It seemed rather fortunate that the 'Halloween' card mailed on October 27th 1970, if designed totally independently to the 340 cipher, that Paradice and Slaves could be found perfectly bisecting the 340 cipher, 17 by 17 characters. Not to mention the word "By" being found in all four quadrants. This is discussed in more detail in the article 'The Illusion of the 340 Cipher.'  
The 'Halloween' card was almost certainly highlighting the Lake Berryessa attack on Bryan Hartnell and Cecelia Shepard, tied up with rope (plastic clothesline) and brutally stabbed sixteen times by the Zodiac Killer. The phrase "peek-a-boo you are doomed" referencing the children's game peekaboo, where 'hiding behind that tree' is sometimes added. This would also be the second time "by knife" would be used - linking the 'Halloween' card to the Volkswagen Karmann Ghia of Bryan Hartnell.
Since these two 'methods of death' (rope and knife) were instrumental to the attack on the young couple, we will focus on Paradice, Slaves, By Knife and By Rope. 
On the 'Halloween' card it is apparent that "By" is written vertically for "knife" rather than horizontally, as displayed by the other 'methods of death'. Could this be a sinister inference to a knife being driven downwards and the predominant focus of this card?   

If we color in the five characters underneath the 'Y' in the bottom left quadrant of the cipher, as is portrayed on the 'Halloween' card, it can be seen that the 'right facing V' would represent the 'E' of knife.
If we  color in the four characters underneath the 'B' in the bottom right quadrant of the cipher, as is portrayed on the 'Halloween' card, it can be seen that the 'right facing V' would represent the 'E' of rope.
To complete the word Paradice and Slaves a 'left facing V' had to be found in the last section of both words for parity. In this instance a 'left facing V' represented the letter 'E'.
When the Zodiac Killer introduced his 408 cipher in the July 31st letters, he stated "Here is part of a cipher" or "Here is a cyipher." When challenged to design another cipher by D.C.B. Marsh in the San Francisco Examiner on October 22nd 1969, the 340 cipher arrived just over two weeks later. The article was entitled 'Cipher Expert Dares Zodiac to Tell Name'. Bearing in mind that the 340 cipher began with "Her," could it have started with "Here is a cipher" or "Here's a cipher" (to marry with the 'P' of Paradice) in direct response to cryptographic expert D.C.B. Marsh.
There are 10 'left or right facing' V's in the entire 340 cipher. If the latter hypothesis was correct, then at least 50% of these would be represented by the letter E, in respect of Here, Paradice, Slaves, Rope and Knife.  

The following is a little background information for people just starting to learn about the Zodiac case.
Approximately seventy minutes after the attack on Bryan Hartnell and Cecelia Shepard at Lake Berryessa, the Zodiac Killer made a payphone call to the Napa County Sheriff's Department from a payphone located near the corner of Main and Clinton Streets, just slightly north of the old Sam Kee Laundry Building, now a wine tasting bar called Vintner's Collective. 

The phone call was received by stand-in dispatcher Dave Slaight who heard Zodiac speak the words "I want to report a murder, no, a double murder. They are two miles north of Park Headquarters. They were in a white Volkswagen Karmann Ghia. I'm the one that did it." After completing his message, the killer, probably learning from his experience at Blue Rock Springs, failed to hang up the phone. Dave Slaight contacted the Sheriff's Office to inform them of the call.
At approximately 7:45 pm the Napa County Sheriff's Office, unable to trace the call, asked for assistance- and a news director at KVON radio by the name of Pat Stanley sprang into action after hearing about the brutal attack on his police scanner.
He stated "The receiver on the phone the Zodiac used was put down, but not hung up. Technology then was not like it is today. The phone company could only report that the call came from a pay telephone somewhere between Lake Berryessa and Napa. The Napa County Sheriff's Department wanted to find the phone, and fast, so virtually any official with a radio was asked to help.
This reporter jumped into action. After a brief stop at the Sheriff's Department, I drove north on Main Street. Driving past a car wash and the historic Sam Key Laundry Building, I spotted a pay phone, but thought the call must have come from closer to the lake, nearly 30 miles away. At the last second, though, I swerved my car toward the phone booth and was shocked to find the receiver off the hook. I used my own two-way radio back to KVON where I instructed the on-duty deejay to call police. They, in turn, told me not to move until officers arrived." 
Napa Valley Register.    

The payphone receiver was found laying on the shelf where it had been placed down by the Zodiac Killer. The phone company couldn't trace the call using 'ring-back', as had been the case at Blue Rock Springs. So, when Pat Stanley arrived, how could he be certain that this was the correct payphone used by the Zodiac Killer. This is where Dave Slaight helps out.
In the 2007 Zodiac documentary he stated "As I sat there I could hear voices in the background and traffic. So I called the Sheriff's Office on another line and kept the one line open. The Sheriff's Office had broadcast, I had possibly broadcast, I'm not exactly positive, that this person had left the phone off the hook. As it turned out one of the local reporters for the newspaper had heard this broadcast on his scanner, and so he started driving around the city of Napa to see if he could find the phone, and he was the one who actually saw the phone. He was then yelling "can you hear me, can you hear me," and I could hear the voice, and that's how we located the phone." 
They were able to confirm that this was the correct payphone because police dispatcher Dave Slaight kept the connection alive, making contact with Pat Stanley. 
However, when Pat Stanley yelled "can you hear me, can you hear me" to Dave Slaight, had he picked up the receiver, accounting for the fresh palm prints recovered by police upon arrival, or was Pat Stanley simply shouting down the phone as it lay on the shelf. Some accounts state that the latent prints were effectively useless because of how they were recovered. One would suspect that responding personnel would have cross examined Pat Stanley as to whether he had handled the phone, thereby eliminating him as the contributor of any latent prints lifted from the receiver.
Why though, had the Zodiac Killer chosen this payphone? It wasn't located directly en route to Vallejo (assuming he lived there), suggesting the killer may have had some previous knowledge of downtown Napa. Perhaps he had previously frequented some establishments in the area of the payphone.   
The quickest and most direct route from Lake Berryessa to downtown Napa is via California State Route 121. Then you have to break off west and travel 1,100 meters (0.68 miles) away from State Route 121 to find the payphone. The alternative is heading west along Lincoln Avenue or Francis Street, then traveling south on Soscol Avenue, which brings you out on Clinton Street by the payphone.

One would have thought that there were more readily accessible payphones, had the killer been traveling directly back to Vallejo. It may suggest he knew of this payphone beforehand, and had it earmarked in advance of his Lake Berryessa attack. It certainly provides a good buffer zone from the Springs and Tuolumne payphone in Vallejo - fifteen miles south of this location. But, did he continue south and head towards Springs Road for a third time?

