-mail account) there are two main parts, the first is the content and the second is the header. As my job is to analyse this email, we are looking at the header because it contains information on how an e-mail is sent, as well as browser information and IP (Internet Protocol) address.
"On Sept 14, I checked the email, 'firstname.lastname@example.org', through the email checker website and it showed that the e-mail account had been deactivated.
The inquest proceedings before Coroner Maimoonah Aid to determine the cause of death of the Irish-French girl Nora Anne, has entered its 13th day on Thursday (Oct 22).
DSP Hazizi said that based on his 14 years of experience in the cyber crime division, such action showed an element of fraud, run by scammers.
The investigation did not find the sender’s real IP.
He said that as the e-mail was registered under Microsoft Corporation, hence only Microsoft knew the real address of the e-mail and when it was created.
"In the investigation, the IP address was registered under the Hotmail webmail service, ” he said.
Asked by Deputy Public Prosecutor Nuralis Mat, what conclusions can be drawn about the e-mail, DSP Hazizi said: "In my opinion, only Microsoft knows the IP address of the email.”
Answering a question from lawyer S. Sakthyvell, who represented Nora Anne's family, whether the police can get information from Microsoft, DSP Hazizi said it could be done by using the Mutual Legal Assistance (MLA) scheme with the United States.
Sakthyvell: Does that mean only Microsoft knows the details of who owns this email?
DSP Hazizi: Microsoft keeps all records from the beginning of the email account creation, delivery transactions and when it is deactivated. So as for the owner, in my opinion, as it is a free webmail service, anyone could register with any identity.
Asked by Sakthyvell whether an email could be created in this country but using an IP address from the United Kingdom or United States, DSP Hazizi said that it could be done.
Earlier, two witnesses were called to testify.
They are a member of the public, M. Magendran, 39, and Bukit Aman's CCID Forensic Accounting Investigation Division, Cryptocurrency Crime Investigating officer, Inspector Nur Adli Md Saari, 36, as the 30th and 31st witnesses, respectively.
Nur Adli, while testifying, informed the court that the e-wallet number listed in the e-mail that purportedly demanding ransom amounting to two Bitcoins, was detected as that of a scammer.
He said that the police had deposited RM100 on Aug 13 last year, and a check on the e-wallet found that it was active on Aug 12 and 13 with the suspect transferring the said deposit into various other accounts to avoid detection.
"The e-wallet used is in line with the known tactics used by scammers, ” he said.
Nora Anne went missing on Aug 4 last year, a day she and her parents arrived in Malaysia for a two-week holiday at a resort in Pantai here.
Her body was found on Aug 13 near a stream in a hilly area, about 2.5km from the rainforest resort following a massive search.
The post-mortem report stated that there was no criminal element in the death of Nora Anne and it was established that she died due to gastrointestinal bleeding from hunger and stress over a prolonged period.
The inquest continues on Friday (Oct 23). - Bernama