3G USIM 2G SIM Service Numbers

3G USIM 2G SIM Service Numbers

3G USIM (2010-04)
Service n°1: Local Phone Book
Service n°2: Fixed Dialling Numbers (FDN)
Service n°3: Extension 2
Service n°4: Service Dialling Numbers (SDN)
Service n°5: Extension3
Service n°6: Barred Dialling Numbers (BDN)
Service n°7: Extension4
Service n°8: Outgoing Call Information (OCI and OCT)
Service n°9: Incoming Call Information (ICI and ICT)
Service n°10: Short Message Storage (SMS)
Service n°11: Short Message Status Reports (SMSR)
Service n°12: Short Message Service Parameters (SMSP)
Service n°13: Advice of Charge (AoC)
Service n°14: Capability Configuration Parameters 2 (CCP2)
Service n°15: Cell Broadcast Message Identifier
Service n°16: Cell Broadcast Message Identifier Ranges
Service n°17: Group Identifier Level 1
Service n°18: Group Identifier Level 2
Service n°19: Service Provider Name
Service n°20: User controlled PLMN selector with Access Technology
Service n°21: MSISDN
Service n°22: Image (IMG)
Service n°23: Support of Localised Service Areas (SoLSA)
Service n°24: Enhanced Multi Level Precedence and Pre emption Service
Service n°25: Automatic Answer for eMLPP
Service n°26: RFU
Service n°27: GSM Access
Service n°28: Data download via SMS-PP
Service n°29: Data download via SMS CB
Service n°30: Call Control by USIM
Service n°31: MO-SMS Control by USIM
Service n°32: RUN AT COMMAND command
Service n°33: shall be set to '1'
Service n°34: Enabled Services Table
Service n°35: APN Control List (ACL)
Service n°36: Depersonalisation Control Keys
Service n°37: Co-operative Network List
Service n°38: GSM security context
Service n°39: CPBCCH Information
Service n°40: Investigation Scan
Service n°41: MExE
Service n°42: Operator controlled PLMN selector with Access Technology
Service n°43: HPLMN selector with Access Technology
Service n°44: Extension 5
Service n°45: PLMN Network Name
Service n°46: Operator PLMN List
Service n°47: Mailbox Dialling Numbers
Service n°48: Message Waiting Indication Status
Service n°49: Call Forwarding Indication Status
Service n°50: Reserved and shall be ignored
Service n°51: Service Provider Display Information
Service n°52 Multimedia Messaging Service (MMS)
Service n°53 Extension 8
Service n°54 Call control on GPRS by USIM
Service n°55 MMS User Connectivity Parameters
Service n°56 Network's indication of alerting in the MS (NIA)
Service n°57 VGCS Group Identifier List (EFVGCS and EFVGCSS)
Service n°58 VBS Group Identifier List (EFVBS and EFVBSS)
Service n°59 Pseudonym
Service n°60 User Controlled PLMN selector for I-WLAN access
Service n°61 Operator Controlled PLMN selector for I-WLAN access
Service n°62 User controlled WSID list
Service n°63 Operator controlled WSID list
Service n°64 VGCS security
Service n°65 VBS security
Service n°66 WLAN Reauthentication Identity
Service n°67 Multimedia Messages Storage
Service n°68 Generic Bootstrapping Architecture (GBA)
Service n°69 MBMS security
Service n°70 Data download via USSD and USSD application mode
Service n°71 Equivalent HPLMN
Service n°72 Additional TERMINAL PROFILE after UICC activation
Service n°73 Equivalent HPLMN Presentation Indication
Service n°74 Last RPLMN Selection Indication
Service n°75 OMA BCAST Smart Card Profile
Service n°76 GBA-based Local Key Establishment Mechanism
Service n°77 Terminal Applications
Service n°78 Service Provider Name Icon
Service n°79 PLMN Network Name Icon
Service n°80 Connectivity Parameters for USIM IP connections
Service n°81 Home I-WLAN Specific Identifier List
Service n°82 I-WLAN Equivalent HPLMN Presentation Indication
Service n°83 I-WLAN HPLMN Priority Indication
Service n°84 I-WLAN Last Registered PLMN
Service n°85 EPS Mobility Management Information
Service n°86 Allowed CSG Lists and corresponding indications
Service n°87 Call control on EPS PDN connection by USIM
Service n°88 HPLMN Direct Access
Service n°89 eCall Data
Service n°90 Operator CSG Lists and corresponding indications

------------------------------------------------------------------

2G SIM (2007-06)
Service n°1 : CHV1 disable function
Service n°2 : Abbreviated Dialling Numbers (ADN)
Service n°3 : Fixed Dialling Numbers (FDN)
Service n°4 : Short Message Storage (SMS)
Service n°5 : Advice of Charge (AoC)
Service n°6 : Capability Configuration Parameters (CCP)
Service n°7 : PLMN selector
Service n°8 : RFU
Service n°9 : MSISDN
Service n°10: Extension1
Service n°11: Extension2
Service n°12: SMS Parameters
Service n°13: Last Number Dialled (LND)
Service n°14: Cell Broadcast Message Identifier
Service n°15: Group Identifier Level 1
Service n°16: Group Identifier Level 2
Service n°17: Service Provider Name
Service n°18: Service Dialling Numbers (SDN)
Service n°19: Extension3
Service n°20: RFU
Service n°21: VGCS Group Identifier List (EFVGCS and EFVGCSS)
Service n°22: VBS Group Identifier List (EFVBS and EFVBSS)
Service n°23: enhanced Multi-Level Precedence and Pre-emption Service
Service n°24: Automatic Answer for eMLPP
Service n°25: Data download via SMS-CB
Service n°26: Data download via SMS-PP
Service n°27: Menu selection
Service n°28: Call control
Service n°29: Proactive SIM
Service n°30: Cell Broadcast Message Identifier Ranges
Service n°31: Barred Dialling Numbers (BDN)
Service n°32: Extension4
Service n°33: De-personalization Control Keys
Service n°34: Co-operative Network List
Service n°35: Short Message Status Reports
Service n°36: Network's indication of alerting in the MS
Service n°37: Mobile Originated Short Message control by SIM
Service n°38: GPRS
Service n°39: Image (IMG)
Service n°40: SoLSA (Support of Local Service Area)
Service n°41: USSD string data object supported in Call Control
Service n°42: RUN AT COMMAND command
Service n°43: User controlled PLMN Selector with Access Technology
Service n 44: Operator controlled PLMN Selector with Access Technology
Service n 45 HPLMN Selector with Access Technology
Service n 46: CPBCCH Information
Service n 47: Investigation Scan
Service n°48: Extended Capability Configuration Parameters
Service n°49: MExE
Service n°50 Reserved and shall be ignored