The sighting of a 'suspicious' male roaming the hillside of Lake Berryessa was reported by Dr Rayfield & Son and the three young women at different times during the Saturday of September 27th 1969. Two unusual or notable sightings, both at virtually the same location (0.8 miles from the Volkswagen Karmann Ghia), of similar description and separated by approximately 3 hours is certainly food for thought. If this was our suspect, then a comparison of his footprints to the boot prints documented from the Volkswagen Karmann Ghia to the crime scene, could have added considerable weight to the description given by the three young women. Bearing in mind their description led to the first sketch of the possible Zodiac Killer, it shouldn't have been too surprising that the description of the killer at Presidio Heights painted a different picture. The difference in hairstyle and the presence of prescription glasses probably the result of what had occurred two weeks earlier.
The Zodiac Killer stated in the November 9th 1969 'Bus Bomb' letter "I look like the description passed out only when I do my thing, the rest of the time I look entirle different. I shall not tell you what my descise consists of when I kill." His disguise in the instance of the Paul Stine murder likely not a disguise at all- just a radical change of his facial appearance because of his widely publicized exploits just 14 days previously.      

In a previous article entitled 'Lake Berryessa-The Two Sightings' the possibility of blood on the shirt of the subject viewed by Dr Rayfield & Son, along with the 70 minute difference between the supposed 6.30 pm attack and the phone call in Napa, were given as supporting evidence that the man described by Dr Rayfield & Son was actually the killer.
Some have wondered whether the couple were followed to Lake Berryessa, hence the killer's ability to connect the victims to the correct vehicle. 
According to Ken Narlow in the 2007 Zodiac documentary "There's a lot of activity up at Lake Berryessa during the summer months, but after Labor Day when all the kids go back to school it kind of quiets down. This was September 27th probably 3 and a half weeks after labor day, so it was a very, very quiet Saturday evening out there." 
Therefore, the ability to connect a vehicle to its owners wouldn't have been that difficult for a killer able to construct ciphers.
According to page 11 of the police report "Miss Marilyn Denise, a student at Pacific Union College, stated that about 5.15 pm Saturday 9/27/69 she was in the Lake Berryessa area with a male companion. She stated at this time they were parked on the Knoxville Road approximately one mile south of the Lake Berryessa Marina. She stated shortly after they parked the vehicle they observed the victims who were known to them, Bryan Hartnell and Cecelia Shepard, driving south on Knoxville Road in Bryan's white Karmann Ghia. She stated as the Hartnell vehicle drove by, Bryan waved out of the window and said "Hi John", referring to her companion."
It is clear from this statement that Bryan Hartnell and Cecelia Shepard would have parked up by 5.30 pm. Had the killer parked behind them shortly after, with the intention of trailing them to the edge of the lake, we would have to assume there was an approximate 40 minute delay before he first made contact with the couple. But, had the killer ever parked his vehicle to the rear of the Karmann Ghia, by the stile? The killer may have parked 0.8 miles north of the crime scene, hence the two sightings before and after the attack on Bryan Hartnell and Cecelia Shepard. It is perfectly conceivable he was traversing the hillside looking for vehicles and victims, rather than driving directly to this parking area. This may explain his confusion regarding the distance he stated in the later payphone call to police dispatcher Dave Slaight.   

The police report states "Reporting officer observed footprints leading from the foot stile to the passenger side of the Karmann Ghia. The footprints were measured and Sgt. T. Butler photographed the impressions. Sgt. Butler also photographed Reporting Officer pointing to the footprint which was to be cast. Said footprint indicating the direction of travel was toward the vehicle."
This is important, because if no footprints were leading towards the foot stile (only beyond the stile), then the killer may not have approached the crime scene from the car park, and by inference, hadn't parked his vehicle in this area.
It is extremely likely the killer wore gloves during the attack, as mentioned in the police report- so it would have been rather a strange decision to then drive 27 miles to Main Street and handle the telephone receiver with bare hands.
"At 20.50 hours Reporting Officer met Eric Ronback and Reserve Officer Donald Stanley at the Napa Car Wash, Main and Clinton Streets, They stated that they had secured the scene and the area around the phone had been searched for physical evidence. The phone booth was then processed for latent impressions and latent impression lifts #1 thru 35 were taken into evidence. Heavy beads of moisture remained on the impressions photographed." 
The Zodiac Killer was almost certainly right-handed, as he had holstered his gun on the right side during the attack on the young couple. Had these been the payphone prints of the killer, then they could have confirmed a right-handed assailant. Although not beyond argument, a right-handed killer would likely handle the telephone receiver with his left hand while dialing with his right. The four fingers of the left hand on the top side of the receiver. In the case of a left-handed person holding the receiver with their right hand, the four finger impressions would be on the opposite side of the receiver. If the killer was wearing leather gloves, this may still have opened up the possibility of confidently tying together this crime with the attacks at Blue Rock Springs and Presidio Heights.           

The leather gloves left in the taxicab of Paul Stine may have been mistakenly forgotten by a previous passenger, nevertheless, the attacker at Blue Rock Springs and Lake Berryessa on both occasions made a payphone call. Had the killer wore the same gloves during these two crimes, it is conceivable that the glove impressions (which are as unique as a fingerprint) could have been matched, along with any latent impressions taken from Presidio Heights- or the taxicab gloves themselves. This could have undeniably tied these three crimes together.
Assuming the physical evidence was retained from Presidio Heights, it shouldn't have been that difficult to detect any traces of airplane cement had the Zodiac used such a defense. 
"Many criminals often wear gloves to avoid leaving fingerprints, which makes the crime investigation more difficult. Although the gloves act as a protective covering for the wearer's prints, the gloves themselves can leave prints that are just as unique as human fingerprints, thus betraying the wearer. After collecting glove prints, law enforcement can then match them to gloves that they have collected as evidence as well as glove prints retrieved from other crime scenes.
In earlier decades, investigators would dust for fingerprints only to find smears and smudges caused by gloves. Often in earlier decades these smudges were ignored because very little of their detail was retrievable. With the advent of latent fingerprint detection in the late 20th century, investigators started to collect, analyze, and record prints left at crime scenes that were created by the wearing of gloves. Glove prints can be as simple as marks caused by seams or folds in fabric of a glove, or they can be as complex as marks left behind by the grain or texture of the fabric of a glove. When gloves are collected as evidence their prints can be taken and compared to glove prints that were taken at crime scenes or from evidence.
Over time, the pores and grain of leather gloves will pick up dirt and grease from surfaces that they have touched or handled. The dirt and grease can in return help to create prints on surfaces. Also, unlined gloves provide the most dexterity but can over time become saturated with the oils and sweat of the wearer's hands. This helps to increase the gripping properties of the gloves but causes the gloves to leave prints. A print that contains the glove wearer's sweat and oils will contain their DNA, which can incriminate them." Wikipedia.
With the 50th anniversary of the Lake Herman Road murders fast approaching, can another form of fingerprint evidence finally snare the Zodiac Killer- or are we heading to an irrevocable dead end.

