Following my article France Car Shootings and Mobile Evidence http://www.trewmte.blogspot.co.uk/2012/09/france-car-shootings-and-mobile-evidence.html an investigator, previously working with a well-known cellular and fixed network manufacturer, confirmed to me the results of an internal forensics investigation which he conducted.
An employee had made threats to a Director. The employee had been found to use a 'prepaid sim' card to send theat messages but added a delay period for the sent messages of 2-hours. The employee then switched OFF the handset and inserted the company SIM card into the same handset which had previously held the prepaid SIM that had sent the threat messages. The handset with the company SIM card in it was then switched ON; the employee claimed not to have been responsible for the threats sent from a different IMSI (SIM card). The intention of the employee was to mask any connection with the threats. However, tracing the IMSIs of the prepaid SIM card and the company SIM card found both to have been operating in the same handset (IMEI). Such trace capability can be made from enquiries of network databases such as BTS, HLR etc. Moreover with high levels of text messaging that are sent and received whilst roaming there is trace capability that can be made by interrogating CAMEL.
There is also useful data that can be obtained for linking with cell site analysis (CSA), which is a bonus although there appears to be some confusion occuring in the US at the moment as to the value of CSA evidence http://www.forensicfocus.com/Forums/viewtopic/t=9679/ and how the material may be applied on a case by case basis. I am not convinced that licenced operators with highly developed as they are in the US cellular networks simply could not/would not sufficient call record/cell data available to know what is happening when an MS has been active in their networks, about the arrangement at a particular mast (cell tower) as used by an MS, the configuration of the radio network operating at the time an MS has been used and so on.
Showing posts with label missing persons. Show all posts
Showing posts with label missing persons. Show all posts
Saturday, September 22, 2012
Monday, September 17, 2012
France Car Shootings and Mobile Evidence
France Car Shootings and Mobile Evidence
It is well known by now that the team investigating the shootings in the French Alps discovered two mobile phones: http://news.sky.com/story/982481/alps-shootings-police-find-two-phones-in-car. The following has nothing to do with the French authorities investigation and does not seek to speculate on what might be. However the case is very useful in that it provides a useful example to apply a conceptual method to seeking out evidence originally discussed in my thread back in January 2009: http://www.trewmte.blogspot.co.uk/2009_01_01_archive.html.
The diagrams below illustrate one method of taking a crime scene event and postulating the possibilities of mobile phone evidence and mobile events that might occur prior to and after e.g. a murder. Yes, it is quite possible that activity on a victim's switched ON mobile phone may still occur after the victim's death. This is in addition to evidence that can accrue when it is switched OFF.
To assist the investigation to make it a more managable task for this case scenario discussion the investigator/examiner can separate, but without severing the links, the case into four stages:
i) possible evidence before and leading upto the crime
ii) possible evidence at the approximate time of (a)shooting, (b)death
iii) possible evidence when attending the scene of crime
iv) possible evidence that might still be collated post scene of crime
The depth and breadth of mobile evidence has substantially increased given the evolving and fast developmental pace of mobile technology and services. To try and discuss all of them would over-complicate this discussion, so the discussion will consider the diagram below and highlight possible mobile evidence and events iv).
The previous 2009 discussion (link given above) needs to be read to understand the diagram below, after which an examiner/investigator then begin to recognise where possible post crime mobile evidence might be generated/occur and create a check list of those possibilities.
Using the 'C now' constant this could represent the position of the investigation in physical space, say where the two mobiles have been recovered but still at the scene of crime. Time is important, too, and therefore the investigator (hypothetically, of course, for this discussion) records a time one-hour after mobile phones recovered at the crime location. This is important for timeline because anything occurring before that time have one set of evidential/event values (prior to approximate time of death) and evidence/events occurring after have another set of evidential values (post approximate time of death). By way of illustrating the latter, the dead victim wont be operating the handset his/herself so that fact is important, but that doesn't exclude the possibility the victim, prior to death, having pre-programmed the handset to do something (e.g. send a birthday text, set an alarm and so on).
The perpetrator/s fled the crime scene and therefore the time delay occuring between that and the discovered mobile phones could be minutes/hours/days. The race is on to catch up if the investigation is not to be caught up on the tide of diminishing returns.
The use of text messaging is prolific and therefore knowing which material to discard and which is important evidence is not an easy task. Commonly, texting is perceived on the basis that a user:
- sends and receives texts
- known or unknown called/calling party
- content based upon 'familiarity' of communicating parties
There is a whole host of investigative information that may need to be practically assessed as to possibility of text occuring on a mobile phone after a victim's death, such as:
- text generated by mobile phone as opposed to text generated on PC sent via the internet e.g: check the SMS header details:
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 44798021XXXX
and where you see 'Originating address' that does not contain the commonly understood mobile telephone number (E.164) but it contains an hex-decimal representation then it might indicate the message originated from the internet. Example
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 35fac2457c0be2008
To start with go back to basics (this is necessary due to the requirements of backward compatibility) and check out GSM standards GSM-0340; 0338, 0411, 0902 etc
- text maybe generated due to a set-calendar event e.g. check user profiling relevant to proactive SIM, STKs and handset calendar
- text may appear as an SMS but what if it is Wi-Fi direct data e.g. depending make/model of mobile phone check settings such as 'wireless and network'
What can happen when received test messages arrive later than the date the text was originated and sent? - http://trewmte.blogspot.co.uk/2007/10/conflicts-call-records-sms-delivery.html - Local and roaming issues maybe relevant?
