Bell [Canada] records when they gave you that IP address and gives it to you
for certain amount of time. Then after — sometimes with Bell [Canada] it
could be three weeks, it could be three days, it could be — the most I’ve seen
is about two months with Bell [Canada] for them to allow you to keep an IP
address, then you change it in for another one.
 For example, consideration of Exhibit 3, the “Combined
table of all the NCMEC report time discrepancies”, and the
NCMEC Report, makes it apparent that IP address 188.8.131.52
was associated with the appellant’s address both for the uploads
on May 14 and May 19, 2012. A reasonable inference is that the
appellant’s IP address did not change between May 14 and May
19. The time discrepancy of seven hours did not eliminate the
value of the NCMEC Report, which had to be weighed in the context of all the information.
 I add another observation. The times at which the files
were uploaded were pertinent to the grounds, but the times at
which Microsoft generated its incident reports were not. Cst.
MacDonald was steadfast in his testimony, even on the first day,
that the upload times in the NCMEC reports were accurate. His
testimony about the uploading times was based on his training
and experience. He testified that the GMT upload times and the
IP addresses were bound together in the computer logs. So, while
the times of the incident reports may have been puzzling, all the
evidence in the record was that the upload times were those indicated in the NCMEC Report. It was only the upload times that
were pertinent to the sufficiency of the grounds.
 Nevertheless, the trial judge never engaged Cst.
MacDonald’s explanation of the time discrepancy on its merits,
but simply refused to accept it because he had not verified it with
Microsoft. Cst. MacDonald’s explanation of the time discrepancy
was compelling and uncontradicted. The trial judge did not consider whether an issuing justice could have reasonably believed
( iv) Staleness
The trial judge’s reasons
 The NCMEC Report indicated that the files containing the
child pornography were uploaded to SkyDrive between May 10
and May 19, 2012. The search warrant was executed on January
 Cst. MacDonald was extensively cross-examined about the
“chances” the search would obtain relevant evidence after the
passage of more than seven to eight months. He was forthright
that he could not say what the chances were and that answering
the question would require him to speculate.