3G USIM 2G SIM Service Numbers

3G USIM 2G SIM Service Numbers

3G USIM (2010-04)
Service n°1: Local Phone Book
Service n°2: Fixed Dialling Numbers (FDN)
Service n°3: Extension 2
Service n°4: Service Dialling Numbers (SDN)
Service n°5: Extension3
Service n°6: Barred Dialling Numbers (BDN)
Service n°7: Extension4
Service n°8: Outgoing Call Information (OCI and OCT)
Service n°9: Incoming Call Information (ICI and ICT)
Service n°10: Short Message Storage (SMS)
Service n°11: Short Message Status Reports (SMSR)
Service n°12: Short Message Service Parameters (SMSP)
Service n°13: Advice of Charge (AoC)
Service n°14: Capability Configuration Parameters 2 (CCP2)
Service n°15: Cell Broadcast Message Identifier
Service n°16: Cell Broadcast Message Identifier Ranges
Service n°17: Group Identifier Level 1
Service n°18: Group Identifier Level 2
Service n°19: Service Provider Name
Service n°20: User controlled PLMN selector with Access Technology
Service n°21: MSISDN
Service n°22: Image (IMG)
Service n°23: Support of Localised Service Areas (SoLSA)
Service n°24: Enhanced Multi Level Precedence and Pre emption Service
Service n°25: Automatic Answer for eMLPP
Service n°26: RFU
Service n°27: GSM Access
Service n°28: Data download via SMS-PP
Service n°29: Data download via SMS CB
Service n°30: Call Control by USIM
Service n°31: MO-SMS Control by USIM
Service n°32: RUN AT COMMAND command
Service n°33: shall be set to '1'
Service n°34: Enabled Services Table
Service n°35: APN Control List (ACL)
Service n°36: Depersonalisation Control Keys
Service n°37: Co-operative Network List
Service n°38: GSM security context
Service n°39: CPBCCH Information
Service n°40: Investigation Scan
Service n°41: MExE
Service n°42: Operator controlled PLMN selector with Access Technology
Service n°43: HPLMN selector with Access Technology
Service n°44: Extension 5
Service n°45: PLMN Network Name
Service n°46: Operator PLMN List
Service n°47: Mailbox Dialling Numbers
Service n°48: Message Waiting Indication Status
Service n°49: Call Forwarding Indication Status
Service n°50: Reserved and shall be ignored
Service n°51: Service Provider Display Information
Service n°52 Multimedia Messaging Service (MMS)
Service n°53 Extension 8
Service n°54 Call control on GPRS by USIM
Service n°55 MMS User Connectivity Parameters
Service n°56 Network's indication of alerting in the MS (NIA)
Service n°57 VGCS Group Identifier List (EFVGCS and EFVGCSS)
Service n°58 VBS Group Identifier List (EFVBS and EFVBSS)
Service n°59 Pseudonym
Service n°60 User Controlled PLMN selector for I-WLAN access
Service n°61 Operator Controlled PLMN selector for I-WLAN access
Service n°62 User controlled WSID list
Service n°63 Operator controlled WSID list
Service n°64 VGCS security
Service n°65 VBS security
Service n°66 WLAN Reauthentication Identity
Service n°67 Multimedia Messages Storage
Service n°68 Generic Bootstrapping Architecture (GBA)
Service n°69 MBMS security
Service n°70 Data download via USSD and USSD application mode
Service n°71 Equivalent HPLMN
Service n°72 Additional TERMINAL PROFILE after UICC activation
Service n°73 Equivalent HPLMN Presentation Indication
Service n°74 Last RPLMN Selection Indication
Service n°75 OMA BCAST Smart Card Profile
Service n°76 GBA-based Local Key Establishment Mechanism
Service n°77 Terminal Applications
Service n°78 Service Provider Name Icon
Service n°79 PLMN Network Name Icon
Service n°80 Connectivity Parameters for USIM IP connections
Service n°81 Home I-WLAN Specific Identifier List
Service n°82 I-WLAN Equivalent HPLMN Presentation Indication
Service n°83 I-WLAN HPLMN Priority Indication
Service n°84 I-WLAN Last Registered PLMN
Service n°85 EPS Mobility Management Information
Service n°86 Allowed CSG Lists and corresponding indications
Service n°87 Call control on EPS PDN connection by USIM
Service n°88 HPLMN Direct Access
Service n°89 eCall Data
Service n°90 Operator CSG Lists and corresponding indications

