Following my article France Car Shootings and Mobile Evidence http://www.trewmte.blogspot.co.uk/2012/09/france-car-shootings-and-mobile-evidence.html an investigator, previously working with a well-known cellular and fixed network manufacturer, confirmed to me the results of an internal forensics investigation which he conducted.
An employee had made threats to a Director. The employee had been found to use a 'prepaid sim' card to send theat messages but added a delay period for the sent messages of 2-hours. The employee then switched OFF the handset and inserted the company SIM card into the same handset which had previously held the prepaid SIM that had sent the threat messages. The handset with the company SIM card in it was then switched ON; the employee claimed not to have been responsible for the threats sent from a different IMSI (SIM card). The intention of the employee was to mask any connection with the threats. However, tracing the IMSIs of the prepaid SIM card and the company SIM card found both to have been operating in the same handset (IMEI). Such trace capability can be made from enquiries of network databases such as BTS, HLR etc. Moreover with high levels of text messaging that are sent and received whilst roaming there is trace capability that can be made by interrogating CAMEL.
There is also useful data that can be obtained for linking with cell site analysis (CSA), which is a bonus although there appears to be some confusion occuring in the US at the moment as to the value of CSA evidence http://www.forensicfocus.com/Forums/viewtopic/t=9679/ and how the material may be applied on a case by case basis. I am not convinced that licenced operators with highly developed as they are in the US cellular networks simply could not/would not sufficient call record/cell data available to know what is happening when an MS has been active in their networks, about the arrangement at a particular mast (cell tower) as used by an MS, the configuration of the radio network operating at the time an MS has been used and so on.
Showing posts with label Mobile Evidence. Show all posts
Showing posts with label Mobile Evidence. Show all posts
Saturday, September 22, 2012
Monday, September 17, 2012
France Car Shootings and Mobile Evidence
France Car Shootings and Mobile Evidence
It is well known by now that the team investigating the shootings in the French Alps discovered two mobile phones: http://news.sky.com/story/982481/alps-shootings-police-find-two-phones-in-car. The following has nothing to do with the French authorities investigation and does not seek to speculate on what might be. However the case is very useful in that it provides a useful example to apply a conceptual method to seeking out evidence originally discussed in my thread back in January 2009: http://www.trewmte.blogspot.co.uk/2009_01_01_archive.html.
The diagrams below illustrate one method of taking a crime scene event and postulating the possibilities of mobile phone evidence and mobile events that might occur prior to and after e.g. a murder. Yes, it is quite possible that activity on a victim's switched ON mobile phone may still occur after the victim's death. This is in addition to evidence that can accrue when it is switched OFF.
To assist the investigation to make it a more managable task for this case scenario discussion the investigator/examiner can separate, but without severing the links, the case into four stages:
i) possible evidence before and leading upto the crime
ii) possible evidence at the approximate time of (a)shooting, (b)death
iii) possible evidence when attending the scene of crime
iv) possible evidence that might still be collated post scene of crime
The depth and breadth of mobile evidence has substantially increased given the evolving and fast developmental pace of mobile technology and services. To try and discuss all of them would over-complicate this discussion, so the discussion will consider the diagram below and highlight possible mobile evidence and events iv).
The previous 2009 discussion (link given above) needs to be read to understand the diagram below, after which an examiner/investigator then begin to recognise where possible post crime mobile evidence might be generated/occur and create a check list of those possibilities.
Using the 'C now' constant this could represent the position of the investigation in physical space, say where the two mobiles have been recovered but still at the scene of crime. Time is important, too, and therefore the investigator (hypothetically, of course, for this discussion) records a time one-hour after mobile phones recovered at the crime location. This is important for timeline because anything occurring before that time have one set of evidential/event values (prior to approximate time of death) and evidence/events occurring after have another set of evidential values (post approximate time of death). By way of illustrating the latter, the dead victim wont be operating the handset his/herself so that fact is important, but that doesn't exclude the possibility the victim, prior to death, having pre-programmed the handset to do something (e.g. send a birthday text, set an alarm and so on).
The perpetrator/s fled the crime scene and therefore the time delay occuring between that and the discovered mobile phones could be minutes/hours/days. The race is on to catch up if the investigation is not to be caught up on the tide of diminishing returns.
The use of text messaging is prolific and therefore knowing which material to discard and which is important evidence is not an easy task. Commonly, texting is perceived on the basis that a user:
- sends and receives texts
- known or unknown called/calling party
- content based upon 'familiarity' of communicating parties
There is a whole host of investigative information that may need to be practically assessed as to possibility of text occuring on a mobile phone after a victim's death, such as:
- text generated by mobile phone as opposed to text generated on PC sent via the internet e.g: check the SMS header details:
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 44798021XXXX
and where you see 'Originating address' that does not contain the commonly understood mobile telephone number (E.164) but it contains an hex-decimal representation then it might indicate the message originated from the internet. Example
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 35fac2457c0be2008
To start with go back to basics (this is necessary due to the requirements of backward compatibility) and check out GSM standards GSM-0340; 0338, 0411, 0902 etc
- text maybe generated due to a set-calendar event e.g. check user profiling relevant to proactive SIM, STKs and handset calendar
- text may appear as an SMS but what if it is Wi-Fi direct data e.g. depending make/model of mobile phone check settings such as 'wireless and network'
What can happen when received test messages arrive later than the date the text was originated and sent? - http://trewmte.blogspot.co.uk/2007/10/conflicts-call-records-sms-delivery.html - Local and roaming issues maybe relevant?