Check also SMS 'validity period' for sent text messages, thus messages can be held in 'escrow' by a network operator. See GSM 11.11; 3GPP 31102
Additional time values for 'Validity Period' can be found in GSM03.40
There can be other aspects of post-crime related mobile evidence activity on a victim's mobile phone, such as voicemail. Moreover, cell site analysis can have a role here too for a switched ON mobile phones and post-crime generated evidence.
Determining possible evidence and events on a mobile phone or mobile account,, for that matter, which may occur post-crime might be highly beneficial in death, kidnap or missing person cases.
It is well known by now that the team investigating the shootings in the French Alps discovered two mobile phones: http://news.sky.com/story/982481/alps-shootings-police-find-two-phones-in-car. The following has nothing to do with the French authorities investigation and does not seek to speculate on what might be. However the case is very useful in that it provides a useful example to apply a conceptual method to seeking out evidence originally discussed in my thread back in January 2009: http://www.trewmte.blogspot.co.uk/2009_01_01_archive.html.
The diagrams below illustrate one method of taking a crime scene event and postulating the possibilities of mobile phone evidence and mobile events that might occur prior to and after e.g. a murder. Yes, it is quite possible that activity on a victim's switched ON mobile phone may still occur after the victim's death. This is in addition to evidence that can accrue when it is switched OFF.
To assist the investigation to make it a more managable task for this case scenario discussion the investigator/examiner can separate, but without severing the links, the case into four stages:
i) possible evidence before and leading upto the crime
ii) possible evidence at the approximate time of (a)shooting, (b)death
iii) possible evidence when attending the scene of crime
iv) possible evidence that might still be collated post scene of crime
The depth and breadth of mobile evidence has substantially increased given the evolving and fast developmental pace of mobile technology and services. To try and discuss all of them would over-complicate this discussion, so the discussion will consider the diagram below and highlight possible mobile evidence and events iv).
The previous 2009 discussion (link given above) needs to be read to understand the diagram below, after which an examiner/investigator then begin to recognise where possible post crime mobile evidence might be generated/occur and create a check list of those possibilities.
Using the 'C now' constant this could represent the position of the investigation in physical space, say where the two mobiles have been recovered but still at the scene of crime. Time is important, too, and therefore the investigator (hypothetically, of course, for this discussion) records a time one-hour after mobile phones recovered at the crime location. This is important for timeline because anything occurring before that time have one set of evidential/event values (prior to approximate time of death) and evidence/events occurring after have another set of evidential values (post approximate time of death). By way of illustrating the latter, the dead victim wont be operating the handset his/herself so that fact is important, but that doesn't exclude the possibility the victim, prior to death, having pre-programmed the handset to do something (e.g. send a birthday text, set an alarm and so on).
The perpetrator/s fled the crime scene and therefore the time delay occuring between that and the discovered mobile phones could be minutes/hours/days. The race is on to catch up if the investigation is not to be caught up on the tide of diminishing returns.
The use of text messaging is prolific and therefore knowing which material to discard and which is important evidence is not an easy task. Commonly, texting is perceived on the basis that a user:
- sends and receives texts
- known or unknown called/calling party
- content based upon 'familiarity' of communicating parties
There is a whole host of investigative information that may need to be practically assessed as to possibility of text occuring on a mobile phone after a victim's death, such as:
- text generated by mobile phone as opposed to text generated on PC sent via the internet e.g: check the SMS header details:
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 44798021XXXX
and where you see 'Originating address' that does not contain the commonly understood mobile telephone number (E.164) but it contains an hex-decimal representation then it might indicate the message originated from the internet. Example
Originating Address type: 91
Type of number: International
Numbering plan identifier: E.164
Originating Address: 35fac2457c0be2008
To start with go back to basics (this is necessary due to the requirements of backward compatibility) and check out GSM standards GSM-0340; 0338, 0411, 0902 etc
- text maybe generated due to a set-calendar event e.g. check user profiling relevant to proactive SIM, STKs and handset calendar
- text may appear as an SMS but what if it is Wi-Fi direct data e.g. depending make/model of mobile phone check settings such as 'wireless and network'
What can happen when received test messages arrive later than the date the text was originated and sent? - http://trewmte.blogspot.co.uk/2007/10/conflicts-call-records-sms-delivery.html - Local and roaming issues maybe relevant?
Check also SMS 'validity period' for sent text messages, thus messages can be held in 'escrow' by a network operator. See GSM 11.11; 3GPP 31102
Additional time values for 'Validity Period' can be found in GSM03.40
There can be other aspects of post-crime related mobile evidence activity on a victim's mobile phone, such as voicemail. Moreover, cell site analysis can have a role here too for a switched ON mobile phones and post-crime generated evidence.
