GSM Mast Installations (Density)

GSM Mast Installations (Density)

.

When planning a cellular radio network there are many aspects to consider. The matter of radio technology and their frequencies (carriers) are but two examples. A relevance to be understood from these examples relate to what services may be obtained and delivered through these carriers? GSM for basic voice and text services and W-CDMA providing high data rates for video, gaming and conferencing etc.
.

Germane and relevant to obtaining radio services are the radio access technologies needed for that - Masts and Antennas. In radio engineering terms, antennas provide the physical technology to access the services obtained in the radio coverage by use of transmitters and receivers, commonly referred to by the acronym TRXs. The Masts provide the physical location for the siting of the TRXs. An important aspect of Mast installations is knowing the potential customer numbers that will use the services obtained from them. The calculation used for the number of customers and the number of calls that can be handled by one Mast's TRXs is calculated using the Erlang formulae - the number of calls and time length of each call in an hour.
.

Generally, though, to understand how Erlang can be used to determine the number of Masts and TRXs for an area let's just say there are 50,000 potential customers for a particular area. Let us also say to retain quality of service three sectors with 2 or 4 TRXs per sector, s222 or s444 respectively, are required. Let's also indicate that it is known that:

.

=======

.
1 TRX = 3 erlang, 2 TRXs = 5 erlang, 3 TRXs = 15 erlang, 4 TRXs = 20 erlang
.

The relevant TRXs selected for this Mast installation scenario are 2 TRXs and 4 TRXs.
.

Let:
.

50,000 x 0.02 erlang, where 0.02 erlang is used per customer = **1000 erlang
.

Each sector of an s444 may carry up to 20 erlang x 3 sectors = **60 erlang
.

**1000/**60 = 16.7
.

Therefore:
.

16.7 (17) Mast installations would be needed where a configuration of TRXs s444
.

or where
.

33.4 (35) Mast installations would be needed where a configuration of TRX s222
.

================

.

Remember the above is intended only to be illustrative so that it can be used to draw inferences about Masts installations and potential user numbers based upon the density of Masts in an area. An inference, such as, why a Mast further away than Masts sited closer to where a mobile station (MS) may be located routed the text message to the MS?

.

There are a large number of issues to be considered but let us take it two important issues to be considered are:

.

- Point-to-Area predictions for terrestrial services 30 MHz to 3000 MHz

- Point-to-Point short message service (SMS)

.

In relation to point-to-area it could be the height of buildings surrounding the MS may be a cause for a distant Mast routing a point-to-point SMS text message. Alternatively, it may be the routing of the point-to-point SMS text message from a distant Mast occurred because the MS, in the idle mode, was surrounded by Masts that were at call traffic capacity. Alternatively it could be because of a combination of both buildings and call traffic capacity.

.

Knowing matters like these are very useful when dealing cell site analysis and a reason why they are incorporated into the Core Skills Knowledge of the TrewMTE training courses:

.

GSM Cell Site Analysis Training Course

-------------------------------------------------------

.

Course One: GSM Core Skills Knowledge Course (CSA Part 1)

3-days training

.
Course Two: GSM Cell Site Analysis Course (CSA Part 2)

3-days training
.

Course Three: GSM Cell Site Analysis Course (CSA Part 3)

3-days training
.

3G Cell Site Analysis Training Course

----------------------------------------------------

Course One: 3G Core Skills Knowledge Course (CSA Part 1)

4-days training

.
Course Two: 3G Cell Site Analysis Course (CSA Part 2)

3-days training

.
Course Three: 3G Cell Site Analysis Course (CSA Part 3)

3-days training

.

SIM Card Training

-------------------------
GSM SIM Card Training Course

3-days training

.
USIM/UICC Card Training

------------------------------------

3G USIM/UICC Training Course

3-days training

.
GSM/3G Handset Examination Training

------------------------------------------------------

GSM/3G Mobile Telephone Training Course

4-days training

.
All courses now have credits towards the MTEB Mobile Telephone Evidence Diploma (MTEdip).

GSM MS List of States for the cell selection process

GSM MS List of States for the cell selection process

The GSM mobile station (MS) enters various states when switched on, but in the idle mode. Three such states are PLMN selection, cell selection and location registration that GSM standards described as a "set of states". The overall state of the mobile is thus a "composite of the states of the three processes". As TS 100 930 makes mention "In some cases, an event which causes a change of state in one process may trigger a change of state in another process, e.g., camping on a cell in a new registration area triggers an LR request." Below are those states relevant for MS cell selection but for a more detailed description of the behaviour of these states read GSM05.08.

C1 Normal Cell Selection ‑ This is the process of initial cell selection, searching all RF channels.
.
C2 Stored List Cell Selection ‑ This is the process of initial cell selection where BCCH carrier information (e.g. a BA list) for the selected PLMN is stored in the MS.
.
C3 Camped Normally ‑ This is where the MS is camped on a cell of the selected PLMN and may be able to make and receive calls. (Whether or not the MS can make and receive calls depends on the state within the location registration process). The MS monitors received level and the system information and checks whether cell reselection is needed.
.
C4 Normal Cell Reselection ‑ This is where the MS has determined that cell reselection is needed and an attempt is being made to reselect a new cell.
.
C5 Choose Cell ‑ This is where the MS has returned to idle mode from "connected mode" and is choosing a suitable cell to camp on.
.
C6 Any Cell Selection ‑ This is where the MS is unable to camp normally on any cell of the selected PLMN, or cannot obtain service because of certain responses to a location registration (LR) attempt. It is searching for a cell of any PLMN to camp on (so that emergency calls can be made).
.
C7 Camped on any Cell ‑ This is where the MS has camped on a cell irrespective of its PLMN identity, so that emergency calls can be made.
.
C8 Any Cell Reselection ‑ This is where the MS is attempting to reselect a cell, irrespective of PLMN identity.
.
C9 Choose Any Cell ‑ This is where the MS is returning to idle mode, after having entered "connected mode" from the "camped on any cell" state to make an emergency call. It is attempting to find an acceptable cell to camp on.

US Court recognises expectation text message privacy

US Court recognises expectation of text messages privacy

Violation the Fourth Amendment

Right to privacy under Art. I, Sec. 1 of the California Constitution

Interesting case, worth reading, as it relates to a Police Office for the Ontario Police Department and others (one said to be a SWAT Officer) who apparenly used work text messaging services to send personal messages unrelated to work.

U.S. 9th Circuit, June 18, 2008 -

Quon v. Arch Wireless Operating Co., No. 07-55282

Users of text-messaging services have a reasonable expectation of privacy in the contents of copies of messages the service provider stores on its network, the Ninth U.S. Circuit Court of Appeals held on June 18, 2008.

http://www.metnews.com/articles/2008/quon061908.htm

Looking back at the future of SIM in 2002

Looking back at the future of SIM in 2002

.

I have always thought looking to the future is important, but equally looking back at what we know or think might be happening, from an historical perspective, can help see what problems can occur in the future and also to note whether foreseeable problems have been addressed or not, over time.

.