Check also SMS 'validity period' for sent text messages, thus messages can be held in 'escrow' by a network operator. See GSM 11.11; 3GPP 31102
Additional time values for 'Validity Period' can be found in GSM03.40
There can be other aspects of post-crime related mobile evidence activity on a victim's mobile phone, such as voicemail. Moreover, cell site analysis can have a role here too for a switched ON mobile phones and post-crime generated evidence.
Determining possible evidence and events on a mobile phone or mobile account,, for that matter, which may occur post-crime might be highly beneficial in death, kidnap or missing person cases.
It is well known by now that the team investigating the shootings in the French Alps discovered two mobile phones: http://news.sky.com/story/982481/alps-shootings-police-find-two-phones-in-car. The following has nothing to do with the French authorities investigation and does not seek to speculate on what might be. However the case is very useful in that it provides a useful example to apply a conceptual method to seeking out evidence originally discussed in my thread back in January 2009: http://www.trewmte.blogspot.co.uk/2009_01_01_archive.html.
The diagrams below illustrate one method of taking a crime scene event and postulating the possibilities of mobile phone evidence and mobile events that might occur prior to and after e.g. a murder. Yes, it is quite possible that activity on a victim's switched ON mobile phone may still occur after the victim's death. This is in addition to evidence that can accrue when it is switched OFF.
To assist the investigation to make it a more managable task for this case scenario discussion the investigator/examiner can separate, but without severing the links, the case into four stages:
i) possible evidence before and leading upto the crime
ii) possible evidence at the approximate time of (a)shooting, (b)death
iii) possible evidence when attending the scene of crime
iv) possible evidence that might still be collated post scene of crime
The depth and breadth of mobile evidence has substantially increased given the evolving and fast developmental pace of mobile technology and services. To try and discuss all of them would over-complicate this discussion, so the discussion will consider the diagram below and highlight possible mobile evidence and events iv).
The previous 2009 discussion (link given above) needs to be read to understand the diagram below, after which an examiner/investigator then begin to recognise where possible post crime mobile evidence might be generated/occur and create a check list of those possibilities.
Using the 'C now' constant this could represent the position of the investigation in physical space, say where the two mobiles have been recovered but still at the scene of crime. Time is important, too, and therefore the investigator (hypothetically, of course, for this discussion) records a time one-hour after mobile phones recovered at the crime location. This is important for timeline because anything occurring before that time have one set of evidential/event values (prior to approximate time of death) and evidence/events occurring after have another set of evidential values (post approximate time of death). By way of illustrating the latter, the dead victim wont be operating the handset his/herself so that fact is important, but that doesn't exclude the possibility the victim, prior to death, having pre-programmed the handset to do something (e.g. send a birthday text, set an alarm and so on).
The perpetrator/s fled the crime scene and therefore the time delay occuring between that and the discovered mobile phones could be minutes/hours/days. The race is on to catch up if the investigation is not to be caught up on the tide of diminishing returns.
The use of text messaging is prolific and therefore knowing which material to discard and which is important evidence is not an easy task. Commonly, texting is perceived on the basis that a user:
- sends and receives texts
- known or unknown called/calling party
- content based upon 'familiarity' of communicating parties
There is a whole host of investigative information that may need to be practically assessed as to possibility of text occuring on a mobile phone after a victim's death, such as:
- text generated by mobile phone as opposed to text generated on PC sent via the internet e.g: check the SMS header details:
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 44798021XXXX
and where you see 'Originating address' that does not contain the commonly understood mobile telephone number (E.164) but it contains an hex-decimal representation then it might indicate the message originated from the internet. Example
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 35fac2457c0be2008
To start with go back to basics (this is necessary due to the requirements of backward compatibility) and check out GSM standards GSM-0340; 0338, 0411, 0902 etc
- text maybe generated due to a set-calendar event e.g. check user profiling relevant to proactive SIM, STKs and handset calendar
- text may appear as an SMS but what if it is Wi-Fi direct data e.g. depending make/model of mobile phone check settings such as 'wireless and network'
What can happen when received test messages arrive later than the date the text was originated and sent? - http://trewmte.blogspot.co.uk/2007/10/conflicts-call-records-sms-delivery.html - Local and roaming issues maybe relevant?
Check also SMS 'validity period' for sent text messages, thus messages can be held in 'escrow' by a network operator. See GSM 11.11; 3GPP 31102
Additional time values for 'Validity Period' can be found in GSM03.40
There can be other aspects of post-crime related mobile evidence activity on a victim's mobile phone, such as voicemail. Moreover, cell site analysis can have a role here too for a switched ON mobile phones and post-crime generated evidence.
Determining possible evidence and events on a mobile phone or mobile account,, for that matter, which may occur post-crime might be highly beneficial in death, kidnap or missing person cases.
Tuesday, September 20, 2011
7.5 trillion mobile communications
7.5 trillion mobile communications
My recent post discussed mobile growth areas, as many have at this blog (just search past posts) and highlights the current European trend with smart-phones. A recognition of the British localised trends in the mobile marketplace can be read about here: UK_CMR_2011_FINAL.pdf
A news article about an Ovum report suggests the quantity of mobile -calls -texts -images and video messages will reach 7.5 trillion this year. Moreover, it is reported: "In a new forecast, the independent telecoms analyst also predicts that the market will generate revenues of $153 billion this year, up 8% on last year’s performance."
From analysis of a number of cross-market conditions by various market analysts these indicators provide useful coordinates about the future of mobile forensics and evidence. It is very positive, but there is a natural consequence of that success; adjustments will need to be made. Those trends cannot help but bring change and imply there will be a need for transformation from the current investigatory set up and a shake up of the stoggy and bloated surface-level superficiality stifling and damaging the approrpriate structural processes inherent in the mobile forensics and evidence tree, perhaps illustrated by the way in which honey-fungus of the genus Armillaria variety eats at the very core of a tree.