At 4.20 pm on September 28th 1969 'Dean' from Pacific Union College contacted the Napa County Sheriff's Office and informed police that three young women from the college had been sunbathing by Lake Berryessa the day of the stabbings, outlining the girls recollections of a suspicious man in the vicinity who appeared to be watching them for a prolonged period.
One of the women recalled a man watching them from the edge of the trees for approximately 30 minutes, before the subject came down by the beach and passed within 20 feet. 
Sergeant Kenneth Narlow dispatched Deputy Sheriff Raymond Land to interview the girls that evening. The following morning (September 29th) he reported his findings to his superiors. At 2.45 pm that day, the three young girls came to the police department and were interviewed by Sergeant Lonergan, Sergeant Snook and Captain Donald Townsend. A sketch of the suspicious man was ultimately created from the three girls recollections. 
To this day, nobody knows for sure if this was the Zodiac Killer preparing for an attack on the young girls, before abandoning his plans and switching his attention to Bryan Hartnell and Cecelia Shepard some two hours later.
'Dean' contacted police at 4.20 pm, about 22 hours after the double stabbing by the lake. Had Deputy Sheriff Raymond Land and/or his superiors acted immediately after he interviewed the girls, and had took them back to the location where they saw the suspicious man standing/walking, then they could have compared the many boot prints leading from Bryan Hartnell's vehicle to the crime scene and back, with the boot prints of the suspicious man. This may have given us a definitive answer, on whether the murderer of Cecelia Shepard and the suspicious man were one and the same. It would also have given much more credence to the Lake Berryessa sketch over the Presidio Heights sketch, bearing in mind the length of time they viewed the man in daylight hours.  
The police report stated "When they left their car they noticed a subject driving a late model silver blue Chevrolet, 2-door sedan, pull up behind them. What appeared to be a white male adult was sitting in the vehicle. They did not observe this subject leave the vehicle. The girls proceeded to the beach area and were sunbathing in their bikinis. After approximately one-half hour had passed, they observed what appeared to be the same subject standing within 40 or 50 feet of them, apparently observing them." 
They described him to be 28-30 years of age during their interview at the police station. However, the day before, according to 'Dean', they had "described the subject as approximately 40 years old." If this were truly their initial recollections, it would place the subjects age bang in the center of the revised descriptions given by the eyewitnesses at Presidio Heights. The uncertainty in both crimes may represent the difficulty in pinning an accurate age on this subject, if of course, the subject at Lake Berryessa described by the three women, was in fact the Zodiac Killer.  

In the October 1st 1969 San Francisco Chronicle article, police stated "there were a couple of things we're still holding back so we'll be able to identify the man if he wants to call us again." 
This may be a subtle reference to the two words "by knife" written on the car door, which they withheld from the newspapers. Had a caller contacted the police and answered the question of what the full message contained, it would be an easy and quick way of ruling out the crank calls. 
The October 1st 1969 Vallejo Evening News Chronicle, contained three paragraphs of great interest. It stated "Vallejo police were investigating a Vallejo man who was previously convicted of accosting "lovers lane" couples- and wore a hood while doing so.
While his molestations did not involve shooting or stabbing his victims, he has a streak of violence in him, police said. And his criminal activities resembled those of the slayer of four young persons.  
This man is much older than descriptions of the killer. However, it was pointed out that fat-faced people often look much younger than their years. His general physical description tallied with that of the hunted man, officers said."
We must also remember that the Paul Stine murder was just 10 days in the making, in which eyewitnesses would ultimately settle on a man described as 35-45 years of age, older than currently believed. 
One can't help thinking that a great opportunity was missed at Lake Berryessa. Had the boot prints of the subject viewed by the three girls matched the boot prints from the Lake Berryessa crime scene, it would have cast a very different light on the Presidio Heights sketch of the Zodiac Killer and changed our perceptions to this day.

There are many ways to interpret the 'Dripping Pen' card mailed by the Zodiac Killer on November 8th 1969 and here is another.
​Some people use the 'evidence of absence' argument to suggest the Lake Berryessa attacker was not the Zodiac Killer- articulating that his lack of mailed correspondence after the double stabbing was evidence for his absence from the crime scene.
​His communication on the car door just six minutes after the attack- probably to him- seemed like unassailable proof he was placing himself at the crime scene, just like attaching Paul Stine's shirt piece to his October 13th 1969 letter.
​At Lake Berryessa he took his handwriting to the crime scene, while at Presidio Heights he took the crime scene to his handwriting. A reverse signature one might say. However, not many people question Zodiac's involvement in the murder of taxicab driver Paul Stine. The idea that the Zodiac Killer never communicated his involvement in the Lake Berryessa crime is patently false, despite our need for a more comprehensive attribution to the events of September 27th 1969. Yet, his correspondences on October 13th 1969 and November 8th 1969 may very well have both referenced the Lake Berryessa attack, but in different ways.
The author of the October 13th 1969 Paul Stine letter opened with the words "This is the Zodiac speaking. I am the murderer of the taxi driver over by Washington St + Maple St last night, to prove this here is a blood stained piece of his shirt. I am the same man who did in the people in the north bay area."
The Zodiac Killer on the car door of Bryan Hartnell's white Karmann Ghia clearly attributes both of his first two attacks under the banner of Vallejo, despite the fact David Faraday and Betty Lou Jensen were murdered in Benicia. In fact, the Zodiac Killer never referenced Benicia in any of his communications, while he mentioned Vallejo several times. If the Zodiac Killer played no part in the Lake Berryessa attack, then his above introduction could have read "This is the Zodiac speaking. I am the murderer of the taxi driver over by Washington St + Maple St last night, to prove this here is a blood stained piece of his shirt. I am the same man who did in the people in the Vallejo area." However, he chose to use the "north bay area" for the first time, which incorporates the Napa and Sanoma wine regions. ​

Despite the claims that an impostor could have faked the Lake Berryessa phone call to mimic Zodiac's rhetoric of the Blue Rock Springs call, by reading the transcripts widely publicized in the newspapers, it appears the copycat would then fail to read the newspapers of the Benicia attack, and bundled both attacks under the banner of Vallejo on the car door, in complete harmony with a Zodiac Killer who always failed to document the simplest of facts- that his first crime was perpetrated in Benicia. The implication being- that they are one and the same person.
The divergence from Vallejo in the October 13th 1969 Stine letter confession, therefore, proof of his admission to the Lake Berryessa attack. The Zodiac Killer would then further indicate his involvement by the lake, in the cryptic November 8th 1969 'Dripping Pen' card communication, not only by the addition of "Sept"  in his running victim count, but through the cover image and wording within it.  
The style of the card may have been purposely chosen in reference to the Lake Berryessa attack and mailed in unison with the 'Bus Bomb' letter, which  elaborated upon his recent murder.
On October 18th 1969, Attorney General Thomas C Lynch implored Zodiac to turn himself in, stating "We will see that he gets help and all his rights are protected. He is obviously an intelligent individual. He knows that eventually he will be taken into custody, so it would be best that he give himself up, before tragedy is written in blood." 
Three weeks later the Zodiac Killer mailed a greeting card, depicting a fountain pen having been washed by its owner. The card itself read "Sorry I haven't written, but I just washed my pen...and I can't do a thing with it." Zodiac then added the words "This is the Zodiac speaking. I though you would nead a good laugh before you hear the bad news. You won't get the news for a while yet. Could you print this new cipher in your frunt page? I get aufully lonely when I am ignored, so lonely I could do my Thing."