I have selected a summary of issues discussed in training back in 2002, which are set out in the downloadable .pdf document "SIM - The Future as Viewed in 2002".

.

http://www.filebucket.net/files/2537_89xfv/SIM%20The%20Future%20As%20Viewed%20in%202002.pdf

.

For example, did you know or remember the slow down in SIM Card manufacturing in 2001? This is hard to believe when we think about the saturation levels of SIMs and handsets in the marketplace today.

.

What about SIM Application Toolkits, applets and the exciting development of Java Standard Edition for mobile phones (KJava and PJava)? Our concerns then were how these advancements were going to impact on mobile telephone and SIM examination. Remember at that time we saw problems and tried to anticipate how to combat problems, but we had no immediate solutions which invariable had to be produced in some instance "on-the-hoof", so to speak.

.

Cloning of SIM Cards had raised its head back in 1998 and devices were starting to appear on the market in 2000/01. The problems we faced then was knowing what to look for to deternmine whether a SIM was cloned or not? And then if the SIM was a clone what impact on evidence could/would it have?

.

What about SIM Cards with multiple IMSIs? Still an issue today as it was then in 2002. The problem being is that SIM readers do not have the capability to read more than one IMSI from a SIM Card at any one time. Consequently, invocation of an IMSI selection in EF-7F20 6F07 is not possible other than the SIM being placed in the handset and another IMSI being selected using the handset menu Network selection. Moreover, once that has been done the green button on the handset needs to be pushed and a location update (and an IMSI-attach) to the network is required, which cannot be performed in a faraday bag, radio dampening field or isolation chamber. The question arises when do you search for more than one IMSI recorded into a SIM? What cases warrant it? How many cases have been missed in the past where more than one IMSI resided in SIM but has gone undetected? Put simply, when should allocution take place?

.

There were a huge range of issues to be addressed then in early 2000, as there are now. When reading these brief discussion documents representing issues spoken about on my training courses, I hope they convey the message that plug and play (PnP) or universal plug and play (UPnP) systems used to extract and harvest data are simply not enough to satisfy the requirements for mobile telephone examination.

Looking back at the future of SIM in 2002

Looking back at the future of SIM in 2002

.

I have always thought looking to the future is important, but equally looking back at what we know or think might be happening, from an historical perspective, can help see what problems can occur in the future and also to note whether foreseeable problems have been addressed or not, over time.

.

I have selected a summary of issues discussed in training back in 2002, which are set out in the downloadable .pdf document "SIM - The Future as Viewed in 2002".

.

http://www.filebucket.net/files/2537_89xfv/SIM%20The%20Future%20As%20Viewed%20in%202002.pdf

.

For example, did you know or remember the slow down in SIM Card manufacturing in 2001? This is hard to believe when we think about the saturation levels of SIMs and handsets in the marketplace today.

.

What about SIM Application Toolkits, applets and the exciting development of Java Standard Edition for mobile phones (KJava and PJava)? Our concerns then were how these advancements were going to impact on mobile telephone and SIM examination. Remember at that time we saw problems and tried to anticipate how to combat problems, but we had no immediate solutions which invariable had to be produced in some instance "on-the-hoof", so to speak.

.

Cloning of SIM Cards had raised its head back in 1998 and devices were starting to appear on the market in 2000/01. The problems we faced then was knowing what to look for to deternmine whether a SIM was cloned or not? And then if the SIM was a clone what impact on evidence could/would it have?

.

What about SIM Cards with multiple IMSIs? Still an issue today as it was then in 2002. The problem being is that SIM readers do not have the capability to read more than one IMSI from a SIM Card at any one time. Consequently, invocation of an IMSI selection in EF-7F20 6F07 is not possible other than the SIM being placed in the handset and another IMSI being selected using the handset menu Network selection. Moreover, once that has been done the green button on the handset needs to be pushed and a location update (and an IMSI-attach) to the network is required, which cannot be performed in a faraday bag, radio dampening field or isolation chamber. The question arises when do you search for more than one IMSI recorded into a SIM? What cases warrant it? How many cases have been missed in the past where more than one IMSI resided in SIM but has gone undetected? Put simply, when should allocution take place?

.

There were a huge range of issues to be addressed then in early 2000, as there are now. When reading these brief discussion documents representing issues spoken about on my training courses, I hope they convey the message that plug and play (PnP) or universal plug and play (UPnP) systems used to extract and harvest data are simply not enough to satisfy the requirements for mobile telephone examination.

Starter Kit Mobile Phone CPD Training Barristers & Solicitors

Starter Kit Mobile Phone CPD Training Barristers & Solicitors

CPD training delivered in 2005 to Bar Council and Law Society Members at the Chambers of Mr Ferguson QC.

http://www.rfqc.co.uk/images/lecture_notes/CPD_training_Pt1.pdf

http://www.rfqc.co.uk/images/lecture_notes/CPD_Training_Pt2.pdf

Barristers - Surrey Chambers

Barristers - Surrey Chambers

One of the most overlooked parts of the law when dealing with crimnal and civil cases is that an expert, professional and client comes into contact with Barristers and Barristers' Chambers. That is quite shocking really as we meet with Barristers virtually on a daily basis for mobile telephone, computer, software and technology evidence in criminal cases and other commerical and civil matters.

Most professional people or companies one way or another require legal advice about professional matters for business and there are others who need assistance when initiating or facing civil or criminal proceedings. I have found a very good Set run by Mr James Tucker, Surrey Chambers of 1A Middle Temple Lane and Global House, Epsom http://www.surreychambers.org/. Not only does Surrey Chambers handle full range of commercial and civil matters but also prosecution, police and defence work. Really excellent Set.

USIM-D Images

Global Mobile Telephone Forensics and Evidence

Global Mobile Telephone Forensics and Evidence

It is interesting to note, and a subject matter I have been keenly watching since this webblog started, the importance of mobile telephone forensics and evidence is receiving around the globe. It is very easy to get submersed into one's own country's (UK) activities in this area and forget how other countries have significantly increased their activities in forensics and evidence too. Below is a sample of the global visitors to trewmte.blogspot in the last 20 days. Some countries will have more visitors than others, but in itself that does not dent the relevance of the global following interested in mobile telephone forensics and evidence.
.

Albania

Algeria
Aruba

Austria
Australia
Belarus
Belgium
Brazil

Bulgaria
Canada

Colombia
Cote D'ivoire
Denmark
Egypt

Estonia
Finland

France
Germany
Greece

Hungary
India

Indonesia
Iran, Islamic Republic Of
Ireland
Israel
Italy

Jamaica
Japan

Kenya
Korea, Republic Of
Kuwait
Macao
Malaysia

Mauritania
Mauritius
Morocco

Netherlands
New Zealand
Nigeria

Norway

Pakistan

Philippines
Poland
Portugal

Qatar
Romania

Russian Federation
Serbia And Montenegro

Sri Lanka

Saudi Arabia
Senegal
Serbia
Seychelles
Slovakia
South Africa
Sudan
Sweden

Thailand

Taiwan
Turkey

United Arab Emirates
United Kingdom
United States

Viet Nam

.

