Maarten Kleintjes, national manager of the electronic crime laboratory, was called as an expert witness on the 10th day of 36-year-old David Cullen Bain's second trial for the murders of his parents and three siblings at their Every St home on June 20, 1994.
The Crown says Bain shot his family and made it look as if his father was responsible, leaving a message on the family computer "Sorry, you are the only one who deserved to stay".
But the defence contends Bain's father Robin murdered his wife and three of their children before shooting himself, that he was the person who wrote the message on the computer and that David Bain found his family dead when he came home about 6.45am.
A crucial issue for both Crown and defence is the time the computer was switched on that morning.
If it was switched on before 6.45am, the defence says David Bain could not be the killer as he was still returning from his paper round.
Bain (36) denies shooting his father Robin Bain (58), mother Margaret (50), sisters Arawa (19) and Laniet (18) and 14-year-old Stephen.
His retrial before Justice Graham Panckhurst and a High Court jury in Christchurch goes into its third week of hearing on Monday.
Prosecuting the case are Kieran Raftery, Cameron Mander and Robin Bates, while Bain is represented by Michael Reed QC, Helen Cull QC, Paul Morten and Matthew Karam.
Mr Kleintjes was the only witness to give evidence yesterday.
He told the court he was asked in June 1997 to do a forensic examination of the computer taken from the Bain house.
He used the information presented at Bain's first trial in 1995 by Martin Cox, a University of Otago computer expert.
Mr Cox examined the computer at the house on June 21, the day after the murders.
He saved the message, took the file "saved" time and worked back to establish the switch-on time, concluding the computer had been opened 36 hours and 31 minutes earlier.
That gave a switch on time of 6.44am the previous day.
But on Thursday, Mr Cox accepted that, because the watch worn by the detective timing the process was two minutes fast - something Mr Cox did not know at the time - the time he had calculated as the start time would have been out by about two minutes.
Mr Kleintjes told the court yesterday that when he examined the computer in 1997, he was able to make a clone of the hard drive to preserve everything on it and carry out tests on the clone without interfering with the data on the original had drive.
That particular technology had not been available to Mr Cox in 1994, he said.
He found the hardware clock in the computer was not working as the battery was flat and, because the system clock only ran when the computer was turned on and stopped when the machine was turned off, it acted like a stop watch.
He put a new battery in the hardware clock and found the two clocks did not keep accurate time with each other.
Using more advanced technology than was available in 1994 to get a time off the computer, he was able to find seconds, as well as hours and minutes, Mr Kleintjes said.
He found another 54 seconds Mr Cox would not have found because he could get only a minute time.
Another variable was the time Mr Cox would have taken to do the original work on the computer.
He would have had to stop and think through every keystroke because he was working on live evidence.
And the watch used by then Detective Kevin Anderson to time the exercise did not have a second hand or separate minute markings, but only five minute increments.
The watch was square and the time seen could vary depending on the angle the watch was being looked at, Mr Kleintjes said.
Although the watch was checked as two minutes fast, nine days after the computer check with Mr Cox, it could have been accurate, or fast or slow that day because of the delay in checking.
And the check was a Telecom voice time check, with only the minute time given, not the seconds.