It is clear the Zodiac has simply parroted the word "thing" from the wording on the card, and began to write the letter 'T' in lower case. It is equally probable the Zodiac wrote the entire word "thing" in normal writing, before emphasizing it in bold fashion, to highlight its importance. 
​The phrase "and I can't do a thing with it" is referring to a pen that now cannot be used, having been damaged by water. This is often taken as a pen accidentally left in clothing and washed, however, it may have a more sinister implication. 
The threat of "I could do my Thing," is obviously referencing murder- but by parroting the word "thing" from the card, which is explicitly referencing the pen, the Zodiac Killer may be associating the pen with murder. More specifically, the murder of Cecelia Shepard.  
The Zodiac Killer's dominant hand would certainly have been covered in blood after the Lake Berryessa double stabbing, so any pen subsequently used to write on the car door would equally have been smothered in blood, thereby making the November 8th 1969 'Dripping Pen' card, of a washed pen, not an unusual choice by the killer. The killer may have worn gloves and removed them before writing on the car door, but the implication of the card remains. 
The six exclamation marks after the word "Thing" are as notable, as they are excessively repetitive. The Zodiac Killer has also deliberately or accidentally underlined the word "Thing" exactly six times. These two characteristics may be purely unintentional on behalf of the author, but considering the Zodiac Killer is claiming 7 victims at this juncture, it would be remiss not to mention that the Lake Berryessa murder of Cecelia Shepard would have been the Zodiac Killer's sixth victim.
One theory behind the origin of the exclamation mark, is that it is derived from a Latin exclamation of joy, which may not have been lost on a killer bereft of empathy. 

For many years, some observers have questioned the September 27th 1969 Lake Berryessa attack on Bryan Hartnell and Cecelia Shepard as a genuine Zodiac crime. It is claimed that the MO of this crime wasn't like Zodiac, despite the fact he altogether only committed three other confirmed attacks, in which Presidio Heights, one could argue, wasn't his MO either. The amount of crimes ascribed to the Zodiac Killer isn't a large enough sample size to make such astronomical claims based on modus operandi. 
Some people also believe that the attacker at Lake Berryessa intended to leave at least one victim alive (in this case Bryan Hartnell), because murdering both would have negated the wearing of the costume. This argument carries no weight whatsoever.
​Bryan Hartnell was bound hand and foot approximately 510 yards from the nearest roadway  (Knoxville Road)- and was brutally stabbed in the back six times, which resulted in extensive blood loss. In the 2007 Zodiac documentary he recalled his memories of the fight to live,:after struggling to free himself from the clothesline bindings: 
"So I got up and made it about 5 feet and the sparkles and the darkness came back and I had to drop down immediately to keep from passing out. I'd just lost too much blood and had no energy to move. So I waited a minute, got some more strength, and thought I'm going to have to do this a little slower. I made it another five feet and dropped down myself. So I started just taking 5, 10 feet intervals, and found that if I wasn't trying to walk fast and walked bent over holding my chest and walk slower, I could make more distance in between having to stop and rest. I made it about halfway to the road and saw some lights coming." This is where he was eventually aided by park ranger Dennis Land. 
At approximately 7.10 pm or very shortly after, Sgt William White radioed Park Headquarters to summon an ambulance and deputies to the crime scene. An ambulance from Naps arrived at the crime scene at approximately 7.55 pm, and returned back to the Queen of the Valley Hospital, arriving at 8.50 pm. That is an approximate journey time of 45 minutes each way, including 10 minutes negotiating the crime scene.

Therefore, one would have to assume that the attacker with an extensive knowledge of anatomy, surgically delivered the knife wounds to Bryan Hartnell, knowing he would free his bindings and would be discovered by a third party in a particular amount of time- and in addition- factor in the overall time the ambulance would take to arrive at the crime scene and return to the hospital. Furthermore, calculating the blood loss to be suffered by Bryan Hartnell in order for him to be subsequently saved by the hospital surgeons and thereby recount his experience of being attacked by a costumed slayer with crosshairs on his chest. I doubt this is a realistic proposition.
It is clear the Zodiac Killer or copycat intended to kill both Cecelia Shepard and Bryan Hartnell, and thought he had- evident by the phone call placed in Napa approximately 70 minutes later, in which the killer stated "I want to report a murder, no, a double murder. They are two miles north of Park Headquarters. They were in a white Volkswagen Karmann Ghia. I'm the one that did it".
​So, why did the attacker wear a costume with crosshairs on the front, if he had no intention of leaving the couple alive?
The Zodiac had every reason to wear the crosshairs symbol, but the copycat didn't.
The attack took place during daylight hours at 6.30 pm or slightly earlier- so the killer, whether Zodiac or copycat, had good reason to wear a costume or disguise in case he was spotted by any eyewitnesses- something I'm sure he was keen to avoid. 
For those in the copycat camp, the writing on the car door of Bryan Hartnell's 1956 White Karmann Ghia and the telephone call to police dispatcher Dave Slaight, is not sufficient proof it was the Zodiac Killer- because the style of the handwriting on the car door and composition of the message in the phone call (based on the Blue Rock Springs call) were widely available in many newspapers- and could easily have been reproduced by a copycat. It is therefore imperative we find another reason to tie the Lake Berryessa attack to the Zodiac Killer rather than a copycat. 
Bryan Hartnell stated that the assailant wore a black hooded mask made of a cloth material, covering his entire head and shoulders, reaching down to the waist. On the front of the four cornered mask at the chest area was a white circle (3 x 3 inches inches in diameter) and a symmetrical cross. He would further elaborate on the design of the crosshairs, as well as later in the 2007 Zodiac documentary, stating "It looked like it was made with a machine or with some degree of care- it wasn't just scrawled on with white paint. It was proportional."       

Why would a copycat killer meticulously sew on perfectly symmetrical crosshairs onto a carefully crafted costume, when he had no intention of leaving anybody alive to report it. If the crime had been committed by a copycat, then imitating the Zodiac Killer's writing on the car door and subsequent phone call should have sufficed. He could simply have disguised his features with a mask or plain hood. 
The same could be said of the Zodiac Killer, I hear you saying.
However, there is one big difference.
The Zodiac Killer had murdered three and seriously injured a fourth person at this juncture, and had bathed in the spotlight of numerous newspaper articles in his name. This must have fed his egotistical nature, and in his own mind, elevated him to another level of self-aggrandizement. The idea, that he would then carefully craft a costume befitting of such an infamous and feared villain, doesn't seem that far-fetched. Would a copycat spend this much time creating an elaborate costume, bedecked with crosshairs, when nobody was going to be left alive to report their observations to police? It would be a pointless waste of time. A copycat would have just reproduced the handwriting on the car door and made the payphone call. The Zodiac Killer, on the other hand, had every reason to adorn himself with a costume befitting of the man he thought he was.