It would be good to get more feedback from law enforcement, universities, forensic examiners and experts from around the global who, rather than lurk in the background, may like to suggest the type of information you would like to see at this webblog. I have been dealing with a variety of mobile telephone examination and evidence issues (SIM/USIM, handset and cell site) for many years and hopefully topics you raise for discussion can be answered here. I should point out, as I have in the past at this webblog (http://trewmte.blogspot.com/2006/11/cell-site-analysis.html), the more I know, the more I need to know, therefore I don't know everything, but I am willing to try and find out.
.
Additionally, as there are no academic qualifications designed precisely for mobile telephone forensics and evidence - no PhD, MSc, BSc, CEng or anything else, this means qualifications in other subjects other than this subject matter tend to get used as a passport, suggesting qualification to deal with mobile telephone forensics and evidence. To overcome that difficulty I have prepared a Diploma in Mobile Telephone Evidence that may help those who seek recognition for the skillsets they have acquired. The Diploma is not a PhD, MSc etc but it is the good old fashioned Diploma where your knowledge and skillsest need to be demonstrated and will be tested.
.

If you would like to know more about the Diploma please send an email to me, Greg Smith. My email is shown at the top righthand side of this webblog page.

Mobile Calls on Aeroplanes

Mobile Calls on Aeroplanes

.

Back in November 2006 I wrote here at trewmte.blogspot a brief piece regarding "Switch On, Update, Lose Evidence":

.

http://trewmte.blogspot.com/2006/11/switch-on-update-lose-evidence.html

.

The discussion thread related to the same but more indepth discussion in "Switch On, Update, Lose Evidence" that could be found in MTE (Mobile Telephone Evidence) Newsletter - copy of the May 2006 Newsletter can be downloaded here:

.

http://www.filebucket.net/files/1579_ov3rx/Switch%20On%20Update%20Lose%20Evidence%20.pdf

.

The purpose of the indepth discussion related to how evidence can be corrupted and contaminated where poor Seizure, Handling and Examination Procedures had been adopted. The discussion illustrated where a user with a mobile telephone steps off an aeroplane and the attempt to discover where the mobile phone had been used.

.

I had been aware for some years before I wrote the MTE Newsletter article that Airline companies were looking at and developing ways passengers could use their mobile phones on planes. At the time of writing the article it wasn't too difficult to imagine that "Switch On, Update, Lose Evidence" implicitly gave a heads up as early as May 2006 to pay attention to formulating various procedures for mobile telephone evidence at airports. Importantly, the indepth discussion wasn't then and isn't now intended to suggest victimising everyone who gets off a plane holding a mobile phone as being involved with something suspicious.

.

It would appear that the MTE Newsletter advanced warning though was well placed, for it now appears March 20th 2008 that according to BBC online middle east news that "Dubai-based airline Emirates has become the first commercial airline to allow passengers to make mobile phone calls during flights. Emirates said the first permitted mobile phone call was made on a flight between Dubai and Casablanca.":

.

http://news.bbc.co.uk/1/hi/world/middle_east/7308041.stm

.

The technology behind Emirates being able to offer mobile calls on their flights originates from http://www.aeromobile.net using pico-cell radio access technology inflight:

.

"AeroMobile allows the use of GSM phones and can also support GPRS mobile data (for BlackBerry’s etc), Wi-Fi, CDMA and 3G/UMTS. AeroMobile comprises an aircraft cabin ‘pico cell’ system that interfaces with the aircraft’s air-to-ground communications systems, typically a satellite-based system. Once transmitted to the ground, signals are sent to AeroMobile’s ground system and on to the destination mobile phone and telecoms networks around the world."

.

Evidentially, this could be very interesting but the use of mobile phones on planes may seem problematical at first. But we will cope, we always do. The evidence from the device shouldn't be too much of a problem although issues of dead-man's trap should always be considered. Equally of interest will be usage, call records and cell site analysis. The latter, cell site analysis, should prove thought provoking, for is there sovereignty on an aeroplane? If there is not (and sovereighty is only applicable to airspace) and a call starts and terminates within the same airspace the sovereignty of which belongs to country XYZ then there may well be some jurisdictional issues to deal with. However, given the confines of the plane's cabin it may well be difficult for a user, if you follow my drift, to suggest that when the call was made s/he wasn't in the plane, but somewhere in the neighbourhood.

World's first cellphone 'telepathic' chat

World's first cellphone 'telepathic' chat

Looking something like out of a future robot cops technology tool kit and been described as a "Nerve-tapping neckband used in 'telepathic' chat", the World's first cellphone telepathic call has taken place (12th March 2008). This new technology basically takes the neurological signals from the brain translates them into a transmission signal which is then sent and decoded through a processor into either, speech, communicate to a computer or communicate to move a wheel chair are just some of the possibilities, and all from a band around the neck and the receiver at the other end.

When this technology fully matures, it only understand "150-words and phrases" at present, and can be made portable, there could be some amazing possibilities for applications in the various cellular technologies and two-way radio fields. Obviously, there appear uses for surveillance, which immediately springs to mind, but other areas as well in high-noise environments such as war zones, industrial sites and airplanes etc.

.

Have a look at the video on the New Scientist's website:

http://technology.newscientist.com/article/dn13449

.

Ambient's website URL below (and where the photo above comes from) is well worth visiting.

http://www.theaudeo.com/

Updating Mobile Telephone Seizure Procedure

Updating Mobile Telephone Seizure Procedure

Every year we work on a Mobile Telephone Seizure Procedure now in its 7-th year. It originated back in 2002 with personnel from law enforcement TSUs adding their wish list as to how mobile telephones should be seized and now the Procedure has input from front line officers as well. The document itself initially started out as a check sheet but this year it is going to have a makeover and more sections with a bit of editorial added.

There will be four sections to the overall document:

- Seizure Procedure

- Examination Procedure

- Investigation Techniques

- Analysing Data

The first section that we are working on is updating and improving the Procedure chart and I wondered whether you may like to have an input on the Seizure Procedure side. Perhaps you may think we have missed something that is worthy of mentioning. Everyone who contributes is mentioned in the credits and receives a full copy of the document when its complete, free. We already have requests for the Procedure from other countries, including the US.

Why would you want to help? If you are a front line officer, when you seize a mobile telephone you are infact the first person that is looked at when evidence gets corrupted or contaminated. Think of the chain of custody.. Imagine that you seize a mobile telephone still switched ON and data that is changed points to you because beyond that point the evidence is in the exhibit bag...until it reaches the Technical Support Unit (TSU), so the theory goes. In practice it can be very different. So if awareness how to avoid corrupting or contaminating evidence is proivded free... then surely that is a good thing. This principle is how the Mobile Telephone Seizure Procedure started back in 2002.

If you are interested and a serving front line police officer send an email to trewmte@googlemail.com and the relevant seizure Procedure chart shall be emailed to you for your comments.

