Important principles in digital forensics

Schrodinger's Cat
https://upload.wikimedia.org/wikipedia/commons/thumb/9/91/Schrodingers_cat.svg/1200px-Schrodingers_cat.svg.png

At a time when digital forensics is under the spotlight and taking salvos of criticism for poor performance and lack of knowledge about its own scientific subject matter (http://parliamentlive.tv/Event/Index/7767e1b9-0e44-4de3-8627-baf9d091f487 and https://www.theguardian.com/uk-news/2018/feb/12/police-outsource-digital-forensic-work-to-unaccredited-labs) there is no better time than to refresh on principles to signpost the way to go or leave a breadcrumb trail to find the way back to safe ground.

I posted comments back in November 2006 (http://trewmte.blogspot.co.uk/2006/11/cell-site-analysis.html) identifying principles to remember, recall and apply, when conducting Cell Site Analysis (CSA) - but they apply to examinations also -  that are still relevant to today (2G/3G/4G/5G/etc....) as they were since the inception of digital cellular radio services back in the late 1980s/1990s.

The requirements identified in standards as "mandatory", "conditional", "recommendations" and so on are not written for fun;  nor to be wilfully disregarded just because they appear complex, complicated or difficult e.g. cannot be bothered to learn them, my device/machine does the thinking for me; both render the human-being to be no more than a perfunctory-goffer (human obsolescence) for the processes generated by software and algorithms in a device or machine.

The four principles to easily remember, recall and apply:

- There are mandatory requirements with mandatory outcomes
- There are mandatory requirements with optional outcomes
- There are optional requirements with mandatory outcomes
- There are optional requirements with optional outcomes

Moreover, and a fundamental (and one might suggest absolute) requirement, is the importance to understanding 'Modal verbs terminology' adopted in the standards.

Modal verbs terminology

In the present document "shall", "shall not", "should", "should not", "may", "may not", "need", "need not", "will", "will not", "can" and "cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions)

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

Market Trends - Mobile/Smart Phones

Market Trends - Mobile/Smart Phones

There is a considerable body of factual and statistical evidence defining the continuing and diversified growth of wireless communications and the use of mobile/smart phone technology that underpins the reason for launching the course "Fundamentals & Principles, Mobile Phone Programming" (http://trewmte.blogspot.com/2010/07/fundamentals-principles-mobile-phone.html).

Here are links to a number of examples of growth and diversification in the mobile phone marketplace:

http://www.idc.com/getdoc.jsp?sessionId=&containerId=prUS22333410

http://www.gartner.com/it/page.jsp?id=1328113

http://www.juniperresearch.com/viewpressrelease.php?pr=176

http://www.juniperresearch.com/viewpressrelease.php?pr=183

http://www.4shared.com/document/GK7rDmOc/MTEB_FPMPP_Content__BookForm.html

Fundamentals & Principles, Mobile Phone Programming

Fundamentals & Principles, Mobile Phone Programming

At the MTEB Conference 2009 Greg Smith TrewMTE stated that the MTEB would launch a series of new courses in 2010 to help improve skillsets, increase knowledge and experience, help galvanise the industry, generate a body that represented our industry and demonstrate ways forward as to marketplaces. Given the current economic climate and public sector cutbacks MTEB has brought forward the launch of the courses with Cell Site Analysis Fundamentals announced recently here and at Forensic Focus and today the launch of FUNDAMENTALS & PRINCIPLES, MOBILE PHONE PROGRAMMING. This new course is to assist those who want to extend their working boundaries, introduce new work to their company or move on from evidence in criminal cases and see the world of mobile phones in a different perspective.


The skilled mobile phone examiner demonstrates his/her understanding of mobile phones not merely from data that s/he has acquired, for that can be relatively simple, but by illustrating his/her understanding of a mobile phone’s capability. For instance, how does the programming language relate to evidence? What does the keypad tell us? How do we know photos get stored in the Image Folder? File sharing, is that possible? Can mobile phone programming skillsets be used in private and commercial business? What about IP infringement or industrial espionage - are mobile phones used? Remember that forensic techniques are not solely applied in criminal matters but in many other areas too! This course can help get you started in new working environments.


http://www.4shared.com/document/GK7rDmOc/MTEB_FPMPP_Content__BookForm.html