Kim Rossmo is a Canadian criminologist who pioneered the art of geographic profiling- a technique used to compliment conventional police work in the tracking of criminals. He has used data from the Zodiac Killer case to narrow down the likely residence and possible commuter routes of the murderer, and even a suggestion of where he may have worked. When the details from the Zodiac case were placed into the Rigel crime mapping software it created significant zones of interest in Rancho Vallejo, northern Vallejo, American Canyon and Benicia. These areas have one critical commuter route relevant to all- that of California State Route 37- which the significance of regarding Zodiac's knowledge of courting couples, his base location and possible workplace will become apparent. Some of Kim Rossmo's ideas will be presented here, but to read his excellent analysis of the Zodiac case, please visit here. 
Below is a map showing all the relevant locations concerning the killer's first two crimes- the red circle at the northern end of Tuolumne Street being of significant interest, as it also brings into focus the easy access to and from the payphone after his murder and attempted murder of Darlene Ferrin and Michael Mageau at the Blue Rock Springs parking lot on July 5th 1969. The journey time to the payphone from the crime scene of less than 10 minutes, and the phone call to police nearly 40 minutes after the attack lends good weight to the premise the killer was a native Vallejoan, and possibly returned home to ditch his weapon and/or clothes before returning to place the call to police dispatcher Nancy Slover.  

What better way to have knowledge that Lake Herman Road and Blue Rock Springs were frequented regularly by courting couples, than if you routinely traveled this route to reach your place of work, not unlike eyewitness James Owen who lived at 1735 Mini Drive and would have likely used California State Route 37 at the beginning of his journey, to arrive at Humble Oil in Benicia. The same applies to an area around Mare Island Shipyard and Rancho Vallejo, where Tuolumne Street nears State Route 37. Lake Herman Road on the eastern fringes of Vallejo and Benicia, is a dark, unlit stretch of rural road infrequently used. It is, however, a logical choice for somebody living in Ranch Vallejo (north Vallejo) or American Canyon to use, if they worked in the industrial area of Benicia.
The northern side of the green line on the map above, shows that access to State Route 37 would take somebody towards the northern side of Columbus Parkway, before heading southeast along Lake Herman Road towards Benicia, and crucially encompassing both crime scenes. If the killer lived in the northern region of Vallejo and worked in Benicia, his 'compass' knowledge of specific locations would not be surprising. This was evident in his first attack when he stated in the July 31st 1969 letters, that Betty Lou Jensen "was on her right side feet to the west." Of course, he had six and a half months to work this out, but had only 36-38 minutes after the Blue Rock Springs attack, in which he was able to direct Vallejo police to the crime scene along Springs Road and Columbus Parkway with completely accurate directions when he called Nancy Slover, stating "I wish to report a double murder. If you will go one mile east...... on Columbus Parkway to the public park, you will find the kids in a brown car. They have been shot with a 9 mm Luger. I also killed those kids last year.... Good-bye." 
Knowledge such as this, could suggest complete familiarity with the public park, golf course, Lake Herman Road and the location of the police station with respect to the Springs and Tuolumne payphone. 
The killer would have one direct route, to and from his residence to the payphone at the intersection of Springs Road and Tuolumne Street. His route to work (possibly a night-shift) also giving him first hand knowledge of courting couples and where to trawl for victims at the weekend.   

Kim Rossmo, referring to Lake Herman Road and Blue Rock Springs Park, stated "In contrast, his target selection at Lake Berryessa and San Francisco did not show any evidence of local area knowledge. Also, the time lapse between the Blue Rock Springs shooting and the Zodiac’s telephone call was approximately 40 minutes, even though the distance between these two locations is only 3.5 miles (7 minutes normal driving time). What did he do for that other half hour? One possibility is that he returned home and disposed of his weapon. If so, that means he most likely lived within a five-mile radius of the crime site. The Zodiac also knew to telephone the Vallejo Police Department, even though the Blue Rock Spring Golf Course and park area was an unusual offshoot of municipal jurisdiction, totally surrounded by Solana County. The Zodiac’s comfort zone clearly includes the Vallejo area."
However, there is one thorn in our side- the testimony of Michael Mageau. He stated in the police report "as he fell out onto the ground the vehicle the subject was in backed up in a turning movement and then took off toward Springs Road in Vallejo at a very high rate of speed." The obvious route back home for the killer, had he lived somewhere by the top of Tuolumne Street, and wanted to ditch his weapon and clothes before making the call to police, would have been to head north and west along Columbus Parkway- the opposite direction that he chose for work. There may be several explanations for this.
Michael Mageau was simply mistaken, the killer's initial intention was to make the phone call immediately but changed his mind, preferring to remove his weapon and possibly bloodied clothing from the equation, or the intended payphone at the initial time of his arrival had potential eyewitnesses, forcing a hasty change of plan. This may have been his preferred choice of payphone, as it provided easy access to and from his home residence, yet allowed a reasonable 'buffer zone' of just over two miles. It had the added benefit of a voyeur killer who wanted to remain in his vehicle and watch responding officers scurry into action from the police station, along Springs Road to the crime scene. It may actually have been the primary reason he chose this particular payphone so close to the police station, despite it seemingly being an added unnecessary risk on his part.        

There may be another reason why the Zodiac Killer chose the 'wrong way' after leaving the Blue Rock Springs parking lot. A reason that involved near eyewitnesses to the murder in the parking lot..
Three young kids, Debbie, Jerry and Roger were the first to find Michael Mageau just after he had extracted himself from the brown Corvair and was lying adjacent to it.
They must have arrived extremely close to the time of the attack- possibly as little as a minute or two after the brutal shooting. The time of the attack can be calculated with a fair degree of confidence to 12.02 am on July 5th 1969. See here. 
Police dispatcher Nancy Slover received a phone call from Jerry's house at  938 Catlewood Drive, Vallejo from Debbie at 12.10 am. The drive to 938 Castlewood Drive from Blue Rock Springs is approximately 6 minutes, indicating they would have had to leave the parking lot by about 12.04 am to make this phone call in time.
​Yet, this isn't the time they arrived at the parking lot, which must have been around a minute earlier at 12.03 am- just after the attack at 12.02 am. The Zodiac Killer may literally have been leaving the Blue Rock Springs parking lot as they were approaching it. This may have influenced the direction Zodiac exited from the crime scene.
Debbie, Jerry and Roger stated in the police report that "they had been downtown to see the festivities for the 4th of July. After this was over, at about 11 pm, they decided to look for this girl that Roger knows. They drove around town and did not see her and decided to go to Blue Rock Springs Park to look for her. They went out the freeway to Columbus Parkway and came into the park the back way. While they were driving in toward the park neither boy recalls seeing any vehicle coming out, none parked along the road, nor did they pass any vehicle."  They must have been almost on top of Zodiac as they approached from the north side of Columbus Parkway. Had Zodiac intended to travel home before making the phone call, his obvious route north and then west along Columbus Parkway, was now not so obvious if he didn't want himself or his vehicle spotted by the three kids. They obviously didn't see him, but he may have spotted their vehicle approaching in the distance. This may have forced a change of plan and coerced Zodiac south toward Springs Road.
The journey time heading in this direction to somewhere close to the green circle at the top of Tuolumne Street, would take approximately 11-12 minutes. The Zodiac Killer would arrive home at about 12.14 am- leaving him approximately 20 minutes at his residence before driving back to the Springs and Tuolumne payphone to make the call. Once doing so, his escape home is a mere 4 minutes.  
Calfornia State Route 37 and Highway 101 may have played a decisive factor when selecting a quick and easy separation from San Francisco after the murder of taxicab driver Paul Stine on October 11th 1969. Whether or not the murderer had entered the Presidio Park is a moot point today, but in 1969 the Zodiac Killer would certainly have wanted to escape from the area in as little time as possible. A vehicle parked somewhere along West Pacific Avenue or to the east of the park in Cow Hollow, would provide immediate access to Highway 101 across the Golden Gate Bridge, and in a handful of minutes out of San Francisco. The killer can then head north and eventually east just before Novato, taking California State Route 37 right onto his doorstep.  

