Crown v Accused

1. The accused is charged with four counts of attempted murder (Charges 1-4) and three counts of murder (Charges 5-7).
2. The prosecution alleges that the accused deliberately poisoned her estranged husband Simon Patterson with meals containing an unknown poison or poisons on three occasions between 2021 and 2022 (Charges 1-3).
3. The prosecution also alleges that the accused deliberately poisoned Simon Patterson's parents, Don Patterson and Gail Patterson, and Simon Patterson's uncle and aunt, Ian Wilkinson and Heather Wilkinson, when they attended a lunch at her home in Leongatha on 29 July 2023 to which Simon Patterson had also been invited but declined at the last minute. It is not in dispute that at that lunch the accused served her lunch guests individually cooked Beef Wellingtons which contained death cap mushrooms. Each of the lunch guests fell gravely ill, were hospitalised and diagnosed with death cap mushroom poisoning. Of the lunch guests, only Ian Wilkinson survived the lunch (Charge 4). Heather Wilkinson, Gail Patterson and Don Patterson died several days later in hospital (Charges 5-7).
4. The impugned evidence which is the subject of this ruling[1] is evidence of certain 'files'[2] found on various electronic devices (computers, tablets, mobile phones) which were seized by investigators from the accused's home. The prosecution relies on these files to prove that, proximate to the alleged offences, the accused had a continuous or enduring state of mind, namely, an interest in poisons in general and death cap mushrooms in particular.
5. I have considered each impugned file in some detail but, in doing so, I have borne in mind that the relevance and probative value of a file is not to be assessed in isolation, but having regard to all the computer evidence, as well as other evidence upon which the prosecution relies.
6. For the reasons given below, I exclude the evidence of all the impugned files save for the file referred to in [302]-[303] of the amended Summary of Prosecution Opening dated 24 February 2025 ('Summary of Prosecution Opening').

1. Before turning to each impugned 'file' in some detail, it is convenient to summarise some of the evidence of Shamen Fox-Henry, a digital forensic officer employed by Victoria Police.
2. Using various software, Fox-Henry (and other digital forensic officers) interrogated the data copied from a number electronic devices seized from the accused's home. This interrogation produced Extraction Records which indicated, amongst other things, the existence of certain files on those devices. The prosecution relies especially on the files which relate to, or may relate to, poisons in general and death cap mushrooms in particular.
3. The use of the term 'files' here has the potential to mislead. A file in some cases may refer to an actual document that investigators were able to recover from the device in question. But, in most cases, the files recovered were brief 'strings' of text contained in what is called an 'Application Cache'.
4. Fox-Henry provided definitions of these two terms in his Glossary of Terms:[3]
   • Application Cache[4] (AppCache):[5] Allows applications that use it to boost performance of those applications and the operating system; it is used or accessed by Windows Desktop Search, Internet Explorer and Microsoft Store Apps.
   • String: a particular list of characters in an AppCache file that is readable.[6] A string represents 'the path that existed on that computer at the creation of that app cache'.[7]
5. An example of a string in an AppCache is the following:

{\" Type\ " : 2, \ Name \": \"Deathcap (Amanita phalloides) iNaturalist[8]\",\" Path\":\"C:\\\\ Program Files\\\\Google\\\\ Chrome\\\\Application\\\\chrome.exe\", \"Description\":\"}[9]

1. Returning to the digital interrogation of the accused's devices, the data obtained from that interrogation indicates, amongst other things, when files present on the devices were 'created', 'modified', 'accessed' and 'downloaded'. Fox-Henry, who made five statements and gave evidence at two s 198B hearings, said that terms such as these did not necessarily connote human interaction with the relevant files; an electronic device may create, access, modify and even download files without the user being aware of that activity. In relation to automatic 'access' to a file, Fox-Henry said 'A common example is a virus scan of the device contents which will assign a new last accessed date and time when the software scans that particular file. The last accessed date and time is not a reliable source of user activity'.[10]
2. This point is underscored by some of the other entries in Fox-Henry's Glossary of Terms:

Accessed Date: The accessed date is the date and time the content of a file was last accessed, this can be from a user or computer process.

Created Date: The created date is the local date and time a file has come into existence in the specific file path, this can be written by a user or a computer process.

File Path: Is the location a file resided within the directory structure of a file system, these can be created by the user or by computer processes.

Modified Date: The modified date is the date and time the content of a file was last modified, this can be written by a user or a computer process.

1. To take an example, Extraction Record 41,[11] which relates to the string referred to above that contains the words 'Deathcap (Amanita phalloides) iNaturalist', includes the following information:

Filename: AppCache 13297650913038787823

Last Modified Date/Time: 22/05/2022 9:55:14am

Last Accessed Date/Time: 22/05/2022 9:55:14am

Created Date/Time: 22/05/2022 9:55:14am

1. These dates and times may refer to user activity or they may refer to automatic processes of which the user was unaware. This state of affairs is acknowledged by the prosecution in the relevant paragraph of the Summary of Prosecution Opening, namely [281], which concludes with the following comment:

The 'string' identifies that a path to 'Deathcap (Amanita phalloides) iNaturalist' was present on the accused's computer, indicating possible access to that information. (underlining added)

1. Under cross-examination, Fox-Henry gave the following evidence regarding the possibility of files even being downloaded automatically:

Q. And some applications on phones and computers are set to automatic downloads, for instance, Telegram, Facebook. That is that something posted on a particular chat might download to your device without you interacting with it?

A. Yes.[12]

...

Q. I asked you some questions before about various applications which might be set to automatically download?

A. Yes.

Q. Have you had any experience with things like, for instance, Telegram?

A. Yes.

Q. Are you aware that Telegram can be set to automatic download?

A. Yes.

Q. That is, that if you are in a chat or a channel on Telegram, people are posting things to that chat or channel. Those items can find their way onto your device without you interacting with them?