------------------------------------------------------------------

2G SIM (2007-06)
Service n°1 : CHV1 disable function
Service n°2 : Abbreviated Dialling Numbers (ADN)
Service n°3 : Fixed Dialling Numbers (FDN)
Service n°4 : Short Message Storage (SMS)
Service n°5 : Advice of Charge (AoC)
Service n°6 : Capability Configuration Parameters (CCP)
Service n°7 : PLMN selector
Service n°8 : RFU
Service n°9 : MSISDN
Service n°10: Extension1
Service n°11: Extension2
Service n°12: SMS Parameters
Service n°13: Last Number Dialled (LND)
Service n°14: Cell Broadcast Message Identifier
Service n°15: Group Identifier Level 1
Service n°16: Group Identifier Level 2
Service n°17: Service Provider Name
Service n°18: Service Dialling Numbers (SDN)
Service n°19: Extension3
Service n°20: RFU
Service n°21: VGCS Group Identifier List (EFVGCS and EFVGCSS)
Service n°22: VBS Group Identifier List (EFVBS and EFVBSS)
Service n°23: enhanced Multi-Level Precedence and Pre-emption Service
Service n°24: Automatic Answer for eMLPP
Service n°25: Data download via SMS-CB
Service n°26: Data download via SMS-PP
Service n°27: Menu selection
Service n°28: Call control
Service n°29: Proactive SIM
Service n°30: Cell Broadcast Message Identifier Ranges
Service n°31: Barred Dialling Numbers (BDN)
Service n°32: Extension4
Service n°33: De-personalization Control Keys
Service n°34: Co-operative Network List
Service n°35: Short Message Status Reports
Service n°36: Network's indication of alerting in the MS
Service n°37: Mobile Originated Short Message control by SIM
Service n°38: GPRS
Service n°39: Image (IMG)
Service n°40: SoLSA (Support of Local Service Area)
Service n°41: USSD string data object supported in Call Control
Service n°42: RUN AT COMMAND command
Service n°43: User controlled PLMN Selector with Access Technology
Service n 44: Operator controlled PLMN Selector with Access Technology
Service n 45 HPLMN Selector with Access Technology
Service n 46: CPBCCH Information
Service n 47: Investigation Scan
Service n°48: Extended Capability Configuration Parameters
Service n°49: MExE
Service n°50 Reserved and shall be ignored

Orange and Vodka - mixing mobile networks

Orange and Vodka - mixing mobile networks

(shaken, not stirred)

.

Good title for a book or article that heading. I thought this would be a useful post regarding the unusual occurrence of roaming onto a forbidden UK network from the home UK network.These screenshots record an event that happened on my wireless broadband. In the area I was located at the time Orange provided GPRS at 56K but download rates of under 6.5kbps (no 3G) - so not very good at all.
.

.
Such a matter like this may have an influence, if understood that it may occur, on any post-obtained radio test measurements after an alleged crime, or may even taint what may be considered a flawless opinion or conclusion, that is when conducting cell site analysis (CSA) investigations for evidential purposes.

.

.
It is not the fact that post-obtained radio test measurements failed to replicate an earlier event, it is the fact that a 'possibility' that may need to be explored to provide a more rounded opinion or conclusion in a report and at Court maybe missed or overlooked.
.
There are answers to the above conundrum but this is not the point of this post, which has been to highlight a technical event that might impact on evidence.

UTRAN & GERAN 3G Inter-PLMN Handover

UTRAN & GERAN 3G Inter-PLMN Handover

.

The subscriber's home network is France. The visited network where the subscriber is registered in a VLR (Visitor Location Register) is Germany. The signalling connection between HLR (Home Location Register) and VLR is indicated by dotted lines. The calls for the subscriber are controlled by the MSC collocated to the VLR where the subscriber is registered. This MSC (Mobile Services switching Centre) is called "anchor MSC".

.

Handover to a different MSC may occur if the cell serving the subscriber after handover is not controlled by the anchor MSC. This MSC is called the "serving MSC". Even after the call has been handed over to a different MSC, the call control function remains in the anchor MSC. The signalling connection and circuit switched connection established between anchor MSC and serving MSC are indicated by a solid line.

.

When the French subscriber registered in a German network roams near the border to the Netherlands, inter-PLMN handover may occur. In this case a Dutch network is the target network. After handover, the anchor MSC located in a German network continues to control the call. The German network remains the visited network where the subscriber is registered. The subscriber's location information stored in the HLR remains unchanged. The signalling and circuit switched connections between the anchor MSC and the previously serving MSC in the German network will be released when the User Equipment (UE) is served by a cell within a Dutch network. The Dutch network becomes the serving network. From the Dutch network the subscriber may be handed over to a Belgian network (see Figure 1).

.



.

It is noteworthy. A problem exists for mobile users when commuting across national borders. Whilst manual network selection may be used to ensure that the user can select the HPLMN (Home PLMN)/ EHPLMN (Equivalent Home-PLMN), many users use Automatic Selection mode; and the ME is only permitted to select PLMNs of a higher priority within the same country in automatic mode. This leads to the situation that, having crossed back into its home country and within HPLMN coverage, an ME might remain camped on the VPLMN in the adjacent territory.

.

As a consequence, the user will be charged international roaming rates for all calls made or received until such time as an MS either:

.

(a) moves out of VPLMN coverage or

(b) manually selects the HPLMN.

.

Note: Power cycling the ME does not solve the problem because the mobile will look for the RPLMN (Roaming-PLMN). The reference to ME is infact a reference also to 3G UE (User Equiment).

.

These matter can impact when considering Roaming Cell Site Analysis and Call/Billing Records. It is recommend therefore that reviewing the 3GPP Standards aid understanding how UTRAN and GERAN can function under certain UE conditions particularly when dealing with Network Selection Principles.

.

Thanks to 3GPP for provision of information used in this discussion.

GSM Mast Installations (Density)

GSM Mast Installations (Density)

.

When planning a cellular radio network there are many aspects to consider. The matter of radio technology and their frequencies (carriers) are but two examples. A relevance to be understood from these examples relate to what services may be obtained and delivered through these carriers? GSM for basic voice and text services and W-CDMA providing high data rates for video, gaming and conferencing etc.
.

