Secrets and Evidence of Older Mobiles

It is good to learn that the Nokia 3310 may make a return, albeit with an Android operating system. The nostalgia for these types of mobile phones has clearly not been lost. What it might suggest is that consumers still want a mobile telephone to remain a mobile telephone and to look like one.

The older mobile phones I have in mind though are the ones that are still used in examinations, investigations and research. Since there is nostalgic sentiment in the air I thought you might be interested in some examples of older mobile phones from my lab toolkit.

Now these old buzzards are used for basic GSM telephony services. There isn't a universal SIM that will work with these as some from my collection operate with a 5-volt SIM and so on. Importantly they are used due to the fact they have an external antenna and extendable external antenna. In some investigation instances RSSI will show network detection and a small amount of RF power whereas mobiles/smartphones with embedded antennas show Emergency Calls Only.

You might recall I have written numerous articles on radio surveys and two that may seem appropriate to this discussion are:

CSA: Mobile Phones and Fringe Coverage
http://trewmte.blogspot.co.uk/2010/06/csa-mobile-phones-and-fringe-coverage.html

GSM Radio Test Measurements
http://trewmte.blogspot.co.uk/2010/06/gsm-radio-test-measurements.html

The next selection of mobiles/smartphones each provide different radio characteristics due to the manufacturer's selection of RF chipset and functionality.

My five beauties, as I call them, are my Nokia 3210s. Great phones and they still operate perfectly well today. You can also see in the photo that all bar one mobile have embedded antenna. Some are mobile phones and some are smartphones. Combined they offer the ability for RF surveys and testing voice telephony, data downloads, instant messaging etc. The common laptop application Network Monitor (NMonitor/NetMonitor) still provides good feedback when connected to the Nokia 3210 (nmon activated). Blackberry requires a bit of setting up with applications such as MagicBerry, BBHTool, etc., and creating JAD-files (depending on what you want to achieve). Now with the Samsung models GT-I8160 and GT-I9100 both are used with 2G and 3G networks and illustrates the point that two models of smartphone from the same manufacturer display didn't RF survey details.

Now I wont bore you with an explanation of the details just to say these investigation RF surveys require knowing the various ServiceMode states. In particular, if you are conducting a PRACH and RACH survey, relevant to investigations for Access Requests (e.g. the phone is not in idle mode but seeking a service), then the GT-I9100 is useful in that it displays not just the LAC but also the Cell ID the RACH (access) request was made. Quite a few mobiles do not do this when looking into the ServiceMode states. You have to be quick, mind you, as the ServiceMode screen changes fairly quickly if you are not ready to take a photo.

Yet another, quite old-ish, mobile phone that I haven't shown so far is the Nokia 6303. The photo shown below should explain everything. But for those not familiar to testing and examination; where a charge in the billing appears for an SMS or at least details of a called number sent an SMS (even if sent message is free) it is quite possible the party receiving the message can read it but the message wont be saved. This is known as a Class 0 message (commonly referred to as a Flash Message). Depending on make and model of mobile phone, part or all of the message which is only held in RAM might still be recoverable, provided seizure and examination is undertaken and completed fairly quickly, as RAM is updating perpetually. 

The Nokia 6303 is one of those mobiles that the handset manufacturer in combination with mobile network operator enabled this feature as they foresaw revenue generation from it and also recognised that a reasonable memory storage capacity in handset and SIM card need not be blocked up with trivial messages.

The 6303 came with a 940 MB memory card for downloaded applications etc. This proved to be useful in an investigation where text messages didn't have alphabet characters but a series of dots and dashes. At first it was thought this was incomplete text chat messages or some sort of smiley face that didn't form properly when typed on the screen.

When reviewing hundreds of text messages recovered from a mobile or smart phone it is quite easy to overlook or ignore a message as being meaningless. However, I researched the matter and following testing the message turned out to be Morse Code. I tracked down the application for this and cross-checked with the device that had been examined.

            

So next time you see a text message with an odd presentation look closely to see if it has relevance and whether your mobile phone forensic suite software has the capability to either identify the message contains additional features or can translate the message.

Hope you have enjoyed this brief look at older mobile phones used in and for mobile forensic examination, investigations and research.

Cellular Transmission Technology

Cellular Transmission Technology
Here are two test sheets identifying a range of cellular transmission technologies for CSA beginners and practitioners. It requires going through the charts to identify the accuracy of the information recorded in them and identify the relevant mobile network operators. It means researching not simply at the mobile network operators' websites, but researching the standards, etc etc etc.

http://cellsiteanalysis.blogspot.co.uk/2013/10/cellular-transmission-technology.html

Cellular Transmission Technology

Here are two test sheets identifying a range of cellular transmission technologies for CSA beginners and practitioners. It requires going through the charts to identify the accuracy of the information recorded in them and identify the relevant mobile network operators. It means researching not simply at the mobile network operators' websites, but researching the standards, etc etc etc.

A key aim and objective with CSA is to remember to start out being as thorough as you possibily can and create a very, very long list of all the elements you expect identified and what information you expect to be revealed from the elements and what has actually been revealed from the other side in evidence.

When visiting the discussion various forums discussions can often refer to a technical point but the relevant and specific cellular transmission technology is not identified. The problem this creates is quite often reference to mobile communication 'commands' and 'responses' can be transferred between cellular transmission technology. To assist with these complexities the cellular transmission technology test sheets 1 and 2 identify researched information and you have to find out whether all the information and supporting information is accurate or not. The sense of achievement is guaranteed in the finding out as opposed to confirming to the world look what I know. Have a go and see how much you think you know - what have you got to lose.