A. Yes, they are cached.

Q. I beg your pardon?

A. They are cached within the program itself.

...

Q. Signal works in the same kind of way?

A. Yes.

Q. WhatsApp?

A. Yes.

Q. Facebook Messenger?

A. Yes, very similar.[13]

1. In the course of his evidence about the various files relied on by the prosecution, there was only one occasion where Fox-Henry did not agree with the suggestion that certain files could have been the result of an automatic process. He was being asked about two PDF files recovered from a white Samsung tablet which are referred to in the Summary of Prosecution Opening at [274] and [276]:

274. On or before 12 October 2019 at 11.26pm, the accused, using a Samsung tablet which was later seized from her home, had access to a pdf file entitled '2007_Bookmatter_Criminal Poisoning.pdf', which is an appendix entitled 'Some Common Homicidal Poisons'.

...

276. On or before 27 October 2020, the accused, using a Samsung tablet which was later seized from her home, had access to a pdf file entitled 'epidinfect00024-0031.pdf', which is an article entitled 'Red kidney bean poisoning in the UK: an analysis of 50 suspected incidents between 1976 and 1989'.

The Extraction Records for these PDF files indicated the following file paths or directories:

Path: USERDATA

(ExtX)/Root/media/0/Download/2007_Bookmatter_CriminalPoisoning.pdf[14]

...

Path: USERDATA

(ExtX)/Root/media/0/Download/epidinfect000 24-0031.pdf[15]

1. Fox-Henry gave the following evidence under cross-examination:

Q. These entries, this record, for these two PDFs, from what you can see of them - including the created, modified and access times - do not exclude the possibility that these files were automatically downloaded onto this device?

A. I don't know for certain.

Q. Yes. I asked you some questions before about various applications which might be set to automatically download?

A. Yes.

Q. Have you had any experience with things like, for instance, Telegram?

A. Yes.

Q. Are you aware that Telegram can be set to automatic download?

A. Yes.

Q. That is, that if you are in a chat or a channel on Telegram, people are posting things to that chat or channel. Those items can find their way onto your device without you interacting with them?

A. Yes, they are cached.

Q. I beg your pardon?

A. They are cached within the program itself.

...

Q. Signal works in the same kind of way?

A. Yes.

Q. WhatsApp?

A. Yes.

Q. Messenger?

A. Yes, very similar.

...

Q. So having answers (sic) those questions about automatically downloading in those various applications, or at least that possibility, the record that I've shown you, that's in front of you there, doesn't exclude the possibility that those files have automatically been downloaded to that device?

A. If by automatically download, you mean cache.

Q. Yes?

A. Based on that directory alone, it looks like that item has been downloaded to the phone[16] (sic).

Q. Yes?

A. Yes.

Q. Automatically, or not?

A. Based on that directory alone, not automatically.

Q. How are you able to say that?

A. The path directory doesn't reference a cache that I would expect to see [with] Facebook Messenger.[17]

1. In summary, the expert evidence relied on by the prosecution acknowledges the possibility that most of the files referencing poisons (including death cap mushrooms) which were found on the accused's device could have been created, accessed, modified and even downloaded automatically. And this possibility, as we shall see, is reflected in the wording of the relevant paragraphs of the Summary of Prosecution Opening which repeatedly uses expressions like 'possibly accessed' or 'had access to' or 'the accused's computer accessed'.
2. Let me now turn to the individual impugned files, in relation to which I will summarise the data extracted from the computer records.
3. I will also summarise the submissions of the parties in relation to each impugned file. All section references are to the Evidence Act 2008 (Vic), unless otherwise indicated.
4. I will leave my analysis to the end, otherwise it will be overly repetitive.

SPO [274] - ON 12.10.19, D "HAD ACCESS TO" A PDF TITLED "2007_BOOKMATTER_ CRIMINAL POISONING.PDF"

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

274. On or before 12 October 2019 at 11.26pm, the accused, using a Samsung tablet which was later seized from her home, had access to a pdf file entitled '2007_Bookmatter_Criminal Poisoning.pdf', which [had] an appendix entitled 'Some Common Homicidal Poisons'. ...

1. The device in question was a white Samsung tablet (Palm 202311-C-0066-0049).
2. The relevant Extraction Record is Extraction Record 3.[18]
3. The application 'source' is 'Facebook Messenger'.[19]
4. Extraction Record 3 indicates that the relevant document was downloaded to the white Samsung tablet:

Path: USERDATA

(ExtX)/Root/media/0/Download/2007_Bookmatter_CriminalPoisoning.pdf[20]

1. I note that the file path makes no reference to 'cache', unlike Extraction Record 5 and Extraction Record 6 on the same page of the Depositions.[21]
2. Investigators were able to recover the appendix itself entitled 'Some Common Homicide Poisons' from the white Samsung tablet.

