China Mobile Telephones

China Mobile Telephone Exports

It wasn't difficult to guess that with China's industrial revolution into manufacturing everything and its growth markets in mobile telephones that China would aim to compete with the world's best known handset brandnames, such as Nokia, Motorola, Samsung, SonyEricsson, Alcatel, Sagem etc. I thought it might be helpful for mobile telephone examiners to be aware of the new China mobile telephone imports and publish a list of new arrivals of mobile telephones from China. The list is not exhaustive and covers those models that are available now. All of these handsets are operating in the frequency ranges of: 900MHz, 1800MHz and 1900MHz.

A818 Multi-media Phone +Bluetooth

BEST D2000 Multi-media Phone

BOEING 777 Dual SIM Card Phone

BELLWAVE 830 Dual SIM Card Phone

CECT Q500

CECT C1000+ Dual SIM Card Phone

CECT 1000D

CECT A800

CECT Jie Bao

CECT N90 Dual SIM Card Phone

CECT V8 Multi-media Phone + Bluetooth

CECT Q500 Dual SIM Card Phone + Bluetooth

CECT N538 Dual SIM Card Phone

CECT 1000D Dual SIM Card Phone

CECT A800 Dual SIM Card Phone + Bluetooth

CECT A706-2 Dual SIM Card Phone + Bluetooth

CECT N95 Dual SIM Card Phone + Bluetooth

CECT Y890 Dual SIM Card Phone

CECT C1000I Dual SIM Card Phone

CECT W958 Multi-media Phone

CECT N788 Multi-media Phone

CECT C99 Dual SIM Card Phone

CECT Q500 Dual SIM Card Phone

CECT N55 Multi-media Phone

CECT A900 Dual SIM Card Phone + Bluetooth

CECT V007 Multi-media Phone

CoolPAD 728B GSM + CDMA

CoolPAD 298 GSM + CDMA

CoolPAD 288 GSM + CDMA

HUI FENG 666 Multi-media Phone

HUI BAO 520 Dual SIM Card Phone + Bluetooth

ICOOL D66 Dual SIM Card Phone + Bluetooth

JIN SHA A203 Dual SIM Card Phone

JIA XIN N95 Dual SIM Card Phone + Bluetooth

K007 Multi-media Phone + Bluetooth

KAI RUI 666 Multi-media Phone

KAI RUI 169 Multi-media Phone

LANG XING M558 Dual SIM Card Phone

Long Run L821 Dual SIM Card Phone + Bluetooth

Ma Bao 99 Dual SIM Card Phone

NCKIA E95 Dual SIM Card Phone + Bluetooth

O3 838 Multi-media Phone + Bluetooth

Qi Tai X689+ / ZT 68 Dual SIM Card Phone + Bluetooth

San Sunc N96 Dual SIM Card Phone + Bluetooth

TIAN Long 788 Multi-media Phone

TIAN SHI XING T900 Dual SIM Card Phone

Ya Qi Yi Hao Dual SIM Card Phone + Bluetooth

Zhong Than 199 Dual SIM Card Phone + Bluetooth

ZT 988 Dual SIM Card Phone

ZTC 988 Multi-media Phone

ZTC C2000 Dual SIM Card Phone

Mobile Phones to be used in counter-terrorism

Mobile Phones to be used in counter-terrorism

USA Today ran an interesting news article titled "Phones studied as attack detector", which discusses The Department of Homeland Security developing "Cell-All" program.

http://www.usatoday.com/tech/news/techpolicy/2007-05-03-cellphone-attack-detector_N.htm

The work undertaken in the project apparently will look at cellular telephones and how isotope and biological detectors can be incorporated into them and their use. As a mobile telephone is carried should it (the cellphone) detect a known reference element, having the inclusion of Global Positioning System (GPS) in the cellphone would allow it to transmit the location coordinates of the detection to authorities.