Writing To Mobile Phones Under Examination

Writing To Mobile Phones Under Examination

There is always the debate as to what amounts to "forensic" processes and whether that can be left to human intervention to do that, whether a device alone can do that or whether it is the combination of human intervention and the device working together that can fulfil the objective? Perhaps germane and relevant to the above question is (1) knowing the potential of each to write to a mobile telephone should be understood first? (2) Whether, as a consequence of using the process, what data are or might be altered/lost? (3) To then decide whether "forensic" is an appropriate and applicable statement to label the process in the first place?

The discussion below starts to address Point 1. When examining mobile telephones there are at least five separate categories under which an examiner can or may write to a mobile telephone due to automated processes (indirect intervention) and/or direct human intervention. The categories and their contents below are not exhaustive, but have been used to illustrate some elements involved with Point 1.

A) Standard powering ON (direct human intervention) a mobile telephone can invoke automated processes (indirect intervention):

- wearleveling - can overwrite physical data

- updating files - writes new content to file

- setting off calendars alarms

B) Connecting data aquisition devices (direct human intervention) to mobile telephones to obtain stored data (indirect intervention):

- AT Command sets; to instruct mobile to identify its profile, fetch data (IMEI and SMS text messages etc). The example below illustrates a typcial communication of seeking the profle of a mobile telephone and the response received:-

SENDING frametype 0x00/length 0x08/8


41A54T2B+43C47G4DM49I0D AT+CGMI.


1 "AT+CGMI"


2 "Sony Ericsson"


3 "OK"


RECEIVED frametype 0x00/length 0x1F/31


41A54T2B+43C47G4DM49I0D 0D 0A 53S6Fo6En79y2045


AT+CGMI...Sony E


72r69i63c73s73s6Fo6En0D 0A 0D 0A 4FO4BK0D 0A


ricsson....OK..


Manufacturer info received


Sony Ericsson [Manufacturer: Sony Ericsson]





SENDING frametype 0x00/length 0x09/9


41A54T2B+43C53S43C53S3F?0D


AT+CSCS?.


1 "AT+CSCS?"


2 "+CSCS:


"GSM""


3 "OK"





SENDING frametype 0x00/length 0x0A/


10 41A54T2B+43C53S43C53S3D=3F?0D


AT+CSCS=?.


1 "AT+CSCS=?"


2 "+CSCS: ("GSM","IRA","8859-1","UTF-8","UCS2")"


3 "OK"





RECEIVED frametype 0x00/length 0x40/64


41A54T2B+43C53S43C53S3D=3F?0D 0D 0A


2B+43C53S43


AT+CSCS=?...+CSC


53S3A:20 28


(22"47G53S4DM22"2C,22"49I52R41A22"2C S:


("GSM","IRA",


22"3883883553992D-31122"2C,22"55U54T46F2D-38822


"8859-1","UTF-8"


2C,22"55U43C53S32222"29)0D 0A 0D 0A 4FO4BK0D 0A ,


"UCS2")....OK..

- Simply connecting a plug and cable to a mobile phone will write a nibble of data to the phone's memory in order to register the communications path along which data shall pass

C) By use of a communications protocol (direct human intervention) in order to extract and harvest data from a mobile telephone can write and overwrite data (indirect intervention):

- Bluetooth: to pair devices requires an identical code to be loaded by examiner on to the mobile telephone and can overwrite previously stored code

- Some Symbian mobile telephones require an agent to be loaded on to the phone in order for the examiners devices to communicate with the phone and then has to be deleted after examination

- Hex-dumping can require the use of flash boxes to flash clips (code) to flash memory that can overwrite blocks of data containing user data

D) To gain access to a mobile telephone may require the entry (direct human intervention)of security codes -

- Passwords/PINS

- Re-setting Passwords/PINs

E) Examiners using devices to select (direct human intervention) specific data can cause the operating system of a mobile telephone to handle data in a particular way (indirect intervention):

-some smart phones write to files in order to keep track of data and in some instances shift data around to accommodate the "fetch" request for certain data

Essentially the categories and content illustrated above merely sets the stage to highlight what an examiner faces when seeking to conduct data aquisition from a mobile telephone. Plug and play (PnP) devices cannot be used in isolation, that they need supervision (direct human intervention). Direct human intervention, with ot without a device, can have consequences too. Furthermore the mobile telephone under examination can as a consequence react to direct human intervention, as well as indirect intervention.

GSM Timers

GSM Timers

In the thread cell site anslysis call analysis <http://trewmte.blogspot.com/2006/12/cell-site-analysis-call-analysis.html> it highlighted the range of Cause Failures for mobile calls. The overview it provided can be quite helpful, but behind those Cause Failures there can be a range of Timers and some of them can be the reason a Cause Failure occurs (positive or negative outcome). For example we can see that timer T3216 (below) in essence relates to the failure of a Immediate Assignment Request, but the "root cause" of the failure can infact be due to SDCCH congestion or poor radio link, such as: interference, coverage restriction or radio path imbalance. Understanding the "Causes for the cessation or loss of mobile communication" requires more than knowing the Cause Code or Timer but all the "root cause" behind them.



The Timer table below provides a useful but not exhaustive list. It essential to keep monitoring the GSM and 3GPP standards. Finally, it is important to recognise that Timers have different durations dependent upon when the timer is applicable. For instance, for radio resources management the durations are often denoted in seconds and some timers are in milliseconds.



However, other timer durations (expiration) are used for internal operation for devices such as mobile telephone or SIM and can be in minutes and in some instances hours. An example of the latter can be the elementary file EFHPLMN (7F206F31) - see GSM11.11. The Timer is set in decimal-digit increments e.g. 01, 02, 03 and so on. Each increment represents a value of n-minutes which the standard GSM0211 refers to as 6 minutes, but commonly rapid updates can cause drain on the mobile telephone's battery it is understood that n-minutes can be 30-minutes. The maximum the timer can be set for is 8-hours. The timer value is network operator dependent, which means either timer method may be used.

Timers and counters for radio resource management

Timers on the mobile station side

T3122: This timer is used during random access, after the receipt of an IMMEDIATE ASSIGN REJECT message.Its value is given by the network in the IMMEDIATE ASSIGN REJECT message.



T3124: This timer is used in the seizure procedure during a hand-over, when the two cells are not synchronized.Its purpose is to detect the lack of answer from the network to the special signal. Its value is set to 675 ms if the channel type of the channel allocated in the HANDOVER COMMAND is an SDCCH (+ SACCH); otherwise its value is set to 320 ms.



T3126:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during an immediate assignment procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the immediate assignment procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T. The maximum value of this timer is 5 seconds.



T3128:This timer is started when the mobile station starts the uplink investigation procedure and the uplink is busy.It is stopped at receipt of the first UPLINK FREE message. At its expiry, the uplink investigation procedure is aborted. The value of this timer is set to 1 second.



T3130:This timer is started after sending the first UPLINK ACCESS message during a VGCS uplink access procedure.It is stopped at receipt of a VGCS ACCESS GRANT message.At its expiry, the uplink access procedure is aborted.The value of this timer is set to 5 seconds.



T3110:This timer is used to delay the channel deactivation after the receipt of a (full) CHANNEL RELEASE. Its purpose is to let some time for disconnection of the main signalling link. Its value is set to such that the DISC frame is sent twice in case of no answer from the network. (It should be chosen to obtain a good probability of normal termination (i.e. no time out of T3109) of the channel release procedure.)



