View source for Reports/RMP/Flight Simulator Analysis

{{Template:Menu/Reports/RMP FlightSim Selected}}
<seo
      titlemode="replace"
      title="Royal Malaysia Police Forensic Investigation of Captain Shah's Flight Simulator"
      keywords="RMP, PDRM, Royal Malaysia Police, investigation, MH370, Captain, PIC, Zaharie, Shah, flight simulator"  
      description="Royal Malaysia Police Forensic Investigation of Captain Shah's Flight Simulator">
</seo>
<h2>Royal Malaysia Police Forensic Investigation of Captain Shah's Flight Simulator</h2>
<h4>Background</h4>
<p>Captain Zaharie Shah was the Pilot-in-Command (PIC) of Malaysia Airlines flight MH370 which went missing on {{Day 001}}. Captain Shah had a sophisticated Flight Simulator at his home which the Royal Malaysia Police (RMP) seized  on {{Day 008}}. The RMP then started a forensic investigation to determine if there was any information on the flight simulator which could relate to the flight MH370.</p>
<div class="header main"><p>It is recommended to read the overview of [[Captain Zaharie Shah/Flight Simulator|Captain Shah's Flight Simulator]] before reading the articles about the police forensic investigation. That article collates information about Captain Zaharie Shah's flight simulator from his Facebook page and other sources, describing how it was upgraded during 2013 and developed to include motion simulation.</p></div>
<p>This forensic investigation was part of the overall Criminal Investigation into MH370. The actual documents are not hosted on this website. However, this Forensic Investigation is described in the articles indexed below.</p>


<h4>The Forensic Investigation of Captain Shah's Flight Simulator</h4>
<p>The Forensic Investigation is described in Four Sections indexed below
<ol>
     <li><b>[[Reports/RMP/Flight Simulator Analysis/1 RMP Forensic Report|1 RMP Forensic Report]]</b> - this report has not been released to the public. However, there is sufficient information about it, to develop a description of what it contains.</li>
     <li><b>[[Reports/RMP/Flight Simulator Analysis/2 Forensic Investigation Process|Forensic Investigation Process]]</b> - a non-technical overview of the process involved in a forensic investigation of computer data and relates the stages to the recovery of data from Captain Shah's personal Flight Simulator. More detail is provided in the following articles:-
     <li><b>[[Reports/RMP/Flight Simulator Analysis/3 Data Discovery|Data Discovery]]</b> - This article provides details about the discovery of relevant data from the flight simulator. <br />
          <ul class="ulNormal">
               <li>[[Data Point]] - Investigators used different terminology to describe the recovered data. The term 'data point' is defined in this article.</li>
               <li>[[Volume Shadow Information (VSI) file]] - The term Volume Shadow Information (VSI) file, used in a RMP Forensic Report,  is not consistent with Microsoft terminology. This article suggests that the forensic investigator may have meant the System Volume Information folder which contains files created by the Volume Shadow Copy Service. These terms are explained so that the reader can better understand where the recovered data came from and how it got there.</li>
</ul></li>
     <li><b>[[Reports/RMP/Flight Simulator Analysis/4 Interpretation|Interpretation]]</b> - Extracts from two official Reports which have used or interpreted results from the RMP Forensic Report.</li>
</ol>
{{ShortLine}}
<h5>This article has Sub-pages:-</h5>
<p>{{Special:PrefixIndex/{{FULLPAGENAME}}/|stripprefix=1}}</p>


[[Category:RMP Forensic Investigation]]
[[Category:Investigations]]