Special thanks for all the help from the superb information made available by various sources but not limited to the following organisation GSMA, 3GPP/2, TIA/EIA; Regulatory bodies; the various mobile network operators around the world; Alcatel, Andrew, Anite, Anritsu, Ericsson, Huawei, Jaybeam, Kathrein, Nec, Nokia, Nortel, Siemens, Zapp.

Signal Strength and Distance

Signal Strength and Distance

Reading an article on Susan Brenner's blog lay-testimony-on-cell-phone-radio-waves  about the case U.S. v. Kale, 2011 WL 4361531 (U.S. Court of Appeals for the 3d Circuit 2011) I read with interest the comments of the network operator's lay witness, in the article, recorded as having stated:

" Jeff Strohm, a custodian of records at Sprint Nextel Communications (Sprint), testified that Kale's cell phone used signals from a cell tower located in Pennsauken, New Jersey, and that `the biggest indicator’ of which tower has the strongest signal is `distance.’ "

" Jeff Strohm explained that a “cell phone is constantly searching for the strongest signal” and that the strongest signal is usually determined by `how far away you are from the cell phone tower.’ "

If one is speaking very, very generally to school children or novices etc where those people learning the information are hardly going to make a decision upon learning that info, may well be sufficient, but as influencing testimony for a criminal trial? Is that really enough to provide low-level of information that may be used to decide someone's innocence or guilt?  It is important to enter the caveat that other things may have been said by this witness or other material looked at, but this is the only info included in the article and, thus, by omission of any other info the discussion is based upon what is stated in the article.

Technically, when we deal with received signal strength (MS-BTS/BTS-MS) radio engineers - as opposed to back office call record staff - generally consider it to be a composite of three discrete effects:

- path loss
- slow fading
- fast fading

Those discrete effects take no account of and omit other fundamentally important data a mobile phone requires to have received, decoded and understood in order to 'camp on a cell', that is even before the mobile phone is receiving a communication or instructed to communicate.  

'Signal strength' and 'distance' are most certainly not sufficient for either GSM or spread-spectrum transmission technologies such as CDMA or W-CDMA to suggest are the main key factors to determine which Mast will handle a particular mobile phone's communications.

Within the realms of the GSM transmission technology it is made fundamentally clear as part of the mandatory requirements that a mobile phone shall detect 'signal strength', but what use is ranking signal strength in order of merit without understanding issues, such as:

- cell selection algorithm C1?
- cell reselection algorithm C2?
- if the mobile phone fails to decode parameters in 'control channels' e.g. RACH control parameters in the SYS_INFOS BCCH_INFOS 1–4. Is the Cell Barr Access bit = 1 (trace cf: 9D 00 00 & 9F 00 00) or the Access Control Class not equal 0?
- etc?
- And what about BTS capacity and directed retry?

When a mobile phone is engaged in a mobile call then the newtork instructs a mobile phone which Mast to use via control info through eg SDCCH.

Turning to issues associated with distance. If a mobile phone is located in-building, which can have affect on radio signals and latching to a particular Mast; where the landscape surrounding the mobile phone affects radio signals; or the clutter on the landscape affects the radio signals or a combination of any of the aforementioned, distance between MS and BTS gets blown out of the window as a reasonable suggestion in opposition to other matters that ought to be mentioned to a court of law.

As Sprint operates spectrum-spread transmission technology CDMA mobile services and iDEN transmission technology TDMA mobile services, I need to take some care here not to portray, too much, the wrong image of identical scenarios with GSM.

Wiki records Sprint's activities (Sprint_Nextel)
Sprint Nextel Corporation (NYSE: S) is an American telecommunications company based in Overland Park, Kansas. The company owns and operates Sprint, the third largest wireless telecommunications network in the United States, with 52 million customers, behind Verizon Wireless and AT&T Mobility. Sprint Nextel also owns a separate wireless division, Sprint Prepaid Group which offers prepay wireless services as Boost Mobile and Virgin Mobile USA.

Sprint is a global Internet carrier and makes up a portion of the Internet backbone. In the United States, the company is the third largest long distance provider and also owns a majority of Clearwire, which operates the largest wireless broadband network.

The company was renamed in 2005 with the purchase of Nextel Communications by Sprint Corporation. The company continues to operate using two separate wireless network technologies, CDMA and iDEN (for Nextel and some Boost Mobile subscribers). In 2006, the company spun off its local landline telephone business, naming it Embarq (which was subsequently acquired by CenturyTel). In 2009, Sprint reached an agreement to outsource management of its wireless networks to Ericsson.

Sprint Nextel launched its first WiMAX wireless card on December 21, 2008 (the Franklin Wireless u300 broadband card), and the first WiMAX phone available in the United States (the HTC Evo 4G) on June 4, 2010, utilizing its WiMAX technology from Clearwire Corp. A recent Consumer Reports survey tied Sprint with perennial front-runner Verizon Wireless in terms of customer satisfaction, a big improvement over previous years.

Thus, Sprint Nextel is a company with not only good quality indicators, but has outsourced management of its wireless networks to Ericsson, according to Wiki. The latter company (Ericsson) is known for its high technical competence, quality and originality in telecommunications and mobile communications, and adds further gravitas to my discussion that using 'signal strength' and 'distance' are insufficient to suggest that those elements should be used in isolation to other factors how a mobile phone may use a particular Mast. Ericsson, one could say, as an owner of patents, a developer of mobile networks/devices and transmission technology are the expert's expert. I am convinced, therefore, that companies like Sprint Nextel and Ericsson would hardly endorse in isolation to anything else the simplicity of using 'signal strength' and 'distance' as the indicators to inform a court of law about why a mobile phone would use a particular Mast.
       
In the next discussion I shall go further to open up and explore CDMA/TDMA parameters and protocols required for a mobile phone and Mast to connect for communications purposes.