1. Under cross-examination, Fox-Henry agreed that automatic downloads can occur in various applications but based on 'this directory alone', he opined that it was not an automatic download.[22]

1. The accused highlighted the prosecution's use of the expression 'had access to' in the Summary of Prosecution Opening at [274]; the prosecution was not able to assert that the user had 'accessed' the data because of the limited information available in the computer records. The accused submitted that the data could have been captured by the device without the user being aware of it (e.g., by an automatic download). Even if the user was aware of the download, the user might not have read it. Or the user might not have been the accused: it could have been [Redacted]. Even if the accused accessed the data, such access was at least more than two years prior to the first alleged poisoning and was thus temporally remote. Even if the accused accessed the data at a time considered proximate to the alleged offending, it does not support an inference that the accused was interested in poisons. Even if the accused was interested in poisons, that could be for an innocent reason (e.g., her interest in true crime).[23]

1. The prosecution submitted that the accused's submission that this might have been an automatic download of which the accused was unaware was contradicted by Fox-Henry's evidence (referred to above) that, in his opinion, it was not an automatic download. Relying on Elomar v R, the prosecution submitted that the download was not temporally remote from the alleged poisonings. In Elomar, there was a gap of three to four years between the attendance of one of the accused at a terrorist training camp and the alleged conspiracy to do acts in preparation for a terrorist act. The NSW Court of Criminal Appeal upheld the trial judge's ruling that the particular accused's attendance could be used as evidence of a continuing state of mind, namely, support for violent Jihad.[24]

1. In reply, the accused distinguished Elomar on the basis that attendance at a terrorist training camp implies an 'intense interest', whereas downloading of an article does not.

SPO [276] - ON 27.10.20, D "HAD ACCESS TO" A PDF TITLED "EPIDINFECT00024-0031.PDF" CONCERNING RED KIDNEY BEAN POISONING IN THE UK

1. The Summary of Prosecution Opening states, relevantly (footnotes deleted):

276. On or before 27 October 2020, the accused, using a Samsung tablet which was later seized from her home, had access to a pdf file entitled 'epidinfect00024-0031.pdf', which is an article entitled 'Red kidney bean poisoning in the UK: an analysis of 50 suspected incidents between 1976 and 1989'.

1. The device in question was the white Samsung tablet.
2. The relevant Extraction Record is Extraction Record 4.[25]
3. The application source is Facebook Messenger.
4. The file path in the Extraction Record indicates that the relevant document was downloaded to the white Samsung tablet:

Path: USERDATA

(ExtX)/Root/media/0/Download/epidinfect000 24-0031.pdf

I note that the file path makes no reference to 'cache', unlike Extraction Record 5 and Extraction Record 6 on the same page of the Depositions.[26]

1. Investigators were able to recover the article itself from the white Samsung tablet.

1. Under cross-examination, Fox-Henry agreed that automatic downloads can occur in various applications including Facebook Messenger, but in relation to the file path or directory referred to in the Summary of Prosecution Opening at [274], which is identical to the file path or directory referred to in the Summary of Prosecution Opening at [276] save for the last segment, he opined that it was not an automatic download based on the directory alone.[27]

1. The accused made similar submissions to those she made in relation to the impugned evidence summarised in the Summary of Prosecution Opening at [274].[28] In short, the accused submitted that the download may have been an automatic download. Even if it was downloaded by a person, it might not have been the accused. If it was the accused, she may not have read it. Even if she did read it, it is too remote, the download occurring at least over a year before any alleged poisoning. If it evidences an 'interest in poisons' on the accused's part, that is not relevant because such an interest may be innocent. If it has any probative value, that probative value is outweighed by the risk of the jury overvaluing the evidence.

1. The prosecution made similar submissions to those the prosecution made in relation to the impugned evidence summarised in the Summary of Prosecution Opening at [274]. In short, Fox-Henry's evidence is inconsistent with it being an automatic download. It is relevant evidence of the accused's enduring interest in poisons.[29]

SPO [280] - BETWEEN 10.10.21 & 15.5.22, D "POSSIBLY ACCESS[ED]" A PDF TITLED 'MAY_2011_VICTORIAN_NATURALIST_128_183"

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

280. On a date between 10 October 2021 and 15 May 2022 (before Simon Patterson's second illness), a 'string', including the words 'C:\\\\Users\\\\erinp\\\\Downloads May_2011_Victorian_Naturalist_128_183.pdf\' was present on a computer which was seized from the accused's home. This data was later recovered as text documents from the AppCache data. The 'string' identifies that a path to a pdf entitled 'May_2011_Victorian_Naturalist_128_183' was present on the accused's computer, indicating possible access to that document. The May 2011 edition of The Victorian Naturalist featured an article called 'An overview of the fungi of Melbourne', authored by Dr Tom May, which appeared in volume 128 at page 183 of that publication.

1. The device in question was a black Scorptec computer (PALM 202308-C-0124-0008).
2. The relevant Extraction Record is Extraction Record 10.[30] Extraction Record 10 states, relevantly:

1. The 'file' that was recovered was an AppCache 'string':

{\"Type\":1,\"Name\":\"May_2011_Victorian_Naturalist_128_183\",\"Path\":\"C:\\\\Users\\\\erinp\\\\Downloads\\\\May_2011_Victorian_Naturalist_128_183.pdf\",\"Description\":\"May_2011_Victorian_Naturalist_128_183 (C:\\\\Users\\\\erinp\\\\Downloads)\",\"Date\":\"2022-5-14\",\"Points\":1}[31]

1. Investigators located an article in Volume 128 of the Victorian Naturalist magazine at p 183 which is titled 'An Overview of the Fungi of Melbourne' and is by Tom May.[32] The article was not located on the black Scorptec computer. The article contains several references to Death Cap amanita phalloides,[33] indicating that they are found under oak trees. The article includes a prominent photo of some death cap mushrooms under oak trees on the Oak Lawn at the Royal Botanical Gardens Melbourne.[34]
2. It is not in dispute that the operating system on the black Scorptec computer was installed on 10 October 2021[35] or that the relevant AppCache string was saved on the black Scorptec computer on 15 May 2022. Hence if the accused accessed the relevant article online, it was between the alleged dates.