T3134:This timer is used in the seizure procedure during an RR network commanded cell change order procedure. Its purpose is to detect the lack of answer from the network or the lack of availability of the target cell. Its value is set to 5 seconds.



T3142:The timer is used during packet access on CCCH, after the receipt of an IMMEDIATE ASSIGNMENT REJECT message. Its value is given by the network in the IMMEDIATE ASSIGNMENT REJECT message.



T3146:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during a packet access procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message during a packet access procedure, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the packet access procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T are defined in section 3.3.1.2. The maximum value of this timer is 5 seconds.



T3164:This timer is used during packet access using CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message. It is stopped at the transmission of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expire, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.



T3190:The timer is used during packet downlink assignment on CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message or of an PDCH ASSIGNMENT COMMAND message when in dedicated mode.It is stopped at the receipt of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expiry, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.



Timers on the network side

T3101:This timer is started when a channel is allocated with an IMMEDIATE ASSIGNMENT message. It is stopped when the MS has correctly seized the channels. Its value is network dependent. NOTE: It could be higher than the maximum time for a L2 establishment attempt.



T3103:This timer is started by the sending of a HANDOVER message and is normally stopped when the MS has correctly seized the new channel. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the HANDOVER COMMAND, plus the value of T3124, plus the maximum duration of an attempt to establish a data link in multiframe mode.)



T3105:This timer is used for the repetition of the PHYSICAL INFORMATION message during the hand-over procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.



T3107:This timer is started by the sending of an ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly seized the new channels. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the ASSIGNMENT COMMAND message plus twice the maximum duration of an attempt to establish a data link multiframe mode.



T3109:This timer is started when a lower layer failure is detected by the network, when it is not engaged in a RF procedure. It is also used in the channel release procedure. Its purpose is to release the channels in case of loss of communication. Its value is network dependent. NOTE: Its value should be large enough to ensure that the MS detects a radio link failure.



T3111:This timer is used to delay the channel deactivation after disconnection of the main signalling link. Its purpose is to let some time for possible repetition of the disconnection. Its value is equal to the value of T3110.



T3113:This timer is started when the network has sent a PAGING REQUEST message and is stopped when the network has received the PAGING RESPONSE message. Its value is network dependent. NOTE: The value could allow for repetitions of the Channel Request message and the requirements associated with T3101.



T3115:This timer is used for the repetition of the VGCS UPLINK GRANT message during the uplink access procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.



T3117:This timer is started by the sending of a PDCH ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly accessed the target TBF. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the PDCH ASSIGNMENT COMMAND message plus T3132 plus the maximum duration of an attempt to establish a data link in multiframe mode.



T3119:This timer is started by the sending of a RR-CELL CHANGE ORDER message and is normally stopped when the MS has correctly accessed the new cell. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent.NOTE: It could be higher than the maximum transmission time of the RR_CELL CHANGE ORDER, plus T3134, plus the maximum duration of an attempt to establish a data link in multiframe mode.



T3141:This timer is started when a temporary block flow is allocated with an IMMEDIATE ASSIGNMENT message during a packet access procedure. It is stopped when the mobile station has correctly seized the temporary block flow. Its value is network dependent.



More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

GSM Timers

GSM Timers

In the thread cell site anslysis call analysis <http://trewmte.blogspot.com/2006/12/cell-site-analysis-call-analysis.html; it highlighted the range of Cause Failures for mobile calls. The overview it provided can be quite helpful, but behind those Cause Failures there can be a range of Timers and some of them can be the reason a Cause Failure occurs (positive or negative outcome). For example we can see that timer T3216 (below) in essence relates to the failure of a Immediate Assignment Request, but the "root cause" of the failure can infact be due to SDCCH congestion or poor radio link, such as: interference, coverage restriction or radio path imbalance. Understanding the "Causes for the cessation or loss of mobile communication" requires more than knowing the Cause Code or Timer but all the "root cause" behind them.

The Timer table below provides a useful but not exhaustive list. It essential to keep monitoring the GSM and 3GPP standards. Finally, it is important to recognise that Timers have different durations dependent upon when the timer is applicable. For instance, for radio resources management the durations are often denoted in seconds and some timers are in milliseconds.

However, other timer durations (expiration) are used for internal operation for devices such as mobile telephone or SIM and can be in minutes and in some instances hours. An example of the latter can be the elementary file EFHPLMN (7F206F31) - see GSM11.11. The Timer is set in decimal-digit increments e.g. 01, 02, 03 and so on. Each increment represents a value of n-minutes which the standard GSM0211 refers to as 6 minutes, but commonly rapid updates can cause drain on the mobile telephone's battery it is understood that n-minutes can be 30-minutes. The maximum the timer can be set for is 8-hours. The timer value is network operator dependent, which means either timer method may be used.

Timers and counters for radio resource management

Timers on the mobile station side
T3122: This timer is used during random access, after the receipt of an IMMEDIATE ASSIGN REJECT message.Its value is given by the network in the IMMEDIATE ASSIGN REJECT message.

T3124: This timer is used in the seizure procedure during a hand-over, when the two cells are not synchronized.Its purpose is to detect the lack of answer from the network to the special signal. Its value is set to 675 ms if the channel type of the channel allocated in the HANDOVER COMMAND is an SDCCH (+ SACCH); otherwise its value is set to 320 ms.

T3126:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during an immediate assignment procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the immediate assignment procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T. The maximum value of this timer is 5 seconds.

T3128:This timer is started when the mobile station starts the uplink investigation procedure and the uplink is busy.It is stopped at receipt of the first UPLINK FREE message. At its expiry, the uplink investigation procedure is aborted. The value of this timer is set to 1 second.

T3130:This timer is started after sending the first UPLINK ACCESS message during a VGCS uplink access procedure.It is stopped at receipt of a VGCS ACCESS GRANT message.At its expiry, the uplink access procedure is aborted.The value of this timer is set to 5 seconds.

T3110:This timer is used to delay the channel deactivation after the receipt of a (full) CHANNEL RELEASE. Its purpose is to let some time for disconnection of the main signalling link. Its value is set to such that the DISC frame is sent twice in case of no answer from the network. (It should be chosen to obtain a good probability of normal termination (i.e. no time out of T3109) of the channel release procedure.)

T3134:This timer is used in the seizure procedure during an RR network commanded cell change order procedure. Its purpose is to detect the lack of answer from the network or the lack of availability of the target cell. Its value is set to 5 seconds.

T3142:The timer is used during packet access on CCCH, after the receipt of an IMMEDIATE ASSIGNMENT REJECT message. Its value is given by the network in the IMMEDIATE ASSIGNMENT REJECT message.

T3146:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during a packet access procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message during a packet access procedure, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the packet access procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T are defined in section 3.3.1.2. The maximum value of this timer is 5 seconds.

T3164:This timer is used during packet access using CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message. It is stopped at the transmission of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expire, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.