The selection of a taxicab driver to take him to a predetermined destination so close to an exit route from San Francisco, one could argue was the perfect choice for a resident of Vallejo. The killer has a nearby park in case things don't go to plan, along with an immediate escape and separation from the crime scene via Highway 101 and the Golden Gate Bridge. Even Inspector Dave Toschi thought this a viable proposition: "The detectives heard from neighbors that a stocky figure was seen dashing across Julius Khan playground and into the dense undergrowth of the Presidio. The dog patrol units, seven of the best search dogs in the country, gathered at the front entrance of the Presidio and were deployed one at a time in various directions. Armstrong and Toschi considered the possibilities. Had the killer gone quickly through the dark woods and emerged from the Presidio at Richardson Avenue, and taken Highway 101 past Fort Point onto the Golden Gate Bridge and vanished into Marin County."
Kim Rossmo made an extremely salient point regarding the murder of Paul Stine.
He stated: ​​"The San Francisco murder differs significantly from the Zodiac's other crimes. Up to this point he was hunting in locations that had a good probability of containing his desired victims. Target selection was a function of area, not of an individual. However, it is unlikely the Zodiac was successful in all his searches; serial killers typically engage in extensive hunting activities, and for every attack there are many unsuccessful search attempts. In San Francisco, however, the Zodiac controlled the situation through his selection of victim type. The need for such control could be indicative of the distance the Zodiac had to travel to the crime site. Criminals who travel longer distances to offend are less likely to use uncertain target selection techniques."  Control your location and you control your escape route.
The Lake Berryessa attack on September 27th 1969 speaks for itself. The killer headed to downtown Napa and the payphone at 1231 Main Street. He may have been only 12 miles from California State Route 37 and home, had he continued the trajectory he had set for himself. Was the Zodiac Killer's apparent knowledge of a road on the fringes of Vallejo more indicative of his recreational habits or a route he traveled daily..... particularly when the sun went down. 

For those of you who dislike using measurements and timelines in the Zodiac case, look away now. The following will be a detailed analysis of the Lake Berryessa sighting of Dr Rayfield & Son and the three young girls- the latter of whom provided a possible sketch of the Zodiac Killer to police. This article will argue that the sketch created from the three girls recollection of a suspicious individual was most likely the murderer of Cecelia Shepard and four others in the Bay Area.
Using only the police report, there are enough details contained within it to place Dr Rayfield & Son and the three girls at virtually the identical location alongside the Knoxville Road that day. The "The three girls left the area about 4.30 pm and the subjects vehicle was gone." Dr Rayfield & Son, it was argued in a previous article, noticed a "white male adult subject walking in the area, described as about 5'10", heavy build, wearing dark trousers, a dark shirt with red in it, long sleeves" at about 6.50 pm that evening. Lake Berryessa-A Killer's timeline.  
If the shirt with "red in it" was blood, this may likely have been the killer returning to his vehicle after the double stabbing by the lake, negating the idea it was parked behind Bryan Hartnell's Volkswagen Karmann Ghia. If Dr Rayfield & Son were at the same location as the three girls, who saw the suspect vehicle no more at 4.30 pm, this may suggest that after he had 'eyed' up the young girls for a potential attack, he ultimately decided to move his vehicle away from any potential crime scene- possibly slightly north- but not too far. He was therefore likely trawling Lake Berryessa along the hillside for victims, and after the attack on Bryan Hartnell and Cecelia Shepard (signing the car door at approximately 6.30 pm or marginally earlier), he returned to the approximate location of where the three girls were earlier, and was spotted by Dr Rayfield & Son returning to his vehicle for the 28 mile journey to the 1231 Main St, Napa payphone. Two different sets of eyewitnesses, spotting a suspicious character before and after the Lake Berryessa attack, one could argue, has a high probability of being the Zodiac Killer, and more importantly the subsequent sketch created thereafter has greater significance.   

But the first thing we have to do is place Dr Rayfield & Son at the approximate location alongside the Knoxville Road as the three girls. We will use these details from the police report: 
The three young women who potentially saw Zodiac, "parked their vehicle at a location two miles north of the A & W Root Beer stand on Knoxville Road." The Sugar Loaf Park A & W was situated at 5100 Knoxville Road.
A second set of eyewitnesses saw the Zodiac later that day: "Dr Rayfield and his son stated that they did not notice a vehicle in the area of their vehicle and only this subject at a distance of about 100 yards. This location was approximately 8/10ths of a mile from the scene of the victim's vehicle. There are four coves of water between the scene of the crime and the area where the doctor saw the subject." 
​So it's time for some calculations.
The three girls were 2 miles north of 5100 Knoxville Road. The Rayfield's were 0.8 miles from Bryan Hartnell's vehicle. If the premise above is correct, the two sets of eyewitnesses may have seen the same suspicious individual at two different times of the day, before and after the brutal stabbing of the young couple. Below details these findings.

You will notice that the white horizontal line above passes through the identical features on both images of Lake Berryessa, indicating that Dr Rayfield & Son and the three girls were visiting the near identical location that day, adding weight to the idea, that the suspicious character observed by both had good reason to be in that area. Firstly, to contemplate an attack on the three girls, and secondly, to return to his vehicle that evening. It suggested that once he had moved it slightly before 4.30 pm, it remained in that position until he returned later that day- after the attack on Bryan Hartnell and Cecelia Shepard with a "red color" on his shirt. 
The payphone call he made to police dispatcher Dave Slaight at 7.40 pm from 1231 Main Street, may be further evidence, suggesting the Zodiac Killer traveled from the Volkswagen Karmann Ghia, 0.8 miles on foot back to his vehicle. Somewhere just past the location of Dr Rayfield & Son. 
The distance from the Volkswagen Karmann Ghia to the payphone (had Zodiac parked here) is 27 miles. The time estimated for this journey on Google maps is 46 minutes. I shall apply some leeway and say 50 minutes. This would have Zodiac reaching the Napa payphone at 7.20 pm, traveling the journey at an average speed of just 32.4 mph.- arriving at the payphone 20 minutes too early. If he took the 70 minutes available to him (6.30-7.40 pm) his speed would be reduced to a sluggish 23.1 mph. So dispelling the latter speed, we are seemingly missing 20 minutes.
The distance of 0.8 miles, to walk from the Volkswagen Karmann Ghia to his vehicle, parked somewhere by Dr Rayfield & Son, would take at a sedentary walking pace of 3 mph (1 mile every 20 minutes) approximately 16 minutes. Allowing for a slightly slower pace, changing any clothes and preparing to leave, 20 minutes is a reasonable estimate. This accounts for the missing 20 minutes above. It has the Zodiac Killer entering his vehicle (now approx 28 miles away) at 6.50 pm, for the 50 minute journey back to the payphone traveling at an average speed of 33.6 mph. This now makes far better reading than 23.1 mph using California State Route 128 and California State Route 121 for the majority of the journey.
The two sets of eyewitnesses, both detailing a suspicious character on the same section of hillside alongside the Knoxville Road, in combination with the distance and timeline presented, hopefully presents a case that the Zodiac Killer had his vehicle parked approximately 0.8 miles north of the ​Volkswagen Karmann Ghia- the tire tracks examined by police were not the Zodiac's car, and the sketch compiled from the recollections of the three girls was very likely the Bay Area murderer.  