1. Fox-Henry said that an application cache (AppCache) is something used by a computer's operating system to 'speed up processes and improve user functionality'.[36] He said that a 'string' is a particular list of characters that are readable[37] and that it is an assumption where a particular string commences and ends.[38] He said that a string represents that 'that path existed on that computer at the creation of that app cache'.[39]
2. Fox-Henry was not specifically asked about this string. But in relation to another string, he said it would be 'speculation' what a string represents.[40]

1. The accused submitted that the data could only support a conclusion that on an unknown date within the date range someone using the computer 'had access' to a PDF of a publication which contained a number of articles about nature in Victoria. The accused submitted that, even if one assumed that the accused accessed Volume 128 of the Victorian Naturalist magazine, one could not reasonably infer that she read the article by Tom May on the fungi of Melbourne.[41]

1. The prosecution submitted that the evidence was relevant in that it was evidence of the accused's interest in death cap mushrooms in particular. Whilst this AppCache string considered in isolation did not support an inference that the accused accessed the relevant article, such an inference was reasonably open when one considered it in the context of other computer evidence demonstrating the accused's interest in death cap mushrooms, in particular the evidence summarised in the Summary of Prosecution Opening at [283] (see below). As for the accused's submission that, even if one assumed that the accused accessed the magazine in question it did not follow that she accessed the article concerning mushrooms, the prosecution highlighted the fact that the string in the app cache not only refers to Volume 128 of the Victorian Naturalist magazine but to the page number where the article by Dr Tom May on the fungi of Melbourne commences.[42]

SPO [281] - BETWEEN 10.10.21 & 22.5.22, D "POSSIBLY ACCESS[ED]" INFORMATION ON THE iNATURALIST WEBSITE CONCERNING AMANITA PHALLOIDES

1. The Summary of Prosecution Opening states, relevantly (footnotes deleted):

281. On a date between 10 October 2021 and 22 May 2022 (before Simon Patterson's second illness), a 'string', including the words 'Deathcap (Amanita phalloides) iNaturalist' was present on a computer which was seized from the accused's home. This data was later recovered as text documents from the AppCache data, located on the system file path 'C:\Users/erip/AppData\Packages\Microsoft.Windows.Search_cw5n1 h2txyewy\LocalState\DeviceSearchCache'. The 'string' identifies that a path to 'Deathcap (Amanita phalloides) iNaturalist' was present on the accused's computer, indicating possible access to that information.

1. The device in question was the black Scorptec computer.
2. The relevant Extraction Record is Extraction Record 41.[43]
3. The 'file' that was recovered was an AppCache 'string':

{\" Type\ " : 2, \ Name \": \"Deathcap (Amanita phalloides) iNaturalist\",\" Path\":\"C:\\\\ Program Files\\\\Google\\\\ Chrome\\\\Application\\\\chrome.exe\", \"Description\":\"} ...[44]

1. Fox-Henry said it is an assumption as to where the relevant string commences and ends, but he suggested[45] that the string reads as set out above. When asked in cross‑examination what the string indicated he said 'that that string was present on that device on the date of that creation of that file'.[46] When asked whether the string provided any information about 'user interaction with that entry', he replied 'not that I'm aware of and nothing that I'd be confident answering'.[47] When asked in re‑examination what this string represented, he said 'That that path existed on that computer at the creation of that app cache'. When asked what the user would be seeing on the computer, he answered 'It would be purely speculation'.[48] He concluded by saying 'all I can determine from this string is that that path is present on the computer, and ... it appears to be associated with Google Chrome'.[49]

1. The accused submitted that the impugned evidence is irrelevant (ss 55, 56). The accused submitted that the prosecution could not prove that the accused accessed the relevant file. The file is nothing more than an AppCache string. The accused relied in particular on Fox-Henry's evidence that, as far as he was aware, the AppCache string did not provide any information as to user interaction and, assuming that a person was responsible for the string, it would be speculation to say what the user would have been seeing on the screen when the string was created. In the alternative, the accused submitted that the probative value of the evidence was outweighed by the risk of unfair prejudice (s 137).[50]

1. Notwithstanding the limited data, the prosecution submitted that when one considers the string references to iNaturalist and death cap mushrooms in the light of other computer evidence of the accused searching that website for information on death cap mushrooms (see especially the Summary of Prosecution Opening at [283]-[285]) one could reasonably infer that the accused had accessed iNaturalist about death cap mushrooms on an occasion between 10 October 2021 and 22 May 2022.[51]

SPO [283]-[285] - On 28.05.22, D ACCESSED THE iNATURALIST WORLD MAP OF DCM SIGHTINGS, INCLUDING IN BRICKER RESERVE, MOORABBIN, MELBOURNE

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

283. On 28 May 2022 at 7.20pm, two days after Simon Patterson was discharged from Mansfield Hospital and before he was taken to Casey Hospital by ambulance, the accused, using a computer which was later seized from her home, utilised the online search engine Bing to search for the term 'inaturalist', before navigating to the iNaturalist webpage. At 7.22pm, the accused navigated to a webpage on the iNaturalist site featuring a world map with geographic locations of death cap mushroom sightings. At 7.23pm, the accused navigated to a webpage on the iNaturalist website featuring a purported sighting of death cap mushrooms in Bricker Reserve, Moorabbin on 18 May 2022 (10 days prior) posted by user 'ivan-theaged'. A record of this search and website access was preserved in the computer's data as various artifacts, namely: Windows Timeline Activity artifacts, Parsed Search Queries artifacts, Edge/Internet Explorer 10-11 Daily/Weekly History artifacts, Edge/Internet Explorer Main History artifacts, Potential Browser Activity artifacts, Chrome Web History artifacts, a Chrome Shortcut artifact, Chrome Favicons artifacts, Chrome Web Visit artifacts, Edge Chromium Web History artifacts, Edge Chromium Web Visits artifacts, IE InPrivate/Recovery URL artifacts, Chrome Cookies artifacts, Edge Chromium Cookie artifacts and Chrome Cache Records artifacts.