The idea is interesting, but is not new. In the issue INDEX NO: VOL 2-MTS02-2005 Mobile Telephone Surveillance (MTS) Newsletter it contained a collection of short articles I had written going back to 2002 in which I identified how mobile telephones and mobile systems can be used as weapons, used for interception and detectors. The MTS edition was sent to military, law enforcement agencies and security specialists in the UK as it also discussed mobile telephone issues associated with the July 2005 bombings in London UK. One of the short articles discussed "Cell phone could warn of bio-attack".

A mobile phone able to warn against fire, leakage of methane or other types of toxic gas. The phone includes a battery with sensors that provides periodical information about quick temperature changes, the presence of smoke, methane and carbon monoxide, which are compared by an internal device with pre-established normal values. The alarm telephone will not be much more expensive than a common one, as a sensor costs about 5-10 dollars and only the phone'ssoftware will be changed.In the future, the mobilephones might also include biosensors, which will warnabout the presence of bacteria,viruses, toxins, micro-organisms,radiations, nuclear particles and explosive powder. Such a project should also take into account the high price of the biosensors of about 300 dollars. The biosensors are currently in the test phase.

The original concept of biosensors being used in mobile telephones has been developing since 2003. It is interesting to see, though, in 2007 how far that concept has come, and how mobile telephones are, once again, being adapted to operate in so many different ways well beyond the original concept for consumer use, such as mobile calls and text messaging.

Privacy: Phones, Emails, Internet

Privacy: Phones, Emails, Internet

The European Courts of Justice gave a further decision recently regarding the importance of Human Rights and the right to Privacy when it comes to communications - Copeland -v- United Kingdom [COPLAND v. THE UNITED KINGDOM - 62617/00 [2007] ECHR 253 (3 April 2007) ]. The impact of this decision will again focus minds on what is reasonable conduct and relevancy of performing the conduct in the first place. The elements to the case of Copeland began in 1998 relating to monitoring of the Complainant's communications, revealed in 2000. However, such monitoring was before the Human Rights Act 1998 came into effect in October 2000 and prior to The Telecommunications (Lawful Business Practice) Regulations 2000 having effect due to the requirements of The Regulations of Investigatory Powers Act 2000. Two important elements of the last two pieces of legislation are: prevent or reduce cases of spying on peoples' communications; and remedy by which to measure whether the conduct and actions are unlawful or not.

I have some understanding of these issues. Back in 2001 I was head of a Fraud and Security SIG in the UK for an association whose members spent approx £8B per annum on communications. You could say I used this time over a four year period to increase my forensic skillsets for evidence arising in the workplace. One issue I dealt with in 2001 was Communications Surveillance in the Workplace in responce to the requirements in The Telecommunications (Lawful Business Practice) Regulations.

I generated a discussion document and researched certain relevant issues at that time and the document was circulated to members and other interested parties. It is based on aspects of UK and EU legal issues. I have looked back in archive and have put a .pdf document into a Winrar file, which can be downloaded:

http://www.filebucket.eu//files/25/Communications%20Surveillance%20Workplace.rar.

This document is a 2001 document, so you need to be aware of latency of the document as to its usefulness in today's marketplace and forensic investigation.

A copy of the full Judgment can be found at: http://www.bailii.org/eu/cases/ECHR/2007/253.html.

File Signatures Mobile Phone & Computer Forensics

File Signatures Mobile Phones & Computer Forensics

FILESIG MANAGER

Given the ever growing list of file signatures needed when drilling down into imaged data to determine varying file types that may be recorded in the data can be a real pain if, like me, you create every growing lists of file signatures copied and pasted into notepad documents. The raw data I see from imaging mobile telephones, SIM/USIM, Smart/MMC cards and hard disc drives means that I need to retain a single database for all the file signatures captured. I have found a great little tool called Filesig Manager, created by Tim Coakley (www.filesig.co.uk), which is a "file signature and keyword management tool, acting as an examiner's central repository of File Identification information." Importantly, not only does it work very well, but it's FREE.