My recent post discussed mobile growth areas, as many have at this blog (just search past posts) and highlights the current European trend with smart-phones. A recognition of the British localised trends in the mobile marketplace can be read about here: UK_CMR_2011_FINAL.pdf
A news article about an Ovum report suggests the quantity of mobile -calls -texts -images and video messages will reach 7.5 trillion this year. Moreover, it is reported: "In a new forecast, the independent telecoms analyst also predicts that the market will generate revenues of $153 billion this year, up 8% on last year’s performance."
From analysis of a number of cross-market conditions by various market analysts these indicators provide useful coordinates about the future of mobile forensics and evidence. It is very positive, but there is a natural consequence of that success; adjustments will need to be made. Those trends cannot help but bring change and imply there will be a need for transformation from the current investigatory set up and a shake up of the stoggy and bloated surface-level superficiality stifling and damaging the approrpriate structural processes inherent in the mobile forensics and evidence tree, perhaps illustrated by the way in which honey-fungus of the genus Armillaria variety eats at the very core of a tree.
Monday, August 15, 2011
Research: critiques of author recognition
Research: critiques of author recognition
With the high-profile Olympics less than 12-months away, the recent looting and rioting that involved the use of voicemail, instant messenging and web-based media and the approach to using "cybercrime" as the new-labelled tool to describe digital investigation and evidential seizure of alleged culpability, these research papers cover some useful ground that might be helpful in evaluating methodology previously unsuspected as fallible to error or mistake, and may have some useful application when applied in author recognition cases which might be relevant to evidence found on mobile phones and computers.
Authors vs. Speakers: A Tale of Two Subfields
The best part of Monday's post on the Facebook authorship-authentication controversy ("High-stakes forensic linguistics", 7/25/2011) was the contribution in the comments by Ron Butters, Larry Solan, and Carole Chaski. It's interesting to compare the situation they describe — and the frustration that they express about it — with the history of technologies for answering questions about the source of bits of speech rather than bits of text.
Practical Attacks Against Authorship Recognition Techniques
The use of statistical AI techniques in authorship recognition (or stylometry) has contributed to literary and historical breakthroughs. These successes have led to the use of these techniques in criminal investigations and prosecutions. However, few have studied adversarial attacks and their devastating effect on the robustness of existing classification methods. This paper presents a framework for adversarial attacks including obfuscation attacks, where a subject attempts to hide their identity imitation attacks, where a subject attempts to frame another subject by imitating their writing style. The major contribution of this research is that it demonstrates that both attacks work very well. The obfuscation attack reduces the effectiveness of the techniques to the level of random guessing and the imitation attack succeeds with 68-91% probability depending on the stylometric technique used. These results are made more significant by the fact that the experimental subjects were unfamiliar with stylometric techniques, without specialized knowledge in linguistics, and spent little time on the attacks. This paper also provides another significant contribution to the field in using human subjects to empirically validate the claim of high accuracy for current techniques (without attacks) by reproducing results for three representative stylometric methods.
With the high-profile Olympics less than 12-months away, the recent looting and rioting that involved the use of voicemail, instant messenging and web-based media and the approach to using "cybercrime" as the new-labelled tool to describe digital investigation and evidential seizure of alleged culpability, these research papers cover some useful ground that might be helpful in evaluating methodology previously unsuspected as fallible to error or mistake, and may have some useful application when applied in author recognition cases which might be relevant to evidence found on mobile phones and computers.
Authors vs. Speakers: A Tale of Two Subfields
The best part of Monday's post on the Facebook authorship-authentication controversy ("High-stakes forensic linguistics", 7/25/2011) was the contribution in the comments by Ron Butters, Larry Solan, and Carole Chaski. It's interesting to compare the situation they describe — and the frustration that they express about it — with the history of technologies for answering questions about the source of bits of speech rather than bits of text.
Practical Attacks Against Authorship Recognition Techniques
The use of statistical AI techniques in authorship recognition (or stylometry) has contributed to literary and historical breakthroughs. These successes have led to the use of these techniques in criminal investigations and prosecutions. However, few have studied adversarial attacks and their devastating effect on the robustness of existing classification methods. This paper presents a framework for adversarial attacks including obfuscation attacks, where a subject attempts to hide their identity imitation attacks, where a subject attempts to frame another subject by imitating their writing style. The major contribution of this research is that it demonstrates that both attacks work very well. The obfuscation attack reduces the effectiveness of the techniques to the level of random guessing and the imitation attack succeeds with 68-91% probability depending on the stylometric technique used. These results are made more significant by the fact that the experimental subjects were unfamiliar with stylometric techniques, without specialized knowledge in linguistics, and spent little time on the attacks. This paper also provides another significant contribution to the field in using human subjects to empirically validate the claim of high accuracy for current techniques (without attacks) by reproducing results for three representative stylometric methods.
Saturday, July 23, 2011
Mobile Markets: Nokia 'Mobile Man'...it tells of a story
Mobile Markets: Nokia 'Mobile Man'...it tells of a story
This excellent construction, made up entirely of mobile phones, is Nokia's collaborative project with Beijing postal service to encourage recycling of mobile phones that can be handed in at post offices, according to the news article at news.cnet.com.
It's great to see projects like, which tend to draw promotions using creative and talented ideas demonstrating the evolving and transforming world of mobile phones and its market places. Back in 2007 I posted on another creative work cellphone-transformer, which, yet again, shows a design that captures the imagination displaying the versatile uses to which a mobile phone might be put.