Germane and relevant to obtaining radio services are the radio access technologies needed for that - Masts and Antennas. In radio engineering terms, antennas provide the physical technology to access the services obtained in the radio coverage by use of transmitters and receivers, commonly referred to by the acronym TRXs. The Masts provide the physical location for the siting of the TRXs. An important aspect of Mast installations is knowing the potential customer numbers that will use the services obtained from them. The calculation used for the number of customers and the number of calls that can be handled by one Mast's TRXs is calculated using the Erlang formulae - the number of calls and time length of each call in an hour.
.

Generally, though, to understand how Erlang can be used to determine the number of Masts and TRXs for an area let's just say there are 50,000 potential customers for a particular area. Let us also say to retain quality of service three sectors with 2 or 4 TRXs per sector, s222 or s444 respectively, are required. Let's also indicate that it is known that:

.

=======

.
1 TRX = 3 erlang, 2 TRXs = 5 erlang, 3 TRXs = 15 erlang, 4 TRXs = 20 erlang
.

The relevant TRXs selected for this Mast installation scenario are 2 TRXs and 4 TRXs.
.

Let:
.

50,000 x 0.02 erlang, where 0.02 erlang is used per customer = **1000 erlang
.

Each sector of an s444 may carry up to 20 erlang x 3 sectors = **60 erlang
.

**1000/**60 = 16.7
.

Therefore:
.

16.7 (17) Mast installations would be needed where a configuration of TRXs s444
.

or where
.

33.4 (35) Mast installations would be needed where a configuration of TRX s222
.

================

.

Remember the above is intended only to be illustrative so that it can be used to draw inferences about Masts installations and potential user numbers based upon the density of Masts in an area. An inference, such as, why a Mast further away than Masts sited closer to where a mobile station (MS) may be located routed the text message to the MS?

.

There are a large number of issues to be considered but let us take iwo important issues to be considered are:

.

- Point-to-Area predictions for terrestrial services 30 MHz to 3000 MHz

- Point-to-Point short message service (SMS)

.

In relation to point-to-area it could be the height of buildings surrounding the MS may be a cause for a distant Mast routing a point-to-point SMS text message. Alternatively, it may be the routing of the point-to-point SMS text message from a distant Mast occurred because the MS, in the idle mode, was surrounded by Masts that were at call traffic capacity. Alternatively it could be because of a combination of both buildings and call traffic capacity.

.

Knowing matters like these are very useful when dealing cell site analysis and a reason why they are incorporated into the Core Skills Knowledge of the TrewMTE training courses:

.

GSM Cell Site Analysis Training Course

-------------------------------------------------------

.

Course One: GSM Core Skills Knowledge Course (CSA Part 1)

3-days training

.
Course Two: GSM Cell Site Analysis Course (CSA Part 2)

3-days training
.

Course Three: GSM Cell Site Analysis Course (CSA Part 3)

3-days training
.

3G Cell Site Analysis Training Course

----------------------------------------------------

Course One: 3G Core Skills Knowledge Course (CSA Part 1)

4-days training

.
Course Two: 3G Cell Site Analysis Course (CSA Part 2)

3-days training

.
Course Three: 3G Cell Site Analysis Course (CSA Part 3)

3-days training

.

SIM Card Training

-------------------------
GSM SIM Card Training Course

3-days training

.
USIM/UICC Card Training

------------------------------------

3G USIM/UICC Training Course

3-days training

.
GSM/3G Handset Examination Training

------------------------------------------------------

GSM/3G Mobile Telephone Training Course

4-days training

------------------------------------------------------
MTEB Mobile Telephone Evidence Diplomas (MTEdipl).

Cell Site Analysis Obervations

Cell Site Analysis Obervations

"Radio, she is a beauty but a mistress to none. Just when you think you have her coralled up she'll jump and kick you right in the backside when you least expect it. She is indeed a worthy challenge."

I said that in 1994, and I haven't changed my mind todate.

The above will be brought home to you only too quickly when you deal with digital radio and the art of cell site analysis. If you want a starting point with GSM, then start with the GSM standards. Having spent many years dealing with GSM and the evidence that can be produced from it, I am still in awe today as I was back in 1993 when I first started to work with GSM. For those not yet having an insight into the GSM, I can only say we really do stand on the shoulders of geniuses. I cannot think of any other technology where the authors produced such an amazing system and went on to fully document what they have done, only asking you respect what they have done by reading the standards and comprehending, and then go on to use it.

For example, when considering GSM, it is worth knowing at least four principles to be understood:

- There are mandatory requirements with mandatory outcomes
- There are mandatory requirements with optional outcomes
- There are optional requirements with mandatory outcomes
- There are optional requirements with optional outcomes

This appears to apply right across the GSM system.

There are some very good radio detection systems around, such as TEMS, Sagem etc, useful for part of the job of cell site analysis radio data acquisition. Each provides different ways to assess the radio system. An expert or examiner cannot get by though relying on devices alone. You need knowledge, skill and experience in order to comprehend the radio assessment and then how to apply it.

If you do come to our branch of forensic science, do make sure you understand the GSM system and not simply knowing how the device works. It does make for better quality of evidence and assist in a higher degree of certainty about the opinion that may be expressed regarding mobile telephone evidence.

Also, if you intend to enter 3G forensic investigation, you will find it much easier having a GSM background understanding and how it impacts; and of course having read the 3G standards.

The caveat in all of this, of course, is both systems (GSM & 3G) are constantly evolving. Even with all the years I have been working with GSM, what I have found is the more I know, the more I need to know. I find exactly the same with 3G.

MTEdipl Diplomas

MTEdipl Diplomas

.

For registered students and those going through the process of registering for the Diplomas for the start of the September 2010 intake:
.
Three Months Notice (June/July/August) Advanced reading to help you prepare for the distance learning and self study. The following book comes highly recommended and will help you with setting your objectives particularly for the research and study modules for each Diploma.
.
LITERATURE:
Skills for Success, The Personal Development Planning Handbook
Author: Stella Cottrell Paperback: 312 pages
Publisher: Palgrave Macmillan (2 May 2003)
Language English ISBN-10: 1403911320
.
Amazon link:
http://www.amazon.co.uk/Skills-Success-Personal-Development-Planning/dp/1403911320

MTEdipl Diplomas

MTEdipl Diplomas

.