Screen Image 1

The screen image 1 illustrates a range of captured file signatures stored in the database that includes file extensions, description and category of file and in addition fields that contain data for segments and offsets used by other computer forensic products. The database comes with some pre-defined file signatures, which are the most common and most useful and the user can enter their own file signatures as and when they are discovered.

Typically, file signatures usually contain the first eight bytes and last four bytes of a file. Below are some examples of common file signature types I have recovered following imaging of mobile phones and MMC cards saved and deleted data.

Header...........................................Footer...................Extension

[FF D8 FF E0 00 10 4A 46]........[A4 83 FF D9]......[.JPG]

[30 26 B2 75 8E 66 CF 11].........[23 AE 00 00].......[.WMA]

[FF FA 61 C0 EA 3D 00 00].......[00 00 00 00]........[.MP3]

[00 00 00 14 66 74 79 70]...........[31 31 31 30]........[.3GP]

[47 49 46 38 39 61 18 01]...........[00 00 00 00]........[.GIF]

[52 49 46 46 AC D3 01 00].........[0D 0A 0D 0A].....[.WAV]

It is worth mentioning that some signatures use a Header that does not require all 8 bytes to be used. For example, .JPG file signatures are commonly referenced with a Header FF D8 FF E0 or FF D8 FF E1.

Screen Image 2

The screen image 2 illustrates file extensions and description of file extension as a look-up table.

Recover deleted data Smart/MMC Cards

Recover deleted data Smart/MMC Cards

There are times when my clients want to recover deleted data, whether it is from mobile telephones, SIM or USIM cards or smart/mmc cards. The screen images below demonstrates some of the stages involved in recovering deleted data from an MMC card.

The screen image above illustrates that a target device has been selected using the easy to understand GUI.

Importantly, this screen demonstrates just some of the file types that have been selected to be recovered. There are, of course, many file types that can be recovered, such as: (images etc) 3GP, AVI, MOV, MP4. MPEG, RM, WM, DjVU, BMP, CDR, DCR, DWG, GIF, ICO, JPEG, MRW, NEF, ORF, PEF, PNG, PSD, PSP, RAF (1) & (2), RAW, SRF, TIFF, TTF, WMF, XIF. (audio) AIF, AU, AVR, DSS, M3U, MIDI, MP3, OGG, RIFF, VOC, WAV, WMA. This is apart from other document file types (such as .doc, .pdf, etc)

Having selected the file types for recovery that have been deleted (free space), the recovery process needs to be set in motion, shown in the above screen image.

Here we see the number of recovered files that had been deleted stands at 13 files. However, the MMC card from which the deleted data was recovered has memory size 32MB. However, it is possible to recover many tens of deleted files from cards with this memory size, and many hundreds of files for large memory cards (dependent on file size, of course).

Finally, here is a complete recovered file fully working 3GP video and metadata intact.

If you are in law enforcement, public sector, criminal or civil solicitors and need this service, please send an email to me with your full contact details at:

The Digital Evidence Examination Unit (The DEEU)

trewmte@gmail.com

Can you help?

Can you help?

Please donate to help young Laura who is diagnosed with cancer. During the past couple of years she has undergone many treatments of radiotherapy and chemotherapy, she has had one kidney removed, her spleen has been removed along with part of her pancreas. On Jan 5th 2007 she had 3 tumours removed from her lungs.The out look for Laura is not good, it was her 3rd birthday recently.

The small gift of a donation you make can help towards making lives like Laura's that little bit easier. All donations are paid to *Candlelighters.

To learn more visit: http://www.justgiving.com/quadsuk

*Candlelighters supports the work of the Regional Children and Adolescent Cancer and Leukaemia Unit at St. James's Hospital Leeds and funds research into childhood cancer.

Charity Registration No 1045077

UPDATE: Sad news. Regrettably, beautiful young Laura died on the 6th April 2007.

Is your cell phone bugged

Is your cell phone bugged

Vortex (a US company) has produced an online Video, which they say is "to explain this issue in a more demonstrative and somewhat less technical manner..."

http://video.google.com/videoplay?docid=-3437321657032158285&hl=en

It raises some quizzical issues. This is not my attempt to be dismissive of what they are saying, but I could not help but think it does rely upon the subjectivity of each mobile phone user to perhaps determine if their battery runs down too quickly or the handset gets hot when not in use that information is being extracted from it.