The business and ecomonic philosophy that resides behind these creative images equally tells of a story of growth and success. If recycling is happening then, perhaps, that is as a likely consequence of mobile ubiquity taking hold. That is a nice statement, but can I back it up? I don't have my finger on every financial and market research pulse, but, apart from anecdotal references, there are various stats out there from the market research firms. Indeed, back in 2008 I blogged (staggering-figures-for-mobile-phone) on the state of the mobile data market when the economic downturn (which appears to have started in 2007 so we are led to believe) had got a firmer grip on global markets. In 2010 the stats still showed extraordinary figures (text.it), although the exact detail where all this activity occurs to generate such figures may not be obvious. It may be compelling to want to know how many consumers send text and mms messages (see OFCOM website for stats), but that is not the full picture. There are the other data markets in business to consider, such as the M2M market place (winwin) and comments by industry pundits on the mobile payments market (cellular-news).
It is useful to see how industry people collate information and bring amassed facts together in order to express their views and vision on what all the facts mean to them in aggregrate. An example of this can be seen in Tomi Ahonen's enthusiastic commentary found in Insiders Guide To Mobile (lulu) with references to trillion dollar market, over 4 billion users and the segmented factors when drawn together identified to him what is forecast for mobile. A view of one segment of the mobile phone market, apps, is simply a further illustration of information to be sourced to underpin market trends (windows-phone-apps-reach-new-market), another is sales and market penetration, such as Apple's iPhone outrageously outstanding sales growth.
If I removed from the context of the above commentary discussion about modern technology, and simply focussed on what an image might communicate, I could have been talking about social, cultural and economic life that might have been depicted by way of an 18th/19th century painting (irrespective of whether the painting is by an impressionist or not). Whilst the image above may not be an old master piece, the image still has a story to explicitly convey and that, in forensic terms, requires understanding all or part of any implicit subtext the image can also communicate.
My forensic skills, acquired over the years, meant that my reaction to seeing this image (even though photo/art imagery is not my subject), was to look at it as evidence and then set out to see what I could deduce from there. In reality we do this everyday in our work. We see a SIM card. We then want to know what it is and what is inside. In order to know what we are dealing with we need to know how it works and what can be held inside and whether all or part thereof can be revealed. Moreover, we need to know what amounts to 'conformance' and within that framework which conforming element is 'mandatory' and which is 'optional'. Once we have that background we can then begin to understand what is 'non-conforming' and/or 'unusual'. This path can equally be taken when dealing with mobile phones and RF investigations.
In conclusion, the subtext of this discussion can be revealed. However mobile phones maybe presented to the world, it is our job in forensics not to change that messsage, but to break down the presentation into its various building block elements in order that we know how each piece works and then how the pieces fit together and work and cooperate together. This is because a true forensic standard requires of the individual to obtain knowledge by way of commentary, appropriate training, standards, specs and investigation, that includes examination and testing (trial and error), which is one side of the coin. The other side of this coin is knowing what the 'thing' in its final state is intended to do, which requiries understanding of the market place it which the 'thing' is to be adopted. Using skills and techniques like these provide for a rich source of experience, too. Essentially, learning to bring all the pieces that are needed into play and being able to demonstrate that identifies the forensic examiner working with a well hone, self-principled approach of high standard.
For MTEB students, the summer recess is now here. Sure, have a great time and relax and enjoy the break, but don't waste valuable time. Great people strive in life because they want to go beyond what has already been achieved. Take time out from relaxing to bring together the exposure you have had to mobile knowledge and experience you have acquired, thus far. Select a particular line of investigative enquiry and see how far you get with it. I have identified some links above to illustrate a way forward or choose a different subject matter; remember to be able to demonstrate the primary basics of 'bush' methodology.
This excellent construction, made up entirely of mobile phones, is Nokia's collaborative project with Beijing postal service to encourage recycling of mobile phones that can be handed in at post offices, according to the news article at news.cnet.com.
It's great to see projects like, which tend to draw promotions using creative and talented ideas demonstrating the evolving and transforming world of mobile phones and its market places. Back in 2007 I posted on another creative work cellphone-transformer, which, yet again, shows a design that captures the imagination displaying the versatile uses to which a mobile phone might be put.
The business and ecomonic philosophy that resides behind these creative images equally tells of a story of growth and success. If recycling is happening then, perhaps, that is as a likely consequence of mobile ubiquity taking hold. That is a nice statement, but can I back it up? I don't have my finger on every financial and market research pulse, but, apart from anecdotal references, there are various stats out there from the market research firms. Indeed, back in 2008 I blogged (staggering-figures-for-mobile-phone) on the state of the mobile data market when the economic downturn (which appears to have started in 2007 so we are led to believe) had got a firmer grip on global markets. In 2010 the stats still showed extraordinary figures (text.it), although the exact detail where all this activity occurs to generate such figures may not be obvious. It may be compelling to want to know how many consumers send text and mms messages (see OFCOM website for stats), but that is not the full picture. There are the other data markets in business to consider, such as the M2M market place (winwin) and comments by industry pundits on the mobile payments market (cellular-news).
It is useful to see how industry people collate information and bring amassed facts together in order to express their views and vision on what all the facts mean to them in aggregrate. An example of this can be seen in Tomi Ahonen's enthusiastic commentary found in Insiders Guide To Mobile (lulu) with references to trillion dollar market, over 4 billion users and the segmented factors when drawn together identified to him what is forecast for mobile. A view of one segment of the mobile phone market, apps, is simply a further illustration of information to be sourced to underpin market trends (windows-phone-apps-reach-new-market), another is sales and market penetration, such as Apple's iPhone outrageously outstanding sales growth.