T3190:The timer is used during packet downlink assignment on CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message or of an PDCH ASSIGNMENT COMMAND message when in dedicated mode.It is stopped at the receipt of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expiry, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.

Timers on the network side
T3101:This timer is started when a channel is allocated with an IMMEDIATE ASSIGNMENT message. It is stopped when the MS has correctly seized the channels. Its value is network dependent. NOTE: It could be higher than the maximum time for a L2 establishment attempt.

T3103:This timer is started by the sending of a HANDOVER message and is normally stopped when the MS has correctly seized the new channel. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the HANDOVER COMMAND, plus the value of T3124, plus the maximum duration of an attempt to establish a data link in multiframe mode.)

T3105:This timer is used for the repetition of the PHYSICAL INFORMATION message during the hand-over procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.

T3107:This timer is started by the sending of an ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly seized the new channels. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the ASSIGNMENT COMMAND message plus twice the maximum duration of an attempt to establish a data link multiframe mode.

T3109:This timer is started when a lower layer failure is detected by the network, when it is not engaged in a RF procedure. It is also used in the channel release procedure. Its purpose is to release the channels in case of loss of communication. Its value is network dependent. NOTE: Its value should be large enough to ensure that the MS detects a radio link failure.

T3111:This timer is used to delay the channel deactivation after disconnection of the main signalling link. Its purpose is to let some time for possible repetition of the disconnection. Its value is equal to the value of T3110.

T3113:This timer is started when the network has sent a PAGING REQUEST message and is stopped when the network has received the PAGING RESPONSE message. Its value is network dependent. NOTE: The value could allow for repetitions of the Channel Request message and the requirements associated with T3101.

T3115:This timer is used for the repetition of the VGCS UPLINK GRANT message during the uplink access procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.

T3117:This timer is started by the sending of a PDCH ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly accessed the target TBF. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the PDCH ASSIGNMENT COMMAND message plus T3132 plus the maximum duration of an attempt to establish a data link in multiframe mode.

T3119:This timer is started by the sending of a RR-CELL CHANGE ORDER message and is normally stopped when the MS has correctly accessed the new cell. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent.NOTE: It could be higher than the maximum transmission time of the RR_CELL CHANGE ORDER, plus T3134, plus the maximum duration of an attempt to establish a data link in multiframe mode.

T3141:This timer is started when a temporary block flow is allocated with an IMMEDIATE ASSIGNMENT message during a packet access procedure. It is stopped when the mobile station has correctly seized the temporary block flow. Its value is network dependent.

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

3G USIM Phonebook

3G USIM Phonebook

Those familiar with the 3G USIM Phonebook (contacts) will know the relevance of examining this data area within USIM, thus the significance of Quantaq's announcement below. If, of course, you do not understand the relevance then coming on my USIM and USIM-D training course will open up the Phonebook (contacts) evidence and other important technical and evidential aspects of USIM, and yes you get trained in USIM-Detective, too. Send your request for training to trewmte [at] googlemail [dot] com or visit the training page at Quantaq's website.

Quantaq (www.quantaq.com) has introduced a major new release of USIM Detective (V2.0.0) - this version has support for the 3G USIM phonebook that is now appearing in many high end handsets.

3G USIM Phonebook

3G USIM Phonebook

Those familiar with the 3G USIM Phonebook (contacts) will know the relevance of examining this data area within USIM, thus the significance of Quantaq's announcement below. If, of course, you do not understand the relevance then coming on my USIM and USIM-D training course will open up the Phonebook (contacts) evidence and other important technical and evidential aspects of USIM, and yes you get trained in USIM-Detective, too. Send your request for training to trewmte [at] googlemail [dot] com or visit the training page at Quantaq's website.

Quantaq (www.quantaq.com) has introduced a major new release of USIM Detective (V2.0.0) - this version has support for the 3G USIM phonebook that is now appearing in many high end handsets.

Mobile Telephone Evidence Diploma

Mobile Telephone Evidence Diploma

As this is my 20th year in mobile telephone evidence and forensics (1987-2007) I have created a Diploma Course for Mobile Telephone Evidence (MTEdip). The Diploma is a development from the numerous SIM Card, Mobile Telephone and Cell Site Analsysis courses prepared and delivered to law enforcement and industry security specialists in the UK and internationally.

I am looking for Industry Sponsors for the Diploma. If you are a company and/or in education and you are significantly involved in digital forensic evidence and would be interested in becoming a sponsor of the Diploma, please email your interest to:

Greg Smith
Email: trewmte@gmail.com
Web: http://trewmte.blogspot.com

Cell Site Analysis

Cell Site Analysis

IN HER MAJESTY'S COURT OF APPEAL IN NORTHERN IRELAND

Neutral Citation no. [2008] NICA 5

THE QUEEN v RICHARD DAVID McCARTAN and BARRY DAVID SKINNER.

Appeal Court: Kerr LCJ, Campbell LJ and Morgan J

http://www.courtsni.gov.uk/NR/rdonlyres/4F39A7FC-5350-4E4B-BB76-FA8DC4BA08D6/0/j_j_KER7057Final.htm


It is not proven with cell site analysis that evidence obtained relating to mobile call records, the Masts and their details associated with handling the calls and conducting radio test surveys combined together form a precise indication of the geographical location of a mobile telephone at the material time. Therefore, it is unlikely an alleged opinion that it is consistent to place a mobile telephone at a particular location holds weight. That cell site analysis might generally indicate the possible movement of a mobile telephone in relation to Masts that it used and no more.

Whilst the Appeal Case for the appellants (McCartan and Skinner) did not succeed it was not because cell site analysis was able to pinpoint the location of the appellants' mobile telephones, which it is unable to do, but the appellants' failure to identity what was happening with their mobile telephones at the material times. The following commentary from this Appeal Case is worth reading.

'The cell site analysis

[37] An expert in this field, David Sanderson, gave evidence, submitted a report on the subject and made a Power Point presentation to the court. Mr Fee suggested that Mr Sanderson’s evidence established that (a) call mapping was carried out in respect of telephone 008 (attributed to Mr McCartan) and telephone 301 (attributed to Mr Skinner); (b) call mapping provides an approximate indication of where a mobile phone was when a call was made; (c) call mapping is used primarily to show the likely movement of a cellular phone with a general indication of location; (d) the cellular phone may be anywhere within the best serving coverage of the sector; (e) there is boundary overlap between sectors served by different masts; (f) the extent of the best serving coverage sector is unknown; (g) the indication of movement of the person using the telephone is no more than consistent with a suggested pattern of progress – it cannot establish positively that the user of the telephone in fact moved in the mooted direction; (h) calls 15, 16 and 17 from 008 at 20.53: 20.55: 20.55 were made when the telephone was not in the vicinity of Euston Street.