The video authors do stress that any such use of monitoring mobile phones is not targetted at the general public, but those under surveillance. But that in itself may not stop the general public thinking something maybe up if they find the events occurring that have been suggested .

Whilst videos like this can be informative, they can introduce feelings of worry or paranoia to those who maybe vulnerable to such feelings. Perhaps it might assist, if a mobile phone user thinks this is happening to first rule out common events that the mobile phone may be exposed to:

The mobile
A) had been left in direct sunlight
B) left close to a radiator or devices that emit heat generally in areas (kettles, photocopiers, computers/laptops etc)
C) that the user hasn't just taken the mobile phone out of the coat pocket (obvious I know, but worth saying anyway)
D) reduction in battery power occurs because of resource greedy applications running on the mobile phone
E) does update to the network and in areas were poor radio coverage pockets occur or where the mobile is located at the radio boundary of a Mast's coverage, updating to the network does increase energy consumption (drawn from the battery)
F) where a mobile phone is swtiched OFF and battery still runs low, it could be a fault of a bleed from the battery or that the mobile's firmware is faulty regarding e.g. the clock and draws more power from the battery at a higher rate
G) using broadband might require the ISP or application service to 'ping' the mobile to ensure the account is still connected, which might be a separate event from updating to the network regarding the subscriber IMSI-attach status for example

These are just some observations that might help, but if a mobile user is still concerned, the video does demonstrate a detection method using speakers. But even that may produce a false-positive result. There is of course another method that may eliminate this matter which the video suggests is to remove the mobile phone's battery. OK, but that doesn't take account of when the mobile is switched ON and in the idle mode. If the mobile user still feels uncomfortable, then change to a different or new mobile phone.

USB Profiler mobile 'phone examination

USB Profiler mobile 'phone examination

Ever found it annoying, like I have, when trying to examine mobile 'phones and SIMs/USIMs that given the fast range of applications and USB plug-in devices to be used it becomes difficult to know which USB connections are actually running on the computer. That means not just USB devices logged as previously being used but whether there is a live-link currently running. As always it is the simple, straightforward programs that make our lives so much easier. USBDeview profiles all USB connections and provides a global view of activity on your computer. You could of course spend time scrolling through DeviceManager...but that can be long winded. This freeware program speeds up the detection process. Enjoy.

http://www.filebucket.eu//files/25/usbdeview.rar

USB Profiler mobile 'phone examination

USB Profiler mobile 'phone examination

Ever found it annoying, like I have, when trying to examine mobile 'phones and SIMs/USIMs that given the fast range of applications and USB plug-in devices to be used it becomes difficult to know which USB connections are actually running on the computer. That means not just USB devices logged as previously being used but whether there is a live-link currently running. As always it is the simple, straightforward programs that make our lives so much easier. USBDeview profiles all USB connections and provides a global view of activity on your computer. You could of course spend time scrolling through DeviceManager...but that can be long winded. This freeware program speeds up the detection process. Enjoy.

http://www.filebucket.eu//files/25/usbdeview.rar

GPS Mobile Phone Computer Training Shoes

GPS Mobile Phone Computer Training Shoes

The conventional mobile 'phone looks set to radically undergo a design change, if the above training shoe becomes popular. The internal microphone and speaker fitted into the trainer can be configured to act as a wireless phone. The trainer even comes with a USB port. Problems might arise of course when going through customs or airport security and you are wearing a pair of these. I must confess perhaps to a little apprehension regarding having to examine this type of exhibit. Will be adding odour eaters and Fabreeze to my forensic examiners toolkit.