If I removed from the context of the above commentary discussion about modern technology, and simply focussed on what an image might communicate, I could have been talking about social, cultural and economic life that might have been depicted by way of an 18th/19th century painting (irrespective of whether the painting is by an impressionist or not). Whilst the image above may not be an old master piece, the image still has a story to explicitly convey and that, in forensic terms, requires understanding all or part of any implicit subtext the image can also communicate.
My forensic skills, acquired over the years, meant that my reaction to seeing this image (even though photo/art imagery is not my subject), was to look at it as evidence and then set out to see what I could deduce from there. In reality we do this everyday in our work. We see a SIM card. We then want to know what it is and what is inside. In order to know what we are dealing with we need to know how it works and what can be held inside and whether all or part thereof can be revealed. Moreover, we need to know what amounts to 'conformance' and within that framework which conforming element is 'mandatory' and which is 'optional'. Once we have that background we can then begin to understand what is 'non-conforming' and/or 'unusual'. This path can equally be taken when dealing with mobile phones and RF investigations.
In conclusion, the subtext of this discussion can be revealed. However mobile phones maybe presented to the world, it is our job in forensics not to change that messsage, but to break down the presentation into its various building block elements in order that we know how each piece works and then how the pieces fit together and work and cooperate together. This is because a true forensic standard requires of the individual to obtain knowledge by way of commentary, appropriate training, standards, specs and investigation, that includes examination and testing (trial and error), which is one side of the coin. The other side of this coin is knowing what the 'thing' in its final state is intended to do, which requiries understanding of the market place it which the 'thing' is to be adopted. Using skills and techniques like these provide for a rich source of experience, too. Essentially, learning to bring all the pieces that are needed into play and being able to demonstrate that identifies the forensic examiner working with a well hone, self-principled approach of high standard.
For MTEB students, the summer recess is now here. Sure, have a great time and relax and enjoy the break, but don't waste valuable time. Great people strive in life because they want to go beyond what has already been achieved. Take time out from relaxing to bring together the exposure you have had to mobile knowledge and experience you have acquired, thus far. Select a particular line of investigative enquiry and see how far you get with it. I have identified some links above to illustrate a way forward or choose a different subject matter; remember to be able to demonstrate the primary basics of 'bush' methodology.
Saturday, May 07, 2011
GSM Radio DNA Bracelet - RACH
GSM Radio DNA Bracelet - RACH (Random Access Channel)
The logical channels set out http://cellsiteanalysis.blogspot.com/2011/01/gsm-radio-dna-bracelet.html each provide useful information that is of use to cell site analysis (CSA). A common misunderstanding that arises with CSA is it has been used in evidence in such away that only a minutiae of information is considered. This in turn has led to some believing CSA can be defined by a limited selection of elements. The world of CSA is far, far larger in rich content than those limited elements. An examiner only comes to know about the rich content having first applied him/herself to learning the symbiotic, co-partnership between the science & technology and examination & forensic procedure leading to evidence & opinion.
For instance let us accept that RACH is a GSM uplink common control channel. In that little nugget of information given by the statement there is firstly the science and technology. The technology is Global System for Mobile (communications) a digital cellular radio system. The adopted GSM system manipulates (modulates) the physical radio signals such that physical signals whilst analogue in nature when manipulated hold a secret inside that is revealed when de-modulated revealing the important data (digital). Moreover, the statement uplink is relevant to note, as is common control channel (CCCH). There are four nominated logical control channel assigned connected with CCCH - Paging Channel (PCH), Access Grant Channel (AGCH), Notification Channel (NCH) and, of course, RACH. The term 'common' needs clarification, too, because it identifies that the channels are common to all users (mobile users) in a geographical radio area via their handsets. 'Uplink' defines the direction to which the control channel data are transmitted.
In combination, the examination of transmitted data becomes highly significant for it represent an action by the user's mobile phone creating the 'first' step in radio DNA evidence. A Layer 3 trace (example below), and when we say Layer 3 we are taking about RR (radio resources), identifies the access request RACH message sent to the network and a response from the network to it. The example below has been extrapolited (thus goes beyond) what would normally be seen from the raw data. The network and handset are programmed to understand each other and do not needs man's convoluted and verbose explanations but should the machinery, so to speak, need such explanation, god help us, for access to the GSM radio network would probably take three months just to camp on the network without using further resources.
Equally, for cell site analysis we need to know what information can be gleaned from RACH. The image below identifies a screen from an Ericsson handset with TEMS pocket (a radio diagnostic tool) in active mode. I will deal with the paging details in another discussion thread.
We first see the string '0 1 4 1 0E'. The point to note is that it only contains basic GSM info and not GPRS. Had it included GPRS info the string would consist of seven different separate elements instead of five. So how do we understand the order in which the data appears?
First element '0': refers to Cell Barred (0: No, 1: Yes)
Second element '1': refers to Call Re-establishment (0: Allowed, 1: Not allowed)
Third element '4': refers to Max number of retransmissions (1, 2, 4, 7)
Fourth element '1': refers to Number of RACH bursts sent for the last connection (1–7)
Fifth element '0E': refers to Establishment Cause/Random: Reference used in the latest RACH burst (00–FF)
The fifth element is, as referred to above, the 'first' step in radio DNA evidence. As this is generated by the user's handset it makes it interesting as it shows the examiner has understanding of seeking out evidence from the science and technology under test and that the data should be obtained using forensic methodology to secure unaltered data. Importantly, it illustrates to the examiner how to start to establish a link within the chain of data created by a mobile phone from when it is first switched ON, when using resources, until it it is switched OFF.
The actually RACH access request generated is no more than 8-bits in length. The GSM standard TS04.08 defines the message content format as seen below:
How to interpret the access request message content for establishment cause can be found in TS04.08:
And when the mobile is answering to paging for radio resources connection establishment.