For registered students and those going through the process of registering for the Diplomas for the start of the September 2010 intake:
.
Three Months Notice (June/July/August) Advanced reading to help you prepare for the distance learning and self study. The following book comes highly recommended and will help you with setting your objectives particularly for the research and study modules for each Diploma.
.
LITERATURE:
Skills for Success, The Personal Development Planning Handbook
Author: Stella Cottrell Paperback: 312 pages
Publisher: Palgrave Macmillan (2 May 2003)
Language English ISBN-10: 1403911320
.
Amazon link:
http://www.amazon.co.uk/Skills-Success-Personal-Development-Planning/dp/1403911320

Diplomas: MTEdipl Syllabus and Student Handbook

Diplomas: MTEdipl Syllabus and Student Handbook

The distance learning and self-study Diplomas: Mobile Telephone Evidence (MTEdipl) Syllabus and Student Handbook is now available for download:


http://www.4shared.com/document/7XHHJ1Ru/MTEdipl_Cata20.html

Diplomas: MTEdipl Syllabus and Student Handbook

Diplomas: MTEdipl Syllabus and Student Handbook

The distance learning and self-study Diplomas: Mobile Telephone Evidence (MTEdipl) Syllabus and Student Handbook is now available for download:


http://www.4shared.com/document/7XHHJ1Ru/MTEdipl_Cata20.html

Orange and Vodka - mixing mobile networks

Orange and Vodka - mixing mobile networks

(shaken, not stirred)

.

Good title for a book or article that heading. I thought this would be a useful post regarding the unusual occurrence of roaming onto a forbidden UK network from the home UK network.These screenshots record an event that happened on my wireless broadband. In the area I was located at the time Orange provided GPRS at 56K but download rates of under 6.5kbps (no 3G) - so not very good at all.
.

.
Such a matter like this may have an influence, if understood that it may occur, on any post-obtained radio test measurements after an alleged crime, or may even taint what may be considered a flawless opinion or conclusion, that is when conducting cell site analysis (CSA) investigations for evidential purposes.

.

.
It is not the fact that post-obtained radio test measurements failed to replicate an earlier event, it is the fact that a 'possibility' that may need to be explored to provide a more rounded opinion or conclusion in a report and at Court maybe missed or overlooked.
.
There are answers to the above conundrum but this is not the point of this post, which has been to highlight a technical event that might impact on evidence.

UTRAN & GERAN 3G Inter-PLMN Handover

UTRAN & GERAN 3G Inter-PLMN Handover

.
The subscriber's home network is France. The visited network where the subscriber is registered in a VLR (Visitor Location Register) is Germany. The signalling connection between HLR (Home Location Register) and VLR is indicated by dotted lines. The calls for the subscriber are controlled by the MSC collocated to the VLR where the subscriber is registered. This MSC (Mobile Services switching Centre) is called "anchor MSC".
.
Handover to a different MSC may occur if the cell serving the subscriber after handover is not controlled by the anchor MSC. This MSC is called the "serving MSC". Even after the call has been handed over to a different MSC, the call control function remains in the anchor MSC. The signalling connection and circuit switched connection established between anchor MSC and serving MSC are indicated by a solid line.
.
When the French subscriber registered in a German network roams near the border to the Netherlands, inter-PLMN handover may occur. In this case a Dutch network is the target network. After handover, the anchor MSC located in a German network continues to control the call. The German network remains the visited network where the subscriber is registered. The subscriber's location information stored in the HLR remains unchanged. The signalling and circuit switched connections between the anchor MSC and the previously serving MSC in the German network will be released when the User Equipment (UE) is served by a cell within a Dutch network. The Dutch network becomes the serving network. From the Dutch network the subscriber may be handed over to a Belgian network (see Figure 1).
.

.
It is noteworthy. A problem exists for mobile users when commuting across national borders. Whilst manual network selection may be used to ensure that the user can select the HPLMN (Home PLMN)/ EHPLMN (Equivalent Home-PLMN), many users use Automatic Selection mode; and the ME is only permitted to select PLMNs of a higher priority within the same country in automatic mode. This leads to the situation that, having crossed back into its home country and within HPLMN coverage, an ME might remain camped on the VPLMN in the adjacent territory.
.
As a consequence, the user will be charged international roaming rates for all calls made or received until such time as an MS either:
.
(a) moves out of VPLMN coverage or
(b) manually selects the HPLMN.
.
Note: Power cycling the ME does not solve the problem because the mobile will look for the RPLMN (Roaming-PLMN). The reference to ME is infact a reference also to 3G UE (User Equiment).
.
These matter can impact when considering Roaming Cell Site Analysis and Call/Billing Records. It is recommend therefore that reviewing the 3GPP Standards aid understanding how UTRAN and GERAN can function under certain UE conditions particularly when dealing with Network Selection Principles.
.
Thanks to 3GPP for provision of information used in this discussion.
.
More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Seminar on GSM Standards Updated

Seminar on GSM Standards Updated

.
Updated for Seminar on GSM Standards (previous link):

http://trewmte.blogspot.com/2010/03/seminar-on-gsm-standards.html
.
It doesn't appear easy to take in the mobile telephone technical standards and that the numerous standards that are out there add an additional layer of perceived complexity.
.
To address this particular matter and demonstrate that dealing with technical standards is far easier than is imagined, as part of the presentation at the Seminar on GSM Standards, diagrams will be shown that reference common elements dealt with during examination. The diagrams are to demonstrate that it is far easier to address technical issues starting with a GSM perspective than it is jumping in at the deep end trying to understand 3G and work backwards.
.
One of the illustrations to be presented at the Seminar (shown below) relates to UICC with SIM and USIM environments. At the Seminar the illustration will be completed with identification of the relevant technical standards that should ease perceived complexity issues with UICC with SIM/USIM environment using this identification process.
.
.
UICC with SIM/USIM environments there are over 80 standards that can be referred to, but an examiner only need start with knowing approximately 20 technical standards at first instance and then expand into the other standards. Be sure of what I am saying here. You need to know the standards that exist and have a copy. Reading standards is not though a matter the Seminar will be addressing, but some helpful tips will be provided.
.
With GSM SIM there are over 40 standards that can be referred to, but knowing approximately 8 technical standards to start with can help kick start getting to the other standards and the realisation that dealing with technical standards need not be a daunting task at all, particularly as acquiring majority of the standards are free, as well.