To find out more click on the Technologies tab at the bottom of home page - http://www.isaacdaniel.com/fele.htm

GSM Radio Test Measurements - Non-Dominance

GSM Radio Test Measurements - Non-Dominance

Screen Image 1

Readers and cell site analysis students will recall the thread at http://trewmte.blogspot.com/2007/01/gsm-radio-test-measurements.html regarding GSM Radio Test Measurements. In that thread the discussion related to possible anomalies and interpretation regarding radio test measurements. In this thread I want to highlight another radio anomaly termed non-dominance that may occur.

Generally speaking, non-dominance occurs when radio coverage from two or more radio sources are equally aligned so that they all become dominant. The rare event in Screen Image 1 displays coverage quality and signal strengths of four radio sources are all equal to each other, in a confined area, where the receiver is in the idle mode and at ground level. Attempting to define that one particular Mast would be used to make or receive a mobile call in these circumstances might be difficult. The problems interpreting outcomes due to non-dominance could be numerous. For instance:

i) Who is to say that the receiver camped on a Mast's coverage shown by ACT would actually use that Mast? The coverage at NC2, NC3 and NC4 are equally as likely to be candidates to carry a mobile call.
ii) What happens in the case that the Mast's coverage upon which the receiver is camped at ACT the Mast is not actually best placed or line of sight with the receiver and in other circumstance would not be considered at first instance to serve the geographical area? The receiver under these conditions could be placed in an entirely different geographical area simply from summarising the Mast details shown in the mobile call records.
iii) When call setup (OACSU) takes place and a connection made it could be possible a mobile ‘phone starts a connection for less than a second on the Mast at ACT but forced into hard handover immediately thereafter thus shifts the call to another Mast (say, NC4)? It could be possible the Mast at ACT is shown as the Mast in the call records, which could be rather misleading when attempting to consider geographical location of the mobile telephone when compared to a particular mobile call.
iv) How can the radio examiner, from looking at historical records, correspond radio test measurements against the outward set of event elements recorded in call records? Non-dominance may mean a series of calls being made at one location handled by numerous Masts – thus may amount to a suggestion from analysis of the Masts usage from the call records that the mobile is on the move when in fact it is rather confined to an area. Non-dominance may result in a high number of short duration mobile calls shown in the call records. The short duration calls may not be due to the user terminating the calls, but rather the network dropping the calls.

I introduced, I believe, GSM non-dominance as an important radio anomaly to be considered regarding evidence of radio test measurements into the first criminal case in the UK back in 2003 at the Central Criminal Court (Old Bailey). GSM non-dominance was identified and shown in my evidence. Three other experts appearing for the prosecution or other defendants received my report. Acceptance of my results and findings were agreed and no challenges were made. However, I should point out that the discovery that non-dominance can occur for radio coverage was not my invention but arose from radio propagation studies by mobile network radio engineers endeavouring to agree anomalies for radio principles. The non-dominance principle had already been adopted for the Tetra standards and is accepted in GSM radio parlances as a noteworthy event. Therefore, I was fairly well armed with other independent findings.

The purpose of this discussion thread is to provide yet another example of radio conditions that can prevail when conducting GSM radio test measurements. That simply analysing call records may only present half a picture – a trompe l’oiel ( a lie to the eye) if you will.

Master Password Unlock

Master Password Unlock

I have received requests for copies of the 2006 supplement edition of Mobile Telephone Evidence (MTE) Newsletter Vol4-MTE-03-2006 supp: 002 regarding Master Password Unlock for Nokia mobile telephones.

http://www.filebucket.net/files/1597_knksh/Handset%20Password%20Unlock.rar

MD5 Collisions

MD5 Collisions

Here is some addtionally reading on MD5 collisions, which was another cryptographic algorithm (like SHA-1) cracked back in 2005.

http://www.cits.rub.de/MD5Collisions/

SHA-1 Secure Hash Algorithm Cracked

SHA-1 Secure Hash Algorithm Cracked

An interesting article about it at:

http://en.epochtimes.com/news/7-1-11/50336.html

GSM Radio Test Measurements

GSM Radio Test Measurements

Radio Test Measurements 1

The screen image (Radio Test Measurements 1) represents the output results of radio coverage detected at the receiver (mobile telephone) and represent a single static view of that coverage at one instance. During cell site analysis there will be many screens obtained but for the purposes of this discussion this single screen image will do the job. Firstly, the reader will need to comprehend, at least, an interpretation that can be given to the identifiers in the screen image above.