There is so much detail associated with RACH it is possible to write a book solely dealing with this single subject. I do not have the time or luxury to put all that detail here, but to provide a flavour to you that the radio DNA evidence in the bracelet contains a gold mine of evidential information that is largely and randomly ignored and apparently seen by some as not being relevant. I wonder with the little I have mentioned above whether you would think the same?
In the next RACH discussion I shall open up to you more and give insight into RACH and some evidential possibilities.
The logical channels set out http://cellsiteanalysis.blogspot.com/2011/01/gsm-radio-dna-bracelet.html each provide useful information that is of use to cell site analysis (CSA). A common misunderstanding that arises with CSA is it has been used in evidence in such away that only a minutiae of information is considered. This in turn has led to some believing CSA can be defined by a limited selection of elements. The world of CSA is far, far larger in rich content than those limited elements. An examiner only comes to know about the rich content having first applied him/herself to learning the symbiotic, co-partnership between the science & technology and examination & forensic procedure leading to evidence & opinion.
For instance let us accept that RACH is a GSM uplink common control channel. In that little nugget of information given by the statement there is firstly the science and technology. The technology is Global System for Mobile (communications) a digital cellular radio system. The adopted GSM system manipulates (modulates) the physical radio signals such that physical signals whilst analogue in nature when manipulated hold a secret inside that is revealed when de-modulated revealing the important data (digital). Moreover, the statement uplink is relevant to note, as is common control channel (CCCH). There are four nominated logical control channel assigned connected with CCCH - Paging Channel (PCH), Access Grant Channel (AGCH), Notification Channel (NCH) and, of course, RACH. The term 'common' needs clarification, too, because it identifies that the channels are common to all users (mobile users) in a geographical radio area via their handsets. 'Uplink' defines the direction to which the control channel data are transmitted.
In combination, the examination of transmitted data becomes highly significant for it represent an action by the user's mobile phone creating the 'first' step in radio DNA evidence. A Layer 3 trace (example below), and when we say Layer 3 we are taking about RR (radio resources), identifies the access request RACH message sent to the network and a response from the network to it. The example below has been extrapolited (thus goes beyond) what would normally be seen from the raw data. The network and handset are programmed to understand each other and do not needs man's convoluted and verbose explanations but should the machinery, so to speak, need such explanation, god help us, for access to the GSM radio network would probably take three months just to camp on the network without using further resources.
Equally, for cell site analysis we need to know what information can be gleaned from RACH. The image below identifies a screen from an Ericsson handset with TEMS pocket (a radio diagnostic tool) in active mode. I will deal with the paging details in another discussion thread.
We first see the string '0 1 4 1 0E'. The point to note is that it only contains basic GSM info and not GPRS. Had it included GPRS info the string would consist of seven different separate elements instead of five. So how do we understand the order in which the data appears?
First element '0': refers to Cell Barred (0: No, 1: Yes)
Second element '1': refers to Call Re-establishment (0: Allowed, 1: Not allowed)
Third element '4': refers to Max number of retransmissions (1, 2, 4, 7)
Fourth element '1': refers to Number of RACH bursts sent for the last connection (1–7)
Fifth element '0E': refers to Establishment Cause/Random: Reference used in the latest RACH burst (00–FF)
The fifth element is, as referred to above, the 'first' step in radio DNA evidence. As this is generated by the user's handset it makes it interesting as it shows the examiner has understanding of seeking out evidence from the science and technology under test and that the data should be obtained using forensic methodology to secure unaltered data. Importantly, it illustrates to the examiner how to start to establish a link within the chain of data created by a mobile phone from when it is first switched ON, when using resources, until it it is switched OFF.
The actually RACH access request generated is no more than 8-bits in length. The GSM standard TS04.08 defines the message content format as seen below:
How to interpret the access request message content for establishment cause can be found in TS04.08:
And when the mobile is answering to paging for radio resources connection establishment.
There is so much detail associated with RACH it is possible to write a book solely dealing with this single subject. I do not have the time or luxury to put all that detail here, but to provide a flavour to you that the radio DNA evidence in the bracelet contains a gold mine of evidential information that is largely and randomly ignored and apparently seen by some as not being relevant. I wonder with the little I have mentioned above whether you would think the same?
In the next RACH discussion I shall open up to you more and give insight into RACH and some evidential possibilities.
Friday, October 22, 2010
Four Blogs
Four Blogs
I have four open webblogs that are active:
http://trewmte.blogspot.com
http://cellsiteanalysis.blogspot.com
http://sim2usim.blogspot.com
http://forensicmobex.blogspot.com
The focus of these webblogs involves dealing with all forms of forensics and evidence relevant to mobile communications in the open arena that may impact now or in the future relevant to:
- Advancing forensic evidence and analysis by challenging methodology and entrenchment in out of date concepts
- Balanced technical evidence for fair trials
I have been developing new materials for the blogs that will be gradually rolled out over the next six months.
Four Blogs
Four Blogs
I have four open webblogs that are active:
http://trewmte.blogspot.com
http://cellsiteanalysis.blogspot.com
http://sim2usim.blogspot.com
http://forensicmobex.blogspot.com
The focus of these webblogs involves dealing with all forms of forensics and evidence relevant to mobile communications in the open arena that may impact now or in the future relevant to:
- Advancing forensic evidence and analysis by challenging methodology and entrenchment in out of date concepts
- Balanced technical evidence for fair trials
I have been developing new materials for the blogs that will be gradually rolled out over the next six months.