Seminar on GSM Standards

Seminar on GSM Standards

.
It is clear that associated with mobile phone examination to obtain evidence that examiners must read the GSM Standards to understand the data evidence and whether the devices used acquire the data. The concern amongst examiners still exists because there are so many Standards current and historical and each providing variations on obtaining evidence and interpretation that it is a daunting task to know where to start. Would it be worth having a one-day seminar in the UK to go through the GSM Standards. Standards can change 2-3 times a year and presenting the information at a seminar would assist in getting across important facts and guide through how to get to the appropriate information in them. I wont be charging for my time to prepare the presentation and present the findings.
.
So that delegates can attend free of charge I am also looking for:
.
1) Sponsor (to pay) for the Seminar room/hall
2) A location must be near to a central train station (not requiring loads of train changes)
3) Sponsor (to pay) for the teas/coffee and sandwiches etc
4) Exhibitors at the Seminar
.
Can you send some feedback whether you are interested in attending or sponsoring.

UPDATE: Seminar on GSM Standards

Objectives

Upon completion of the seminar, the participant should:


• Understand the GSM Standards development and legal references

• Be aware of GSM system standards relevant to the examination or investigation

• Have an awareness of GSM interfaces to comprehend symbiotic relationships for call/data tracing

• To know where to look to attribute identity conventions

• Know availability of standards

There are five presentation modules:

1) Introduction

2) GSM System Standards

3) GSM Specified Interfaces (10 + 1)

4) Identifier Conventions

5) Access to Standards

Mobile Phones, Security, Economy and Employment

Mobile Phones, Security, Economy and Employment

.

An article in the Telegraph on the 6th November 2009 caught my eye, titled "Inventor of mobile phones says they have become 'too complicated" are the thoughts of Martin Cooper who was th lead engineer at Motorola and made the first mobile phone call in 1973.

.

http://www.telegraph.co.uk/expat/expatnews/6509126/Inventor-of-mobile-phones-says-they-have-become-too-complicated.html

.

Echos of how complicated mobile phones can be are common views heard from many users. However, we need to make the distinction that complicated doesn't mean they are "functionally unused". As usage and personal data populates many memory areas in mobiles it is because of that "functional use" it is so important to mobile telephone examination.

.

The places where user information proliferates are places in smart phones memory that are simply not being examined by practitioners as they are being led to place too much reliance upon the machinery (reading devices) where the output is being presented parrot fashion. The machinery does not contain the high level of competence necessary to cope with all the aspects associated mobile telephone evidence. Neither, for that matter, does the machinery examine all areas of memory. The current round up of forensic readers on the market simply surf certain quarters where certain information resides in memory. Data recovered can also vary dependent upon the machinery and the machinery recovering data from some makes, models and firmware versions. It is great having tools but they really do not supercede in any shape, manner or form the ability of the knowledge and skills needed by the practitioner.

.

The above are some issues that are influencing the need for a common mobile telephone forensics standard in the UK. Other factors that require change:

.

-No longer have unnecessary separated areas between law enforcement and the independent sector.

-No longer have poorly considered policies, practices and procedures regarding mobile telephone examination and evidence because they are not fully considered by all
-No longer have various public agencies promulgating confused and diametrically opposed procedures

.

Another reason why it is important to have a single common standard approach (and a second reason why I started the mobile forensics and evidence Pathfinder Approach) is the misrespresentation regarding the status of 'mobile phone'. Inspite of a hugh array of information about wireless, radio, radio signals and their role in the creation of a mobile phone, there still remains a persistence in the forensic and evidential system in indulging the notion that mobile phones are computers. That is rather ashame because whether it is done for cheap-labelling or getting bigger budgets (more than likely) it is largely unnecessarily and willful. Computer forensics in the area of data recovery from mobile phones has made an enormous contribution to our field. But after data recovery has been performed what else does computer forensics do for mobile phone wireless, radio, radio signals etc? Nothing. That is because computer forensics is not a discipline needed to embrace wireless; computing is rather a subset of wireless communications.
.

A mobile phone is a wireless device at first instance and designed for that purpose. It has a history, decades before the hybrid (computer) was created. Mobile phones allow for instantaneous radio telecommunications to place and to enable voice and data to be communicated. The device also allows for a memory area to record exchange of information. Overall this makes wireless devices useful to the user and gives them an appeal of user-friendliness.

.

Memory, code and data can be found in many systems and devices and code and data may be subjected to computation, but in their finite existence they are not a computer. These elements are storage, protocol and information. The only area where mobile telephones are connected with computer, per se, is that they have a CPU to enable computation. But mobile phones could operate without a CPU albeit currently the experience would no doubt not be too pleasureable, and in the future where the commonly understood CPU is dispensed with.

.

Yet a further reason why practitioners tacitly admit, through their conduct, that a mobile phone is a wireless device and not a computer is through the use of radio isolation (faraday rooms, tents or bags). Faraday rooms can cost £70K of tax payers money. So why would practitioners use radio isolation if the device under test was simply a computer? Moreover, how could cell site analysis be conducted if mobile telephones were simply a computer?