284. Simultaneously, at 7.23pm, the accused navigated to the website of the Korumburra Middle Pub via the Google search engine. She used the website to order a 'family pack' of food, to be delivered to the accused's address of 46 Shellcot Road Korumburra. The accused's phone number ending 783 and name were entered into the website using Chrome Autofill. The accused's purchase was confirmed by the Korumburra Middle Hotel, who provided a receipt in the name of Erin Patterson for the purchase of meals and a bottle of soft drink, utilising the hotel's online ordering provider, YourOrder.[52]

285. The accused's online activities on 28 May 2022, in navigating to the iNaturalist website and ordering food online from the Korumburra Middle Pub, were also captured as text documents from the AppCache data.

1. The device in question was a Cooler Master Computer (PALM 202308-C-0124-0011).

1. During oral submissions, the accused withdrew her objection to the admissibility of this evidence, conceding that, unlike the other impugned files, there is 'a wealth of information'[53] regarding the accused's online activities on this occasion.

SPO [287] - BETWEEN 5.09.22 & 1.05.23, D "POSSIBLY ACCESS[ED]" INFORMATION ON iNATURALIST REGARDING POISON HEMLOCK IN POOWONG RD, LOCH

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

287. On a date between 5 September 2022 and 1 May 2023, a 'string', including the words 'poison hemlock from Loch-Poowong Rd, Loch, VIC, AU on 05 September, 2022 at 12:38 PM by moosemerrick97·iNaturalist\' was present on a computer which was seized from the accused's home. This data was later recovered as a text document from the AppCache data, located on the system file path 'C:\Users/erip/AppData\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache'. The 'string' identifies that a path to 'poison hemlock from Loch-Poowong Rd, Loch, VIC, AU on 05 September, 2022 at 12:38 PM by moosemerrick97·iNaturalist\'' was present on the accused's computer, indicating possible access to that information.

1. The device in question was the black Scorptec computer.
2. The relevant Extraction Record is Extraction Record 79.[54]
3. The 'file' that was recovered was an AppCache string:

{\"Type\":2,\"Name\":\"poison hemlock from Loch-Poowong Rd, Loch, VIC, AU on 05 September, 2022 at 12:38 PM by moosemerrick97 · iNaturalist\",\"Path\":\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"Description\":\"\"}

1. The accused submitted that this evidence was irrelevant. Even assuming that the accused accessed information about hemlock in Loch on the iNaturalist website between the dates alleged, it is not asserted by the prosecution that the accused ever accessed hemlock, let alone poisoned Simon Patterson with hemlock. The accused submitted that the wide date range is 'also a barrier' to the admissibility of this evidence. Alternatively, the accused submitted that the information is of slight probative value whereas the risk of unfair prejudice is 'overwhelming'.[55]

1. The prosecution submitted that the evidence is relevant because it shows the accused's interest in poisons and her knowledge of and use of the iNaturalist website.[56]

SPO [289] - ON 15.11.22, D "HAD ACCESS TO" A PDF CONCERNING "ONE STEP PURIFICATION & CHARACTERISATION OF ABRIN TOXIN FROM ABRUS PRECATORIUS SEEDS"

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

289. On or before 15 November 2022, the accused, using a Samsung mobile phone which was later seized from her home, had access to a pdf file entitled '0@pdf_1668470640330.pdf' which is an article entitled 'One step Purification and Characterisation of Abrin Toxin from Abrus Precatorius Seeds'. This article originates from the October 2019 issue of Defence Life Science Journal.

1. The device in question was a black Samsung mobile phone (PALM 202308-C-0124-0012).
2. The relevant Extraction Record is Extraction Record 87, which indicates the PDF was 'modified' on 15 November 2022.[57]
3. According to the prosecution, the article in question was located on the black Samsung mobile.[58]

1. The accused submitted that this evidence was irrelevant. Even assuming that the accused accessed information about Abrin on or before 15 November 2022, it is not asserted by the prosecution that the accused ever accessed Abrin toxin or Abrus precatorius seeds, let alone poisoned Simon Patterson with Abrin toxin. The accused submitted that the date uncertainty further diminishes the probative value of the evidence.[59]

1. The prosecution submitted that the evidence was relevant to the accused's interest in poisons. The prosecution highlighted that the article was saved on the black Samsung mobile and was recoverable from the device.[60]

SPO [290] - ON OR BEFORE 18.11.22, D "HAD ACCESS TO" AN IMAGE OF A DOCUMENT REGARDING RICIN TOXICITY

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

290. On or before 18 November 2022, the accused, using a Samsung mobile phone which was later seized from her home, had access to an image file entitled '613.jpg', which is an image of a document related to ricin toxicity.

1. The device in question was the black Samsung mobile.
2. The relevant Extraction Record is Extraction Record 26.[61] The file path indicates the file was 'cached':

EXTRACTION_FFS.zip/data/data/com.sec.android.app.my files/cache/613/jpg

1. The accused submitted the evidence was irrelevant. The accused submitted that because the computer record is limited to a 'thumbnail', one cannot discern what interaction if any there was between the user and the data. Even if the accused was the user and accessed the data, there is no evidence the accused ever accessed or used ricin, let alone poisoned Simon Patterson with ricin. If relevant, the accused submitted that Fox-Henry was not an expert in relation to operating systems on Samsung mobile phones and consequently, the evidence was excluded by s 76. Further, the accused submitted any slight probative value was outweighed by the danger of unfair prejudice.[62]

1. The prosecution submitted that the evidence is relevant as proof of the accused's interest in poisons. The prosecution noted investigators were able to photograph and enlarge the thumbnail of the document and thus determine that it concerned ricin toxicity. The prosecution submitted that Fox-Henry was qualified to give evidence regarding this thumbnail.[63]

SPO [291] - ON OR BEFORE 18.11.22, D "HAD ACCESS TO" AN IMAGE OF AN ARTICLE TITLED "ABRUS PRECATORIUS POISONING: A RETROSPECTIVE STUDY OF 112 PATIENTS"

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

291. On or before 18 November 2022, the accused, using a Samsung mobile phone which was later seized from her home, had access to an image file entitled '614.jpg' which is an image of a document or article entitled 'Abrus precatorius Poisoning: A Retrospective Study of 112 Patients'.