Four Blogs
Four Blogs
I have four open webblogs that are active:
http://trewmte.blogspot.com
http://cellsiteanalysis.blogspot.com
http://sim2usim.blogspot.com
http://forensicmobex.blogspot.com
The focus of these webblogs involves dealing with all forms of forensics and evidence relevant to mobile communications in the open arena that may impact now or in the future relevant to:
- Advancing forensic evidence and analysis by challenging methodology and entrenchment in out of date concepts
- Balanced technical evidence for fair trials
I have been developing new materials for the blogs that will be gradually rolled out over the next six months.
Saturday, July 31, 2010
Deleted messages uncovers fake rape claim
Deleted messages uncovers fake rape claim
Having specialised in the UK for many years dealing with deleted data and having published many papers on 'deleted content', 'deleted text messages', 'deleted data mobiles' and 'deleted data may not amount to possession' when this subject raises its head it is worth making a record of it for later discussion.
There are many aspects about deleted data that require to be considered in detail before making an allegation (Prosecution/Defence, Plaintiff/Respondent etc) and simply finding deleted data and saying well it is here let's use it is not always a good idea.
The details of an Australian criminal case reported recently involving recovered deleted data showed the content of a text message imported an entirely different context about an allegation of rape.
------------------------------------------------------------
Rape charges dropped after deleted messages recovered from iPhone
A MAN'S business and reputation are tainted, a young woman's HSC and mental health are in tatters and prosecutors have been ordered to pay more than $30,000 in legal costs for a bungled rape investigation on Sydney's northern beaches.
http://www.smh.com.au/digital-life/mobiles/rape-charges-dropped-after-deleted-messages-recovered--from-iphone-20100727-10ueq.html
------------------------------------------------------------
This case shows an example where deleted data can be effective. Past cases I dealt with are illustrative of what can be found in deleted data such as a daughter who accused her father of rape when in fact she didn't want to admit to having sexual relations with a boyfriend her parents knew nothing about. Or the case of a man's body that was found where a family stated they had never visited them, only to find a deleted photo of the man in their living room.
For further information about deleted data contact:
trewmte@gmail.com
Monday, October 26, 2009
100,000 reach trewmte blogspot
100,000 reach trewmte blogspot
.
Three years after trewmte.blogspot was launched and today it has reached over 100,000 visitors. For a small, but hopefully helpful and informative blog on mobile telephone evidence and forensics, amongst a sea of websites and blogs on the world wide web, it reminds us all of what is possible from being on the web, but also the amazing library of information that is out there available by of web.
.
Thanks to everyone who stopped by to see what is going on here.
Sunday, October 11, 2009
Extra-Statutory
Extra-Statutory
.
Where, for illustrative purposes only, a Home Office circular regulates e.g. the use of listening devices and aural and visual procedures, the standards set by that document may be the same as those under a Stature (say RIPA or, previously, IOCA) but that Home Office circular does not mean by following its guidance it makes any acts or omissions compliant with the statutory provisions; conduct arising from following the circulars regulation, and not the statute, could be "wholly extra-statutory" and would probably contravene the European Convention on Human Rights - see Malone v Metropolitan Police Commissioner [1979] Ch 344; cf Malone v United Kingdom (1984) 7 EHRR 14.
.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.
.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.
.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.
.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.
.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.
Extra-Statutory
Extra-Statutory
.
Where, for illustrative purposes only, a Home Office circular regulates e.g. the use of listening devices and aural and visual procedures, the standards set by that document may be the same as those under a Stature (say RIPA or, previously, IOCA) but that Home Office circular does not mean by following its guidance it makes any acts or omissions compliant with the statutory provisions; conduct arising from following the circulars regulation, and not the statute, could be "wholly extra-statutory" and would probably contravene the European Convention on Human Rights - see Malone v Metropolitan Police Commissioner [1979] Ch 344; cf Malone v United Kingdom (1984) 7 EHRR 14.
.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.
.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.
.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.
.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.
.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.
Thursday, August 20, 2009
Mobile Telephone Case Law
Mobile Telephone Case Law
.As you know for Judges, Lawyers, Practitioners, Experts, Law Enforcement and Students the webblog was set up for educational discussion points about mobile telephone forensics and evidence. Whilst visitors to this webblog liked the format and knowledge and experience being imparted, and want this to continue, due to the many posts I have put up since 2006 led to requests for having more discussion on these topics. To that end a discussion forum was set up relating to Mobile Forensics over at Jamie Morris' Forensic Focus Forum here:
Arising from the success of that we have now begun the extension of that fourm by introducing specialist sub-forums: the first sub-forum identifies case law that involves mobile telephone evidence to aid comprehension as to what principles are being argued at law regarding this subject matter; to learn about errors with evidence; to increase knowledge and act as an aid to improving skillsets.
.
Mobile Telephone Case Law
http://www.forensicfocus.com/index.php?name=Forums&file=viewforum&f=18
.
Below are a list of cases that have been posted to start this new specialist area sub-forum:
.
Below are a list of cases that have been posted to start this new specialist area sub-forum:
.
Mobile Phone Calls - Usage: Gun Crime Case
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4393
.
Cell Site Analysis (CSA) Case
.
Cell Site Analysis (CSA) Case
Call Records, Cell Site Analysis & Omagh Bombing
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4398
.
Silence on Cell Site usage not a good idea
.
Silence on Cell Site usage not a good idea
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4399
.
Civil Case about mobile phone functionality infringement
.
Civil Case about mobile phone functionality infringement
.
Movement, Collocation and Cell Site Analysis
Cell Site Analysis not available for Trial
Why wasn't Cell Site Analysis used?
.
I shall continue to add to the list of cases above.
.
Interception case
.
Conspiracy, mobile calls and text messages
.
Article: Courts wary of cellphone forensics
.