[38] On the basis of this evidence Mr Fee argued that the cell site analysis did no more than provide a very imprecise indication of general movements. In the absence of a capacity to identify a precise location of the telephone within the area of best coverage it was not possible to provide any precise indication of travel direction. We are disposed to accept that Mr Fee has correctly identified the limitations that apply to the cell site analysis. As he has acknowledged, however, it does provide a general indication of the movements of the users of the telephones. If the appellants followed a different pattern of movements on the day in question, it was open to them to give evidence about those movements and to explain where they had been at the critical time in relation to the shooting. Their failure to do so, combined with the general indication that the cell site analysis provided, constituted strong evidence against them that their movements were as indicated by that analysis. In Mr McCartan’s case, his inquiry of the interviewing police officers as to how precisely he could be tied down to a particular area was also, in our judgement, extremely telling.'

The comments of the Appeal Court in para [38] suggests the appellants' own lack of self-preservation to state what their mobile telephones were doing and the reasons for going in a direction following the line of Masts used for handling calls, undermined the cell site analysis element of their appeal.

FORENSIC RECRUITMENT

FORENSIC RECRUITMENT

I get alot of enquiries asking about computer and mobile telephone recruitment. I try and answer as many queries as I can but I can't deal with all enquiries for those seeking employment. Moreover, it seems to me, at any rate, that alot of enquiries I get would be better directed to a recruitment consultant who specialises in this area and is more able to deal with the employment questions and vacancies in the forensic arena.

I have added a new link in the weblinks block under FORENSIC RECRUITMENT (on the right-hand side of this blog) so that students and professionals seeking employment etc can consult those who specialise in this area. I have spoken with David Sullivan of Appointments-UK (www.appointments-uk.co.uk) and he has confirmed to me that he is happy to field enquiries for those seeking employment.

Mobile Phone Alarm 'dangerous'

Mobile Phone Alarm 'dangerous'

I read an interesting news article reported by kvue.com about a woman in the East Austin area of the US who found that when she dialled "911" on her mobile telephone it had an audible alarm that activated. In itself the alarm noise was not excessively loud and it may not be a problem for those who have a disability and need confirmation that "911" has been successfull dialled. It could be danagerous though in other situations the user may find themself that may require discretion. Siutations like hostage, burglary, hijack or reporting a crime in progress...these and other scenarios may alert assailant/s to the user attempting to contact the emergency services.

The mobile telephone kvue.com refers to in this case is a Cazio G'ZOne phone from US mobile operator Verizon Wireless. The question is why was such a feature incorporated into the mobile telephone? kvue.com reported Verizon Wireless as saying “The tone our customer experienced is our interpretation of Section 255 of the Telecommunications Act calling for a provider of telecommunications service to offer service that is accessible and usable by individuals with disabilities. The tone, indicating that 911 has been dialed, is one of several features designed to make wireless service is accessible and easy to use, especially for those with disabilities...."

The FCC were reported as saying that Section 255 of the Telecommunications Code requires that phones let a caller know a 911 call is underway, but does not require an audible alarm, according to kvue.com. A spokesman for the FCC also said “The Commission has not implemented any rules pursuant to Section 255 that would require the use of any tones concerning 911 calls,”

The news article got me thinking why the alarm was necessary, if at all? Most mobile telephones have set as default an audible tone that the user can hear when dialling a number. If hearing is a user disability then 1) why does the user have a mobile telephone in the first place (unless for texting etc) and 2) numbers dialled appear on the screen of the mobile telephone, anyway. That is apart from the fact that some mobiles have an ICON the user can select to call the emergency services. Additionally, for those with impaired sight, it has been a feature of "key 5" on telephones and mobile telephones for at least two decades that a small nipple rises from "key 5" which can be detected by touch for the visually impaired. Once "key 5" is depressed for a period of seconds the phone automatically dials 999/911 (whichever is relevant) and hence why it has been termed the 'emergency key'. So the audible alarm approach looks more gimmicky than of benefit to the user.

Whatever reasoning was behind the intention to use an audible alarm, the fact that it cannot be decommissioned may well impact on consumer appeal to have such a handset. If, by accident, 911 is accidently pressed and the audible alarm goes off in the cinema or on the train it may actually aggravate an assailant into shutting the "thing" up - which is the danager the user seeks to avoid.

http://www.kvue.com/news/local/stories/110907kvueverizonalarm-bm.1f46e16ee.html

Expert Evidential Disclosure in Criminal Proceedings

Expert Evidential Disclosure in Criminal Proceedings

When dealing with mobile telephone evidence it is important to be aware of the rules of expert evidence. This too goes for technical and examiner witnesses. In the recent case of R -v- Lorraine Harris & Others (2005) EWCA Crim 1980 Lord Justice Gage was invited by counsel for the Crown to give guidance in relation to expert evidence where the evidence was considered frontier evidence and the significant failure within the criminal justice system to control and manage expert evidence. Counsel argued that there must be a change in approach. The Court of Appeal, however, took the view that, regardless of whether or not the criminal justice system had failed to control and manage expert evidence, they were reluctant to give any new guidance on expert evidence arising from the facts in these particular cases.

Gage LJ took the view that developments in scientific thinking and techniques should not be kept from the court. He considered this to have been demonstrated amply by recent cases involving new techniques such as facial mapping. He went on to express the view that this openness should be so even in cases where scientific thinking was at such an early stage that it could amount to no more than a hypothesis. Obviously, it would be imperative that the true hypothetical nature of the expert’s evidence be frankly indicated to the court.

Using the reasoning of Wall J in the case of Re: AB (Child Abuse: Expert Witnesses) (1995) 1 FLR 181 the current thinking of the Court of Appeal suggests that expert evidence in developing or controversial fields should have its place in court and ought not to be discouraged. However, the expert must be frank and open about the scientific status of such evidence and should reveal any material that might be contradictory. There can never be, said the court, a single test to provide a threshold for admissibility in all cases. It is up to the judge in each case to decide whether expert evidence should be admitted.

These matters follow on the heels of disclosure requirements raised in late 2006 and and 2007. These particularly related to disclsoure by prosecution expert, professional and technical witnesses generally. Set out in the "Golden Rule" (enunciated by Lord Bingham in R -v- C and H 2004) it removed the right of the witness to arbitrarily decide what evidence s/he would or wouldn't provide to the Crown Prosecution Service or Police and to have identified "all" evidence detailed in lists of "used" and "unused" material generated from the witness' work in the case, which should be disclosed in evidence. All data, test results, standards, academic works etc to be recorded and copies provided to CPS or the Police for assessment and disclsoure where necessary. The principle here perhaps suggesting the defendant should know what is in the file that is being used against him or her (Foucher -v- France 25 EHRR 234).

Thanks to Dr Chris Pamplin and the UK Register of Expert Witnesses for the cases and background info to them. For full details of the cases contact UK Register of Expert Witnesses.

Conflicts Call Records & SMS Delivery Dates

Conflicts Call Records & SMS Delivery Dates

One of the topics dealt with on my training courses just last week is getting examiners to appreciate the relevance of date and time stamps for received SMS text messages. Essentially, it should not be assumed as fact that a text message date and time stamp and call record date and time stamp for the SMS reflect the actual date and time of receipt by a mobile telephone.

The warning during training is worth raising, but there is nothing better that having a reminder about this matter. I have had two reminders of the fact that delayed text messages can occur. Over the last couple of days, Two text messages that were sent to me arrived yesterday and today. The text that was received yesterday 08/10/07 was sent on the 05/10/07. The text received today 09/10/07 was sent on the 04/10/07. Note how the older dated of the two text messages arrived later.