The 'Dripping Pen' greeting card and cipher were purportedly mailed virtually alongside the 'Bus Bomb' letter, on November 8th and November 9th 1969 respectively. The postmark on the 'Dripping Pen' card envelope is less than clear in many reproductions, but there may be a better version available somewhere online. However, there is something rather out of place regarding this Zodiac communication, particularly when one compares it to the 'Bus Bomb' letter postmarked just one day later.   

The Zodiac wrote his victim count using months of the year: "Des, July, Aug, Sept, Oct = 7," but in his next 'Bus Bomb' communication he adds "This is the Zodiac speaking up to the end of Oct I have killed 7 people. I have grown rather angry with the police for their telling lies about me. So I shall change the way the collecting of slaves. I shall no longer announce to anyone. When I committ my murders, they shall look like routine robberies, killings of anger, + a few fake accidents, etc."
Why is the killer informing us he has killed seven people up to the end of October, when he has made this plainly obvious in the 'Dripping Pen' card by addition of the last entry as "Oct," meaning October. If the Zodiac Killer had murdered anybody in November, then surely the total would be 8 victims, with November added to the list of months. The killer further states "I though(t) you would nead a good laugh before you hear the bad news. You won't get the news for a while yet." But we didn't hear of any bad news before he mailed the Melvin Belli letter on December 20th 1969, or for months thereafter. 
This may be because we had already heard the bad news, and the 'Dripping Pen' card was intended to be mailed slightly over a month earlier.
Mail can go astray from mailing to being postmarked, however, that avenue will not be explored here.
It seemed unusual for two such prominent communications to be sent either in tandem, or one day apart. The Zodiac Killer had obviously invested a lot of time crafting a new and innovative cipher, after becoming aware his first cipher had been cracked in a matter of days, and announced in the San Francisco Chronicle on August 9th 1969. So, after investing time and energy into his new masterpiece, it seemed strange he would take the shine and emphasis away from this new cipher, by tying it alongside the rather lengthy 'Bus Bomb' letter about the murder of Paul Stine on October 11th 1969 and his exploits in the park.
The 'Dripping Pen' card and cipher could have been mailed two weeks later to maximize impact. The context and choice of card, if chosen for purpose, also makes little sense. The message on the purchased greetings card read "Sorry I haven't written, but I just washed my pen."  The Zodiac Killer, however, had written only 27 days earlier, when he mailed the October 13th 1969 Paul Stine letter containing the swatch of bloodied shirt. The supposed bad news we were supposed to get also never materialized, and in addition, he would repeat the month of October just one day later, reminding us of seven victims claimed, as if our attention span only lasted 24 hours. All these factors place this correspondence and its contents curiously out of place. ​

We will attempt to put this card chronologically in its rightful place, where its contents can be understood. 
The wording "Sorry I haven't written, but I just washed my pen,"​ if this card was chosen carefully, seems to imply the killer had not written to the newspapers for a while-  longer than 27 days.
The Zodiac Killer prior to the October 13th 1969 Paul Stine letter, had not written to the newspapers since August 4th 1969, when the 'Debut of Zodiac' letter arrived at the San Francisco Examiner. That is over two months. It is longer regarding the San Francisco Chronicle, of over 10 weeks. This card now makes more sense. But why would the dripping pen (possibly red in color) be relevant to the Zodiac. 
On September 27th 1969, Bryan Hartnell and Cecelia Shepard were enjoying a pleasant picnic at Lake Berryessa when a knife-wielding man approached wearing an theatrical executioners costume, brutally stabbing the young couple 16 times in their back and abdomen. The assailant's hand or glove would have been covered in blood. Minutes later he wrote on the car door with a pen: Vallejo 12-20-68, 7-4-69, Sept 27-69 -6:30 by knife.
The pen would have been covered with blood. What better time to ironically proclaim in your next correspondence "Sorry I haven't written, but I just washed my pen," as if to imply he was the responsible for the callous attack and murder of Cecelia Shepard just days earlier, and was washing the blood from his pen. The author of the 'Dripping Pen' card further added "Could you print this new cipher in your frunt page? I get aufully lonely when I am ignored, so lonely I could do my Thing."
The Zodiac Killer, like most serial killers, don't have horns growing from their head- they go largely unnoticed and blend into society. The Zodiac Killer was certainly searching for notoriety, as opposed to the loneliness he experienced in everyday life. What better way, than to dress up in an executioners costume and do his "thing." 

The 'Dripping Pen' card would sit nicely between the Lake Berryessa attack and the murder of Paul Stine, had it been mailed sometime around September 30th 1969. The text on the card would then make further sense in respect to the month of October and the wording "I though(t) you would nead a good laugh before you hear the bad news. You won't get the news for a while yet."
The seventh victim was to become Paul Stine (or another taxicab driver) in San Francisco. He had already earmarked his next murder, and this was the "bad news" we were soon to receive. The addition of the month of October was the precursor to death, and unlike his previous attacks where he had to search out victims- in San Francisco they would literally come to him.
But why wasn't the 'Dripping Pen' card mailed after the Lake Berryessa attack?, assuming the communication didn't go astray from posting to postmark.
The Zodiac Killer likely had his ego dented after Donald Gene and Bettye June Harden cracked his 408 cipher in a matter of days. He may have began developing his more challenging cipher immediately in response, or at the very least sometime in August or September. 
The Zodiac Killer chose the greetings card in respect to the Lake Berryessa stabbings, for which he could have then attached his cipher and mailed it. But something changed.
​Did he want to revise or add to his cipher to incorporate the attack by the lake? Some have suggested the cipher may have been separated into two halves. Did the killer originally encipher a banal message, much like his original code, and wanted to completely redesign it. The intended murder at Presidio Heights was looming, and the killer was planning ahead. The cipher and card may have been placed on the back-burner. 
On October 11th 1969, taxicab driver Paul Stine was murdered in Presidio Heights. The killer mailed a piece of the taxicab driver's shirt two days later, and followed up with more details on November 9th 1969 about his excursion into the park. 
In between the October 13th 1969 Stine letter and November 9th 1969 'Bus Bomb' letter, the killer may have finalized his cipher, unable to replace the 'Dripping Pen' greeting card with an identical or relevant card, and with the Lake Berryessa attack cooling, mailed off both communications in unison. He stated we wouldn't "get the news for a while yet," totally negating the message he delivered one day later, that "I shall no longer announce to anyone when I committ my murders." Seemed like a quick change of heart. The card choice still made sense to him, if not us at this juncture, but the message inside now appeared chronologically repetitive in respect to the 'Bus Bomb' letter and the intended "bad news" had already occurred, although not apparent to the reader, so the threat still remained. 