Thumbnail downloads, Mobile Phones and Google
.
US Cell Site Analysis cases
.
US Case: CSA, ESN/MIN and Cloning Equipment
.
Deleted data may not amount to possession
.
US Case: Electronic Wireless Vehicle Monitoring
.
US Case: Email interception defined
.
RIPA, Emails and Interception
.
Sunday, August 02, 2009
Non-Law Enforcement Mobile Forensics Conference UK
Non-Law Enforcement Mobile Forensics Conference UK
.
A queries that has been raised about "When and where are the Mobile Forensic Conferences usually held in the UK? Also are they open to non Law Enforcement?" A discussion about this is running over on the other website that I am connected with, which is owned by Jamie Morris, called Forensic Focus. My reply to the query is:
.
"We can have a Mobile Forensics Conference in the UK. The problem getting it off the ground is getting people to pay the entrance price or get the numbers to actually attend. It is impossible to hire a large enough conference centre when it presents high costs.
.
"I recently found a place where the combined costs for a suite for a 2-days conference, promotion of conference, producing handout material, getting conference speakers to attend and have some good grub (not that canteen cacky food that often gets thrown up) would generate an entrance charge of £150.00 + VAT per head but to breakeven 150 paying people attending the two days conference are needed.
.
"The agenda would need to reflect what people want to know more about or just to be able to attend and go through forensic and evidential issues to see if our understanding is the same.
.
"So here is something for Forensic Focus forum members to comment: Are there 150 forum members of the 10,000+ FF members willing to attend and more importantly can you afford and willing to pay £150 + VAT per person. I will create a new thread for this discussion containing a Poll to see what forum members would like to do."
.
The Poll is here:
.
To see or added to the discussion go here:
.
¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬
UPDATE
¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬
.
MTEB Mobile Forensics Conference UK we will be looking at the conservatively estimated £1-billion market for the criminal and civil mobile forensics marketplace. What are the likely business opportunites?
.
There will be the topics:
- Practises
- Procedures
- U/SIM Card
- Handsets
- Cell Site Analysis
- Directives
- Statutes
- Regulations
- Rules
- Standards
- etc
.
The list above is undefined because there will be new ideas and initiatives as we will be casting of the old, stagnated and stale that prevails in the marketplace - they are history.
.
A new, fresh age is starting in our forensic arena and you should be a part of it.
Tuesday, July 14, 2009
Mobile Evidence CDR/Billing Course
Mobile Evidence CDR/Billing Course
.
One-day live training session on mobile evidence CDR/Billing.
.
- understanding and obtaining evidence
- standards
- relationship between network and user
- relationship to cell site analysis (CSA)
.
I am proposing this training with a number issues that impact in the background:
.
- obtain training at a cost-effective price in difficult economic times
- people need training, even in difficult economic times
- demonstrate training from experienced individuals has been undertaken
- to improve understanding of CDR/Billing, thus improve evidential standards
.
The attendee does not require to have undertaken CDR/Billing work before.
.
I have checked out and compared prices for a one-day course and found the following:
.
1) They do not provide content like the course I am proposing;
2) They do not impart the experience to deal with the specifics, my course does;
3) They do not impart the information how to go about getting the evidence, mine does;
4) I won't be using the training course to take your money and then have the cheek to tell you why you should be using my examiner/exerpt services or buy my product;
5) My courses have always been about empowering people with the skills needed to do the job.
.
The basic cost per person is £239.00
.
Factors to consider: the training cost does not pay for your:
.
- your travel
- your overnight accommodation (should you want to stay on and travel back the next day)
- your food
- any other expense
.
The minimum number of attendees MUST be 50 to run the course due to the proposed venue in Surrey UK (and very nice it is too).
.
Interested, then please send an email to me, for a registration form:
.
trewmte @ gmail.com
Friday, July 10, 2009
Mobile Phone Flash Memory Chip Evidence
Mobile Phone Flash Memory Chip Evidence
.
When recovering data using flasher box devices it may be useful to support the notion of obtaining a detail (IMSI/ICCID/etc) about a previously inserted paricular SIM Card in a particular mobile telephone that the notion about storing such data in memory is:
.
- not new
- not clandestine shady black-box technology
- not a security breach by the handset manufacturer
.
In fact the entire process of maintaining a SIM List in the phone was designed to allow a user with more than one SIM Card to gain access to previously held memory data associated with each particular SIM Card.
.
In order to support that statement it would be helpful to see practitioners using authoratitive statements about the forensic 'reliability' and 'accuracy' of recovered data being obtained using flash reading devices and the evidential 'weight' and 'value' to be given to the data.
.
To assist, here is a statement from a 1996 published Electronic User Guide for the Nokia 2110:
.
SECURITY LEVEL (Menu 5 2) Page 71
"The phone keeps a list of the SIM cards which are used with the phone. This list may contain the information on up to five different SIM cards."
.
However under the same section in the User Guide it states:
.
"Regardless of the selected security level, all temporarily stored phone numbers are erased when a new SIM card is installed. On the other hand, these phone numbers are not erased when a previously used SIM card is inserted, regardless of the selected security level."
.
As a query about forensic reliability and accuracy:
.
- During the acquisition process and the harvesting of the data acquired is there/ has there been anything lost in translation of the data themselves, at first instance? If the IMSI you have recovered from flash memory is presented along with call logs etc, how do you know that those call logs relate to that IMSI and not another IMSI?
.
As a query about evidential weight and value:
.
- What weight can be given to the recovered IMSI being directly associated with those call logs? Moreover, what value is there in using such potentially uncorroborated evidence assigned to the recovered data being presented as evidence?
Subscribe to:
Posts (Atom)