.

Moreover, wireless and mobile telephones have their own legalisation, directive, standards and guidelines - none of these designate them, technically or otherwise, as computers. Indeed there is a huge number of mobile telephone departments and labs in the public sector - none of them are labelled computer.

.

Two further reasons for a common standard created by all practitioners to underpin integrity:

.

- to give courts of law guarantee about the relability of mobile telephone evidence and opinion and to allow the legal system to it jobs as opposed to trying to hoodiwink the legal system or dictate to it; the current position is high% of evidence is being pushed through on the nod without any appropriate or independent assessment or scrutiny. This is occurring because many claiming themselves to be experts the basis for which is that they have had several mobile phones or owned mobile phones or visited forums or bought a piece of equipment that reads mobile phones. This area potentially opens the door to a huge range of appeal cases costing tax payers many millions of pounds which society can ill-afford given the economic pressures on the UK for the next 6 years.

.

- there is no single coherent standard for mobile telephone examination in the UK, despite the fact that up until 2003/4 Britain led the world in mobile telephone examination and evidence which was underpinned with alot of my work that begun the programme to help law enforcement understand the technological evidence with which they were dealing. When the public sector changes took place, experience was through out of the window in favour for opening pandora's box; anyone with relatively limited experience could give mobile evidence or had a desire to train others in mobile phone evidence, they could do so; Britain's international standing has been allowed to plummet and has been dropping further ever since. This is what awaits the Olympic Games in 2012 in this country and it is important to rectify this.

.

Lastly, I point out to Government Ministers looking at this matter, you will have seen the UK MTEB Mobile Forensics Conference 25th and 26th November 2009. The point of the Pathfinder Approach is to ensure Governement has the experience available to it, not simply from Law Enforcement, but from the independent sector where 90% of knowledge and skills are developed for mobile phone examination and evidence.

.

However, there is some disappointing news that many of the Constabularies are not even sending one representative to the Conference because we are told they have no money (even where everyone knows the Conference charge is extremely low and is a not-for-profits Conference). Also, that apparently it would impact for the attending person to justify how s/he will do their work to catch up after 2-days away from the office; this is on the basis that delegation of work doesn't exist. On the back of that, numerous outsources to those Constabulary not attending, have not signed up either. This is not a case of forcing them to attend, but it highlights the glaring obvious gaps across the UK and the regional educated pot-holed thinking in the country.

.

A list of delegates of those attending Conference and speakers supporting the Pathfinder Approach can be provided to Ministers. I can confirm there are some law enforcement and public agencies attending.

.

The Economy and Employment

Maybe the NAO and/or the Competition Commissioner might start to look and to see whether the way the forensic system is divvied up stilfes proper competition in the UK and impacts on town and urban regeneration to help develop small businesses, leading to employment. For instance, what is the point of a Constabulary throwing £1-million or more at one firm when a contract for 3 years @ £100,000.00p.a. to one small firm could enable eg one-person business to take on, say, one secretary and one assistance for 3 years:

.

- £50,000.00 Principal

- £27,0000 Secretary/Assistant

- £5,000.00 for equipment

- £1800.00 for compliance training and checking

- £16,200 for office rent/business rates/phone etc etc

.

Using the £1-million as the financial basis, multiply the above idea by 10 new small businesses, 20 people newly employed, rejuvernation of local funding to locals councils and suddenly spread across the country the grass roots of growth can start without the Governement having to increase current funding levels. Certainly, if I were offered a deal like this and with my understanding of the forensics arena I could have turned one of these businesses in two years providing employment for 10 people and in 3 years employ 25 people and teach other businesses how to do it as well. I have been in this business for over 20 years. The Police have never offered me a £1 million or £500K pa contract for that matter but still seek out my advice. So why can we not put my skills to help others.

.

To assist I have a plan that can keep those new businesses up to common standard for 3 years under their contracts. Also I have a team I have identified that along with myself could spear head this project to lift it off the ground.

.

How will this help Parliament. MPs from all parties can now go back to their constituencies and offer some hope of rejuvenation and employment.

.

Hmmm....I wonder if "Dragons' Den" might be interested in this.

3G Dongle CSA sample measurements

3G Dongle CSA sample measurements

.

Since the UK MTEB Mobile Forensics Conference 2009 is being held in Dorking, a short drive from Box Hill Point (an area of outstanding natural beauty that is situated in the National Trust Park) I thought I would go out and conduct some 3G radio test measurements. I was interested to comprehend, given the terrain and forest area, the quality and type of coverage was like along the road from Box Hill Point. I viewed the operator coverage maps for this area and found that the operators offered fringe coverage in the area.

.

I recorded sample measurments for the Orange mobile network as their Mast in Dorking is approximately 3.5Km from Box Hill. The screen prints of the measurements are set out below. The sample measurements were taken over a 45-minutes period.

.

Image 1:

illustrates the route driven from Dorking to Box Hill (a) to (b) and

(b) was the approximate location point for tests.

.

Image 2:
illustrates the OFCOM basestation database details for the

Orange Mast (3G) at Dorking High Street dteected at Box Hill location (b)
.

Image 3:
illustrates the terrain path from Dorking to Box Hill (a) to (b) and
(b) was the approximate location point for tests. Box Hill is 687-metres above sea level
. Image 4:
illustrates the mobile network operator, signal strength (RSSI), registration to
Circuit Switched (CS) and/or Packet Switched (PS) and which registration is
attached. Note from all the images below the variations in RSSI, the registrations
and to the network attachments
.
Image 5
.

Image 6

.

Image 7
.

Image 8

.

Image 9
.

Image 10
.

Image 11

.

Image 12
.

Image 13

.

Image 14
.

Image 15

.

Image 16
.