1. The device in question was the black Samsung mobile.
2. The relevant Extraction Record is Extraction Record 27.[64] The file path indicates the file was 'cached':

EXTRACTION_FFS.zip/data/data/com.sec.android.app.myfiles/cache/614.jpg

1. The accused submitted the evidence was irrelevant. There is no evidence that the accused interacted with the data. Even if she had there is no evidence that the accused ever accessed Abris precatorius seeds, let alone used them to poison Simon Patterson.[65]

1. The prosecution submitted the evidence is relevant as proof that the accused was interested in poisons.[66]

SPO [292] - ON OR BEFORE 2.12.22, D "HAD ACCESS TO" AN IMAGE OF AN ARTICLE TITLED "ONE STEP PURIFICATION & CHARACTERISATION OF ABRIN TOXIN FROM ABRUS PRECATORIUS SEEDS"

1. The Summary of Prosecution Opening states, relevantly (footnotes deleted):

292. On or before 2 December 2022, the accused, using a Samsung mobile phone which was later seized from her home, had access to an image file entitled '417.jpg' which is an image of the article titled 'One step Purification and Characterisation of Abrin Toxin from Abrus Precatorius Seeds', which is an article that originates from the October 2019 issue of Defence Life Science Journal (as detailed above).

1. The device in question was the black Samsung mobile.
2. The relevant Extraction Record is Extraction Record 17.[67] The file path indicates the file was 'cached':

EXTRACTION_FFS.zip/data/data/com.sec.android.app.myfiles/cache/417.jpg

1. The accused submitted that this evidence is irrelevant. Because it is a cached thumbnail, one cannot say what interaction if any the user had with the data. Even if the accused had interacted with the data, there is no evidence that the accused ever accessed Abrin toxin, let alone poisoned Simon Patterson with it.[68]

1. The prosecution submitted this evidence is relevant as proof that the accused was interested in poisons.[69]

SPO [301] - BETWEEN 10.10.21 & 1.5.23, D "POSSIBLY ACCESS[ED]" INFORMATION PERTAINING TO 'POISONS HELD; EMERGENCY IDENTIFICATION FOR MUSHROOMS AND PLANTS'

1. The Summary of Prosecution Opening states relevantly (footnotes deleted):

[301] On a date between 10 October 2021 and 1 May 2023, a 'string', including the words 'Poisons Help; Emergency Identification for Mushrooms & Plants|Facebook' was present on a computer which was seized from the accused's home. This data was later recovered as a text document from the AppCache data. The 'string' identifies that a path to 'Poisons Help; Emergency Identification for Mushrooms & Plants|Facebook' was present on the accused's computer, indicating possible access to that information.

1. The device in question was the black Scorptec computer.
2. The 'file' that was recovered was an AppCache 'string':

{\"Type\":2,\"Name\":\"Poisons Help; Emergency Identification For Mushrooms & Plants | Facebook\",\"Path\":\"C:\\\\ProgramFiles\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"Description\":\"\"},{\"Type\":2,\"Name\":\"Poisons Help; Emergency Identification For Mushrooms & Plants |Facebook\",\"Path\":\"C:\\\\ProgramFiles\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"Description\":\"\"}[70]

1. The accused submitted that this evidence is irrelevant. One cannot say what interaction if any the user had with the data. Even if the user interacted with the data, one cannot say that the accused was the user.[71]

1. The prosecution submitted that the evidence is relevant as proof of the accused's interest in poisons.[72]

1. [REDACTED]
2. [REDACTED]
3. [REDACTED]
4. [REDACTED]
5. [REDACTED]

Detective Leading Senior Constable (DLSC) Eppingstall

1. [REDACTED]
2. [REDACTED]
3. [REDACTED]
4. [REDACTED]

1. [REDACTED]
2. [REDACTED]
3. [REDACTED]
4. [REDACTED]

SPO [308] - BETWEEN 10.10.21 & 16.5.23, D "POSSIBLY ACCESS[ED]" TWO ARTICLES CONCERNING DCMs TITLED "MEDICAL ERROR IN TREATMENT OF AMANITA PHALLOIDES IN PRE-HOSPITAL CARE" & "TWO DIE AFTER EATING DEATH CAP MUSHROOMS"

1. The Summary of Prosecution Opening states, relevantly (footnotes deleted):

308. On a date between 10 October 2021 and 16 May 2023, a 'string', including the words 'Medical error in treatment of Amanita phalloides in pre-hospital care | Scandinavian Journal of Trauma, Resuscitation and Emergency Medicine' and the words 'Two die after eating death cap mushrooms' was present on a computer which was seized from the accused's home. Both articles were subsequently obtained by police. This data was later as a text document from the AppCache data, located on the system file path 'C:\Users/erip/AppData\Packages\Microsoft. Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache'. The 'string' identifies that paths to 'Medical error in treatment of Amanita phalloides in pre-hospital care | Scandinavian Journal of Trauma, Resuscitation and Emergency Medicine' and to 'Two die after eating death cap mushrooms' were present on the accused's computer, indicating possible access to that information.