Determining possible evidence and events on a mobile phone or mobile account,, for that matter, which may occur post-crime might be highly beneficial in death, kidnap or missing person cases.
Sunday, February 05, 2012
Pinging mobile phones
Pinging mobile phones
http://house.mo.gov/billtracking/bills121/biltxt/intro/HB1108I.htm
SECOND REGULAR SESSION
HOUSE BILL NO. 1108
96TH GENERAL ASSEMBLY
Be it enacted by the General Assembly of the state of Missouri, as follows:
Section A. Chapter 392, RSMo, is amended by adding thereto one new section, to be known as section 392.415, to read as follows:
392.415. 1. Upon request, a telecommunications carrier shall provide call location information concerning the user of a telecommunications service, including a wireless telecommunications service, in an emergency situation to a law enforcement official or agency in order to respond to a call for emergency service by a subscriber, customer, or user of such service, or to provide caller location information (or do a ping locate) in an emergency situation that involves danger of death or serious physical injury to any person where disclosure of communications relating to the emergency is required without delay.
2. No cause of action shall lie in any court of law against any telecommunications carrier or telecommunications service, or its officers, employees, agents, or other specified persons, for providing any information, facilities, or assistance to a law enforcement official or agency in accordance with the terms of this section.
--------
Relevant Chapter 392 where section 392.415 would be placed
http://www.moga.mo.gov/statutes/chapters/chap392.htm
--------
Background to this Bill Enactment
A House Committee has heard testimony on a bill that would clear the way for cell phone companies to provide cell phone location information to law enforcement in certain missing persons cases.
The language of House Bill 1108 has been introduced three previous times in Missouri, and has been passed out of the House but never out of the Senate. It would require companies to locate, or “ping” a cell phone, when law enforcement requests that information in emergencies in which a missing person is in danger of serious physical injury or death. It also protects cell phone companies from being sued for providing that information under the guidelines of the bill.
Missey and her husband, Greg Smith, are proponents of the bill commonly named for their daughter Kelsey, who was kidnapped from Overland Park, Kansas and found murdered in southern Jackson County in 2007.
Greg, now a legislator in Kansas, says if such language had been law then Kelsey might have been saved. “June 2, 2007 was the night she went missing and she was found four days later … Once that information was released by the cell phone company it only took forty-five minutes to recover her body.” A former police officer, he adds, “If you can get that kind of response in a missing person case, that’s just absolutely light years ahead of what we’re doing right now.”
http://www.missourinet.com/2012/02/03/bill-would-require-pings-of-missing-persons-cell-phones/
http://house.mo.gov/billtracking/bills121/biltxt/intro/HB1108I.htm
SECOND REGULAR SESSION
HOUSE BILL NO. 1108
96TH GENERAL ASSEMBLY
Be it enacted by the General Assembly of the state of Missouri, as follows:
Section A. Chapter 392, RSMo, is amended by adding thereto one new section, to be known as section 392.415, to read as follows:
392.415. 1. Upon request, a telecommunications carrier shall provide call location information concerning the user of a telecommunications service, including a wireless telecommunications service, in an emergency situation to a law enforcement official or agency in order to respond to a call for emergency service by a subscriber, customer, or user of such service, or to provide caller location information (or do a ping locate) in an emergency situation that involves danger of death or serious physical injury to any person where disclosure of communications relating to the emergency is required without delay.
2. No cause of action shall lie in any court of law against any telecommunications carrier or telecommunications service, or its officers, employees, agents, or other specified persons, for providing any information, facilities, or assistance to a law enforcement official or agency in accordance with the terms of this section.
--------
Relevant Chapter 392 where section 392.415 would be placed
http://www.moga.mo.gov/statutes/chapters/chap392.htm
--------
Background to this Bill Enactment
A House Committee has heard testimony on a bill that would clear the way for cell phone companies to provide cell phone location information to law enforcement in certain missing persons cases.
The language of House Bill 1108 has been introduced three previous times in Missouri, and has been passed out of the House but never out of the Senate. It would require companies to locate, or “ping” a cell phone, when law enforcement requests that information in emergencies in which a missing person is in danger of serious physical injury or death. It also protects cell phone companies from being sued for providing that information under the guidelines of the bill.
Missey and her husband, Greg Smith, are proponents of the bill commonly named for their daughter Kelsey, who was kidnapped from Overland Park, Kansas and found murdered in southern Jackson County in 2007.
Greg, now a legislator in Kansas, says if such language had been law then Kelsey might have been saved. “June 2, 2007 was the night she went missing and she was found four days later … Once that information was released by the cell phone company it only took forty-five minutes to recover her body.” A former police officer, he adds, “If you can get that kind of response in a missing person case, that’s just absolutely light years ahead of what we’re doing right now.”
http://www.missourinet.com/2012/02/03/bill-would-require-pings-of-missing-persons-cell-phones/
Subscribe to:
Posts (Atom)