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Join MTEB Forum if your are in wireless / telecomms

Join MTEB Forum if your are in wireless / telecomms

.
If you work in forensics and/or examination devices, investigations or deal with evidence then the MTEB forum puts you in contact with other professionals when you need help with technical issues, technical discussions or generally want to stay up to date. Due to the make up of the forum members: experts, high level security, law enforcement and senior investigators requests to join are vetted.
.
.
Invitation to Join Mobile Telephone Examination Board
--------------------------------------------------------
The MTEB forum is dedicated to evidential standards, forensic examination and lawful interception dealing with mobile telephones/SIM/USIM/MMC, bluetooth, IrDA, USB, cell site analysis and mobile networks GSM, CDMA, 3G, 4G.
.
Link if you are NOT a LinkedIn member:

http://www.linkedin.com/groupInvitation?groupID=141739&sharedKey=35E59F107179

Link if you are a LinkedIn member:
http://www.linkedin.com/groupsDirectory?results=&sik=1216135556335

Join MTEB Forum if your are in wireless / telecomms

Join MTEB Forum if your are in wireless / telecomms

.
If you work in forensics and/or examination devices, investigations or deal with evidence then the MTEB forum puts you in contact with other professionals when you need help with technical issues, technical discussions or generally want to stay up to date. Due to the make up of the forum members: experts, high level security, law enforcement and senior investigators requests to join are vetted.
.
.
Invitation to Join Mobile Telephone Examination Board
--------------------------------------------------------
The MTEB forum is dedicated to evidential standards, forensic examination and lawful interception dealing with mobile telephones/SIM/USIM/MMC, bluetooth, IrDA, USB, cell site analysis and mobile networks GSM, CDMA, 3G, 4G.
.
Link if you are NOT a LinkedIn member:

http://www.linkedin.com/groupInvitation?groupID=141739&sharedKey=35E59F107179

Link if you are a LinkedIn member:
http://www.linkedin.com/groupsDirectory?results=&sik=1216135556335

GSM Mast Installations (Density)

GSM Mast Installations (Density)

.

When planning a cellular radio network there are many aspects to consider. The matter of radio technology and their frequencies (carriers) are but two examples. A relevance to be understood from these examples relate to what services may be obtained and delivered through these carriers? GSM for basic voice and text services and W-CDMA providing high data rates for video, gaming and conferencing etc.
.

Germane and relevant to obtaining radio services are the radio access technologies needed for that - Masts and Antennas. In radio engineering terms, antennas provide the physical technology to access the services obtained in the radio coverage by use of transmitters and receivers, commonly referred to by the acronym TRXs. The Masts provide the physical location for the siting of the TRXs. An important aspect of Mast installations is knowing the potential customer numbers that will use the services obtained from them. The calculation used for the number of customers and the number of calls that can be handled by one Mast's TRXs is calculated using the Erlang formulae - the number of calls and time length of each call in an hour.
.

Generally, though, to understand how Erlang can be used to determine the number of Masts and TRXs for an area let's just say there are 50,000 potential customers for a particular area. Let us also say to retain quality of service three sectors with 2 or 4 TRXs per sector, s222 or s444 respectively, are required. Let's also indicate that it is known that:

.

=======

.
1 TRX = 3 erlang, 2 TRXs = 5 erlang, 3 TRXs = 15 erlang, 4 TRXs = 20 erlang
.

The relevant TRXs selected for this Mast installation scenario are 2 TRXs and 4 TRXs.
.

Let:
.

50,000 x 0.02 erlang, where 0.02 erlang is used per customer = **1000 erlang
.

Each sector of an s444 may carry up to 20 erlang x 3 sectors = **60 erlang
.

**1000/**60 = 16.7
.

Therefore:
.

16.7 (17) Mast installations would be needed where a configuration of TRXs s444
.

or where
.

33.4 (35) Mast installations would be needed where a configuration of TRX s222
.

================

.

Remember the above is intended only to be illustrative so that it can be used to draw inferences about Masts installations and potential user numbers based upon the density of Masts in an area. An inference, such as, why a Mast further away than Masts sited closer to where a mobile station (MS) may be located routed the text message to the MS?

.

There are a large number of issues to be considered but let us take it two important issues to be considered are:

.

- Point-to-Area predictions for terrestrial services 30 MHz to 3000 MHz

- Point-to-Point short message service (SMS)

.

In relation to point-to-area it could be the height of buildings surrounding the MS may be a cause for a distant Mast routing a point-to-point SMS text message. Alternatively, it may be the routing of the point-to-point SMS text message from a distant Mast occurred because the MS, in the idle mode, was surrounded by Masts that were at call traffic capacity. Alternatively it could be because of a combination of both buildings and call traffic capacity.

.

Knowing matters like these are very useful when dealing cell site analysis and a reason why they are incorporated into the Core Skills Knowledge of the TrewMTE training courses:

.

GSM Cell Site Analysis Training Course

-------------------------------------------------------

.

Course One: GSM Core Skills Knowledge Course (CSA Part 1)

3-days training

.
Course Two: GSM Cell Site Analysis Course (CSA Part 2)

3-days training
.

Course Three: GSM Cell Site Analysis Course (CSA Part 3)

3-days training
.

3G Cell Site Analysis Training Course

----------------------------------------------------

Course One: 3G Core Skills Knowledge Course (CSA Part 1)

4-days training

.
Course Two: 3G Cell Site Analysis Course (CSA Part 2)

3-days training

.
Course Three: 3G Cell Site Analysis Course (CSA Part 3)

3-days training

.

SIM Card Training

-------------------------
GSM SIM Card Training Course

3-days training

.
USIM/UICC Card Training

------------------------------------

3G USIM/UICC Training Course

3-days training

.
GSM/3G Handset Examination Training

------------------------------------------------------

GSM/3G Mobile Telephone Training Course

4-days training

.
All courses now have credits towards the MTEB Mobile Telephone Evidence Diploma (MTEdip).

USIM-D Images