1. The device in question was the black Scorptec computer.
2. The relevant Extraction Record is Extraction Record 81.[73]
3. The 'files' that were recovered were the following AppCache strings:

{\"Type\":2,\"Name\":\"Medical error in treatment of Amanita phalloides poisoning in pre-hospital care | Scandinavian Journal of Trauma, Resuscitation and Emergency Medicine | Full Text\",\"Path\":\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"Description\":\"\"}[74]

{\"Type\":2,\"Name\":\"Two die after eating death cap mushrooms\",\"Path\":\"C:\\\\ProgramFiles\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"Description\":\"\"}[75]

1. The first mentioned article, which is included in the Depositions,[76] indicates that a single death cap mushrooms can be fatal to humans. The article also includes the following information regarding its publication:
   • Received: 3 December 2021
   • Accepted: 8 March 2022
   • Published Online: 19 March 2022[77]
2. The second article, which is also included in the Depositions,[78] is an article from the Sydney Morning Herald dated 4 January 2012.

1. The accused submitted that the impugned evidence is irrelevant (ss 55, 56). The accused relied on the same submissions about the evidentiary limitations of AppCache strings as she did in relation to the Summary of Prosecution Opening at [280] above. The computer records may have been caused automatically, not by a person. Even if they were caused by a person, that person may not have been the accused. If the accused accessed the records, it is not known when they were accessed, they may not have been accessed proximate to the offending.[79] The evidence invites speculation. Alternatively, the accused submitted that the risk of unfair prejudice outweighed the probative value of the impugned evidence (s 137).[80]

1. The prosecution submitted that this evidence is relevant to prove the accused's interest in death cap mushrooms and for a tendency purpose, namely, to show that the accused had a tendency to access information online concerning death cap mushrooms. The prosecution implicitly adopted its submissions regarding the inferences that could reasonably be drawn from other AppCache strings.[81]

1. Before turning to my analysis, it may be helpful to summarise the parties' submissions.

1. The accused submitted that the impugned evidence was irrelevant (ss 55, 56). Alternatively, the accused submitted that its probative value was low and was outweighed by the danger of unfair prejudice to the accused (s 137). In one instance, the accused submitted that the impugned evidence was also excluded by s 76.[82]
2. More particularly, the accused's objections to the various files were as follows:
   • The file may have been captured by the computer automatically, not as a result of a person knowingly accessing the file;
   • Even if a person knowingly accessed the file, that person may not have been the accused;
   • Even if the accused knowingly accessed the file, the accused may not have read the file;
   • Even if the accused read the file, the accused's interaction with the file may be temporally remote from the alleged poisonings;
   • Even if the accused read the file proximate to the alleged offending, it does not necessarily show that the accused was interested in poisons;
   • Even if the accused was interested in poisons, that does not make it more likely that the accused committed the alleged offence. Such access may have been due to innocent reasons, such as the accused's interest in true crime.[83]

1. The prosecution submitted that not only was the impugned computer evidence concerning poisons relevant (ss 55, 56), its probative value was high and was not outweighed by the danger of unfair prejudice to the accused. Any danger of unfair prejudice could be cured by appropriate directions.
2. The prosecution submitted that a jury could reasonably infer from the evidence, considered as a whole, that:
   • the accused was repeatedly accessing files on poisons during a time proximate to the alleged offending;
   • that by reason of such access, the accused had a continuous state of mind,[84] namely, an interest in poisons in general and death cap mushrooms in particular;
   • that the accused's interest in poisons makes it more likely that the accused deliberately poisoned the alleged victims and did so with murderous intention.
3. The prosecution also submitted that some of the files are relevant to proving that the accused had a tendency to access information about death cap mushrooms, including on the iNaturalist website. That alleged tendency evidence will be the subject of another ruling. Suffice to say here that the accused relies on the alleged tendency as some proof that the accused, at a time proximate to the fateful lunch on 29 July 2023, accessed information on the iNaturalist website about sightings of death cap mushrooms in Loch and Outtrim which are towns near Leongatha where the accused was living during 2023. It is the prosecution's case, relying on cell tower evidence (which is the subject of another ruling),[85] that the accused visited those towns on 28 April 2023 (Loch) and 22 May 2023 (Loch and Outtrim), sourcing death cap mushrooms from one or other of those locations for the Beef Wellingtons served to her lunch guests.

1. It was made clear by the prosecution in the course of oral submissions that, notwithstanding the repeated references in the Summary of Prosecution Opening to the accused possibly accessing the relevant files (or words to that effect), the prosecution is actually alleging that, having regard to all the impugned files, as well as other evidence upon which the prosecution relies, that one can reasonably infer that the accused accessed the relevant files in each instance.[86]
2. In assessing the relevance and probative value of the impugned files one must, of course, assume that the jury will accept the evidence and take it at its highest but, even so, it rises no higher in most instances than the accused possibly accessed the file in question. It is true that the test of relevance only requires a minimal logical link between the evidence and the ultimate facts in issue, but there must be a rational basis for inferring that the accused accessed any particular file. Whilst I consider it unlikely that all or most of the files found on the accused's devices were the result of automatic computer processes of which the accused was unaware, the expert evidence in relation to any particular file (save for the files referred to in the Summary of Prosecution Opening at [274], [276] and [302]-[304]) supports the possibility that it may have been automatically 'captured'. This state of affairs is effectively conceded by the prosecution in the Summary of Prosecution Opening by its repeated use of the phrase 'possibly accessed' or words to that effect. Considering the impugned computer evidence as a whole, in combination with the other evidence relied on by the prosecution, does not remove this impediment to the prosecution establishing that it is a reasonable inference that the accused actually accessed a particular file.
3. Accordingly, with respect to all the files, except those referred to in the Summary of Prosecution Opening at [274], [276] and [302]-[304]), I find that they fail the test of relevance because the evidence does not support more than an inference in relation to any particular file that the accused possibly accessed that file.
4. As regards the files referred to in the Summary of Prosecution Opening at [274] and [276], Fox-Henry ultimately rejected the suggestion that the computer records were consistent with those files being automatic downloads.[87] However, they were downloaded on 12 October 2019 and 27 October 2020 which, in my view, is temporally remote from the first of the charged offences, allegedly committed on 16 November 2021. I accept the accused's submission that the analogy drawn by the prosecution with Elomar is inapt for the reason stated by the accused (see above).
5. [REDACTED]
6. [REDACTED]
7. [REDACTED]
8. [REDACTED]
9. [REDACTED]
10. [REDACTED]
11. [REDACTED]
12. [REDACTED]
13. [REDACTED]
14. [REDACTED]