In the previous article we estimated that the Zodiac Killer arrived at the location of Bryan Hartnell's 1956 White Karmann Ghia at approximately 6.00 pm. Here we shall reverse the timeline of Ronald Fong, the man who noticed the stricken couple from his boat on Lake Berryessa and set off for help at the Rancho Monticello Resort, and hopefully attempt to verify or negate this finding. It may also answer the question of whether the 6:30 written on Bryan Hartnell's vehicle was the time of the attack or the time of writing. Here are some key statements to consider.
#1. On page 6 of the police report it read "White stated at approximately 18.55 hours 9/27/69 he was on routine patrol around the Lake Berryessa area when he received a call from Park Headquarters to proceed to the Rancho Monticello Resort where a person was reporting a possible stabbing. Ronald Fong advised him that he had seen a male and a female victim on the beach area south of Rancho Monticello Resort, hollering that they had been stabbed." link
#2. Bryan Hartnell interview: "There was a boat kept circling around out there in the lake and we started yelling at it and finally it came within about 100 yards of the shore and turned off its motor and stayed there watching us for about 15 minutes." link
#3. "I heard this screaming," said Fong, who has relocated to Washington state but was back in San Francisco last week visiting his family. "I used binoculars to see what was going on. He wanted me to go help him. But I had my 9-year-old son. ... I was close to the boathouse, so I went and told the park rangers." link
#4. "Victim stated he thought suspect had been with the couple for approximately 15 minutes from time of observing suspect until suspect departed." link 
The Rancho Monticello Resort is 3.7 miles by road from the Volkswagen Karmann Ghia, 3.2 miles as the crow flies. By boat from the area of the crime scene to dock at the Rancho Monticello Resort is also approximately 3.7 miles.
We shall use these pieces of information to calculate the time of the attack, first of all using the shortest timeline.  

What we don't know is the speed that Ronald Fong traveled in his boat, so we will estimate this to begin with, at 10.mph.
​Sergeant William White received a call from Park Headquarters regarding the attack and proceeded to the Rancho Monticello Resort at 6.55 pm. Because this time is approximated, we will take 6.55 pm as the time Ronald Fong reported the stabbing at the Rancho Monticello Resort, and assume it was transferred through fairly quickly. 
The journey time of Ronald Fong at an estimated 10 mph is 22.2 minutes (22 approx). After docking his boat he traveled by foot to the Rancho Monticello Resort, and allocating little time to the delay in transferring the call to Sergeant William White, this is estimated at 6 minutes. So far, a minimum of 28 minutes has elapsed since Ronald Fong departed the crime scene.
Bryan Hartnell stated that after the attack Ronald Fong had "stayed there watching us for about 15 minutes." This time may have appeared longer than it actually was, but it will remain untouched, because Bryan Hartnell certainly wouldn't have started shouting for help immediately with the Zodiac Killer nearby. This delay in calling for help will be incorporated into the 15 minutes. Keeping these timelines as tight as possible will compensate for the speed of Ronald Fong's boat, had it traveled slightly quicker.
Adding the 15 minutes to the 28 minutes already elapsed, we have 43 minutes to deduct from 6.55 pm (18.55 pm), to tell us when the Zodiac Killer finished his attack on the young couple. This would have been 6.12 pm.
Now let us ramp up the speed of the boat to 20 mph. This would cut his journey time in half, to 11 minutes. Giving us a total time elapsed of 32 minutes, placing the end of the attack at 6.23 pm. Traveling at an unlikely 30 mph, the end of the attack would be 6.27 pm. But having kept the timeline as tight as possible, to allow the 10 mph boat speed, the end of the attack was more likely around 6.12-6.17 pm.
On page 6 of the police report it continued "Sergeant William White stated he proceeded to the Rancho Monticello Resort where a person was reporting a stabbing. Ranger Sgt White, accompanied by Archie White, Mrs Elizabeth White and Ronald Fong, proceeded to the beach area via speedboat owned by Archie White. When they arrived on the beach they observed a young female lying on the ground with what appeared to be numerous stab wounds. White stated he immediately radioed in and had Park Headquarters radio the Sheriff's Office to dispatch an ambulance and deputy."  
Deputy Ray Land and Sergeant David Collins were dispatched directly to the crime scene from St Helena and Napa respectively. Sgt David Collins spoke on the documentary 'This is the Zodiac Speaking' "It took us a half hour from Napa and/or St Helena to arrive at the location. And we later found out of course that crime had occurred at least half an hour before we were notified." They were notified at approximately 7.10 pm, which by their statement above would place the crime at around 6.10 pm.
Allowing Sergeant William White 8 minutes from being radioed at 6.55 pm to entering the speedboat and 1 minute to reaching Cecelia Shepard once they arrived at the crime scene and contacting Park Headquarters, who in turn contacted the Sheriff's Office, this affords 6 minutes for the speedboat journey. Or 7 minutes if we tighten the timeline. The speedboat was therefore traveling approximately 30-37 mph. This is the reason they took Archie White's speedboat- it likely accommodated four people and could travel at a far greater speed than Ronald Fong's small fishing boat. Indicating that the 10-20 mph range of Ronald Fong's boat, and more likely the lower end estimate, is likely the correct one. 

But what time did the Zodiac Killer approach the couple. 
Bryan Hartnell estimated that "he thought suspect had been with the couple for approximately 15 minutes from time of observing suspect until suspect departed." Therefore, if the end of the attack was 6.12 pm, the Zodiac must have approached the couple at 5.57 pm. The distance from the Volkswagen Karmann Ghia to the crime scene was approximately 510 yards. Allowing for the terrain, and the time for the killer to hide behind the tree and don his costume, it would take approximately 7 minutes. This would have the Zodiac Killer spotting the Volkswagen Karmann Ghia at 5.50 pm, slightly earlier than the anticipated 6.00 pm in the previous article. But allowing for a little flexibility in the timeline and taking the end of the attack at 6.17 pm, would have the killer approaching the Volkswagen Karmann Ghia at 5.55 pm, only five minutes out from the previous article. Had the attack finished at 6.12-6.17 pm, then Zodiac would be writing on the car door at 6.19-6.24 pm.
Keeping a tight timeline, with Ronald Fong's boat traveling between 10-20 mph, the end of the attack on the young couple never would have exceeded 6.23 pm. His small boat was extremely unlikely to have reached anything in excess of this range, and indicates the Zodiac Killer more than likely 'signed' the car door by at least 6:30 pm, or possibly slightly earlier. 
The last article theorized Zodiac's vehicle just over a mile north of this location. However, if he had parked by the Volkswagen Karmann Ghia, the Zodiac Killer could have had anywhere from 70-80 minutes for his 40-50 minute journey to the payphone in Napa, indicating he either went off route on the return journey, he stopped or was delayed somewhere, or his vehicle wasn't parked behind the Volkswagen Karmann Ghia of Bryan Hartnell. 
But why did Ronald Fong, if he frequented the area regularly, travel 3.7 miles north to the Rancho Monticello Resort for help, when he could have traveled 0.7 miles south, directly to Park Headquarters.  
​
LAKE BERRYESSA- A KILLER'S TIMELINE [PART ONE]