There may be some who might argue that:

1) 7F106F3C was full up and 7F106F43 threshold was exceeded, thus preventing texts being received? I can confirm 7F106F3C wasn't full and there is plenty of memory for incoming texts, thus 7F106F43 would not have been invoked.

2) That my mobile 'phone inbox was full up? I can confirm that it wasn't and there is plenty of memory available for incoming texts.

3) That my phone had been switched off all that time? I can confirm my mobile 'phone has been switch ON, on most occasions, except at night and for re-charging. Additionally, I have been receiving texts from others.

4) That the mobile had or has been in a poor service coverage areas? No this would not be correct because on the 04/10/07 I was right by the mobile operator's mast from which my mobile receives service and usually the location for my mobile is in a good coverage service area.

This topic raises important matters regarding mobile telephone evidence in criminal proceedings:

A) That the date and time in an SMS text message is the SMSC date and time that received the sent text message from its subscriber. There are some, not many, mobile telephones that do identify a date and time for the text folder when the message was received, but that is not the text message itself. Also the folder date and time is as accurate as the user set the clock on the mobile 'phone. The latter folder issue maybe a moot point though for where the text message is deleted and later to be recovered, the mobile telephone folder or its date and time stamp are not recovered.

B) That the call records reflect the charging parameters date and time, not necessarily the delivery date and time of an SMS text message. Therefore, this can create conflict between the call records dates and time and SMS delivery dates and times.

C) In criminal proceedings, we largely deal with historical data and therefore the subscriber of an mobile telephone account may receive a message that can be some time after the date it was sent and the message maybe subsequently saved or deleted. However it may also be the case that the subscriber may not remember down the line whether a particular text was received late or not.

To overcome this problem and for corroborative purposes, naturally, call record data that identifies details of a received SMS text message should include the network operator's record confirming receipt of the text message including date and time stamp. The network receipt arises as the mobile 'phone is required to provide confirmation of the message delivered to it. You might think this is analogous to a "Registered Post" letter requiring the addressee to sign having taken taking delivery of it.

Conflicts Call Records & SMS Delivery Dates

Conflicts Call Records & SMS Delivery Dates

One of the topics dealt with on my training courses just last week is getting examiners to appreciate the relevance of date and time stamps for received SMS text messages. Essentially, it should not be assumed as fact that a text message date and time stamp and call record date and time stamp for the SMS reflect the actual date and time of receipt by a mobile telephone.

The warning during training is worth raising, but there is nothing better that having a reminder about this matter. I have had two reminders of the fact that delayed text messages can occur. Over the last couple of days, Two text messages that were sent to me arrived yesterday and today. The text that was received yesterday 08/10/07 was sent on the 05/10/07. The text received today 09/10/07 was sent on the 04/10/07. Note how the older dated of the two text messages arrived later.

There may be some who might argue that:

1) 7F106F3C was full up and 7F106F43 threshold was exceeded, thus preventing texts being received? I can confirm 7F106F3C wasn't full and there is plenty of memory for incoming texts, thus 7F106F43 would not have been invoked.

2) That my mobile 'phone inbox was full up? I can confirm that it wasn't and there is plenty of memory available for incoming texts.

3) That my phone had been switched off all that time? I can confirm my mobile 'phone has been switch ON, on most occasions, except at night and for re-charging. Additionally, I have been receiving texts from others.

4) That the mobile had or has been in a poor service coverage areas? No this would not be correct because on the 04/10/07 I was right by the mobile operator's mast from which my mobile receives service and usually the location for my mobile is in a good coverage service area.

This topic raises important matters regarding mobile telephone evidence in criminal proceedings:

A) That the date and time in an SMS text message is the SMSC date and time that received the sent text message from its subscriber. There are some, not many, mobile telephones that do identify a date and time for the text folder when the message was received, but that is not the text message itself. Also the folder date and time is as accurate as the user set the clock on the mobile 'phone. The latter folder issue maybe a moot point though for where the text message is deleted and later to be recovered, the mobile telephone folder or its date and time stamp are not recovered.

B) That the call records reflect the charging parameters date and time, not necessarily the delivery date and time of an SMS text message. Therefore, this can create conflict between the call records dates and time and SMS delivery dates and times.

C) In criminal proceedings, we largely deal with historical data and therefore the subscriber of an mobile telephone account may receive a message that can be some time after the date it was sent and the message maybe subsequently saved or deleted. However it may also be the case that the subscriber may not remember down the line whether a particular text was received late or not.

To overcome this problem and for corroborative purposes, naturally, call record data that identifies details of a received SMS text message should include the network operator's record confirming receipt of the text message including date and time stamp. The network receipt arises as the mobile 'phone is required to provide confirmation of the message delivered to it. You might think this is analogous to a "Registered Post" letter requiring the addressee to sign having taken taking delivery of it.

Another Mobile Telephone Stun Gun

Another Mobile Telephone Stun Gun

If I carry on like this I will probably end up with the world's largest webblog catalogue of mobile telephone stun guns. Having previously reported on mobile telephones being re-designed as weapons at this webblog, well here's another. Just to be clear I will not promote where these products can be obtained, but I do highlight that these devices do exist and, as always, ask those who are seizing, handling or examining mobile telephones to take care, so as to avoid personal injury.

This realistic looking smartphone-style stun gun delivers 900,000-volts of so-called "protection" and using only three (3) CR2 batteries. Previous mobile telephone stun guns claimed 800,000-volts or lower. As a generous bonus the manufacturer of this device has added 12 LED flashlight, so that users can white-light blind the vision of their victims before whacking the poor souls with 900,000-volts - how generous! The unit is 4-inches in height and comes with a snazzy holster for those who are fashion conscious. So as to prevent users from zapping themselves the manufacturer as thoughtfully put in two levels of safety - well quite, it just wouldn't do would it for the user to be zapping themselves?

Take care, be lucky.

Cloning GSM SIM Card Report

Cloning GSM SIM Card Report

This report that is available for download was written back in 2002 and was one of the first on the market to look at what was happening with GSM SIM Card cloning marketplace and I believe this report was the first to report on this matter in the mobile telephone evidence and forensic community.

I am letting this report out as it was written in 2002 but largely because there is so much about cloning of SIM Cards that is available by way of the Internet (Google says 1,580,000 threads) that I think it is hardly likely that I am breaking any professional, forensic or moral taboos.

Cloning GSM SIM Card Report

Cloning GSM SIM Card Report

This report that is available for download was written back in 2002 and was one of the first on the market to look at what was happening with GSM SIM Card cloning marketplace and I believe this report was the first to report on this matter in the mobile telephone evidence and forensic community.

I am letting this report out as it was written in 2002 but largely because there is so much about cloning of SIM Cards that is available by way of the Internet (Google says 1,580,000 threads) that I think it is hardly likely that I am breaking any professional, forensic or moral taboos.

http://www.filebucket.net/files/4289_kt8qi/Special_Edition_2002_SIM_Cloning.pdf