[1] I note that during oral submissions, the accused withdrew her objections to the admissibility of evidence summarised in the amended Summary of Prosecution Opening (SPO) at [283]-[285] and [299].

[3] Unless otherwise indicated, the contents of this Glossary are drawn from Fox-Henry's statement dated 30 September 2024.

[4] Definition included in Fox-Henry's statement dated 2 July 2024.

[5] On slide 16 of Fox-Henry's draft PowerPoint dated 6 February 2025, Fox-Henry includes caveats to his comments on caches.

[6] Consolidated Transcript of the s 198B hearings conducted before Freeman JR in 2024 (CTA), 1130.12‑13, 1132.9-11. Fox-Henry said it is an assumption where a particular string commences and ends: CTA, 1130.29-30.

[8] I note that "iNaturalist" is a website which, amongst other things, includes information about sightings of death cap mushrooms. The prosecution alleges that the accused accessed that website to find the whereabouts of DCMs to put in the Beef Wellingtons that she served to her lunch guests on 29 July 2023.

[10] See Slide 6 of Fox-Henry's draft PowerPoint dated 6 February 2025 which was tendered as an exhibit at the s 198B hearing before me on 7 July 2025.

[22] CTA 1109.10-11; D1088.2468 lines10-11.

[23] Defence Folder Tab (DFT) 1; Defence Written Admissibility Submissions 1 (DWAS1), [87, 92-94, 98, 173]; Defence Written Admissibility Submissions 2 (DWAS 2) [3b]; Defence Oral Submissions (DOS), Consolidated Transcript of Pre-Trial Argument (CTB), 1013-1015, 1107-1108, 1294-1295.

[24] Prosecution Folder Tab (PFT) 11; Prosecution Written Admissibility Submissions (PWAS) [42]; Prosecution Oral Submissions (POS) (CTB 1171-11176, 1255-1258).

[27] D1088.2468 lines10-11; CTA 1109.10-11.

[28] DFT 3; DWAS 1 [95]; DWAS 2 [3(c)]; DOS (CTB 1015-1016).

[29] PFT 12; PWAS [43]; POS (CTB 1258-1259).

[41] DFT 4; DWAS 1 [101-102]; DWAS 2 [3]; DOS (CTB 1016-1018, 1109-1111, 1113).

[50] DFT 5 (see also transcript extracts behind Tab 4); DWAS 1 [87]; DWAS 2 [3a], [11(l)]; DOS (CTB 1111-1112).

[51] PWAS [47]; POS (CTB 1177-1182, 1261-1262).

[52] For the avoidance of doubt, I note that, as proof that the accused was the one who conducted the iNaturalist search in relation to death cap mushrooms, the prosecution relies on the computer records that show that, a few minutes later, the accused used the same computer to order food online from the Korumburra Middle Pub.

[55] DFT 7; DWAS 1 [87,109-112]; DWAS 2 [3(a)(D)]; DOS [Nil].

[57] There is no page reference in the Depositions for this record, but it was included behind DFT 8.

[59] DFT 8; DWAS 1 [45(d), 87, 113(a)]; DWAS 2 [3(c)(C)]; DOS (CTB 1006, 1299-1301).

[60] PFT 16; PWAS [52]; POS (CTB 1265-1266).

[62] DFT 9; DWAS 1 [113(b)]; DWAS 2 [3(b)(A)]; DOS (CTB 1144-1145, 1303-1304).

[63] PFT 17; PWAS [53]; POS (CTB 1266-1268).

[65] DFT9; DWAS 1 [87,113]; DWAS 2; DOS (CTB 1006,1124-1125).

[66] PFT 18; PWAS [54]; POS (CTB 1268).

[68] DFT 10; DWAS 1 [45(d), 87, 113(c)]; DWAS 2 [3(b)(c)]; DOS (CTB 1126-1128).

[69] PFT 19; PWAS [55]; POS (1268-1269).

[71] DFT 12; DWAS 1 [115]; DWAS 2 [3(a)(e)]; DOS (CTB 1283).

[80] DFT 15; DWAS 1 [129]-[131]; DWAS 2 [3a]; DOS (Nil).

[84] See Elomar v R [2014] NSWCCA 303; (2014) 316 ALR 206 at [361]-[372]; Davies v R [2019] VSCA 66 at [104]-[110]; Higgins (a pseudonym) v R [2016] VSCA 47.

[85] R v Patterson (Ruling 2) VSC 103R.

[87] I am mindful of the fact that Fox-Henry initially said "I don't know for certain" when asked if the relevant files could have been an automatic download but his ultimate position when pressed was that the file or directory path was inconsistent with an automatic download. In any event, "certainty" is not required for admissibility. The issue is whether the inference posited by the prosecution (namely, the accused having downloaded the PDF) is a reasonable inference.