TOP ROW
1. Chan: this indicator refers to the Broadcast Control Channel number.
2. RxLv: this indicator refers to the received strength of signal at the test handset measured in deciBel milliwatts, (dBm), where dBm is the notion for the measurement of power of the received radio signal e.g -75dBm.
3. C1: this is a quality indicator (path loss criterion) and is used for cell selection and cell reselection. The parameters are determined from the signal strength, the minimum received power levels for initiation of signals between the mobile and network, the maximum transmit power for accessing the network and the power of the mobile phone itself.
4. C2: this is an indicator used only for cell reselection optimisation and identifies parameters to aid the mobile phone in its cell reselection process.

LEFT COLUMN
5. 'ACT' denotes the strongest, thus dominant, serving cell coverage at that location providing the best quality associated with the BCCH number (Chan). Meaning the mobile telephone has completed the cell selection/reselection processes for normal service and has chosen a cell from which it plans to receive all available services (known as "camping on a cell").
6. 'NC2-NC6' denotes other cells available in an area that may equally offer service, but that the mobile phone has not camped upon them. However, the mobile network is aware that the mobile phone has choices available to it. Displayed beside the NCs are the cells, identified by their respective Broadcast Control Channel (BCCH) numbers.

OBSERVATIONS

If it is accepted that Chan (Channel) identifies the BCCH frequencies of the radio coverage that the receiver (mobile telephone) has detected in the ether (or as Professor Clerk-Maxwell (1886) so put it "ethereal wind" when describing electro-magnetic energy in the air ) then the consideration of the RxLv (signal strength) and C1 and C2 can then be considered.

Signal Strength

The maximum received signal strength at the receiver is understood to be -40dBm for GSM (see e.g GSM 11.10 etc) and commonly -40dBm is said to be at or very close to the transmitter. However, when looking at Radio Test Measurement 1 for ACT and NC1 we see Chan 81 and 87 detected at the receiver with signal strength -27dBm and -37dBm respectively. This raises the suggestion of saturation by the transmitter's coverage determined at the receiver, where the receiver is located on the ground. So what could be the reason for this?

One suggestion might be the sensitivity at the receiver is out of spec. For this instance it would be wrong. When I conduct cell site analysis I have five (5) mobile telephones with me set in network engineering mode in order to account for a faulty handset and other anomolies and for the purposes to determine when several mobile telephones are switched ON and side by side whether they would detect and camp on the same cell (GSM terminology for radio coverage from a particular Mast) or other cells. For the radio test measurements in this case all five (5) were switched ON and all detected Chan 81 with signal strength ranging from -27dBm / -30dBm.

So if it is accepted that the mobile telephones collectively are not revealing false-positives, what other occurrence might cause this to occur. To determine this matter readers may wish to investigate by way of the GSM Standards to comprehend the standard for upper and lower limits of signal strength and review the requirements for BTS (Base Transceiver Station) transmission power etc.

It may equally be helpful to mention at this point that the signal strengths for NC2 (- 44dBm), NC3 (-67dBm), NC4 (-68dBm), NC5 (-69dBm) and NC6 (-70dBm) are very respectable levels of signal strength being that they are of high quality. When I refer to high quality I am of course referring to the term as used by the objective GSM Standard GSM03.22. It contains a useful reference when considering the quality of signal strength (RxLv) recorded in radio test measurements that a mobile network "shall be understood to be received with high quality signal if the signal level is above ‑85 dBm".

Moreover, GSM05.08 identfies the threshold RXLEV (same as RxLv) on the downlink for handover process to commence. Typical range -103 to -73 dBm. Thus NC2 to NC6 received signal strength at the receiver, being above -73dBm, could one conclude from that were the mobile telephone to have camped on either one of NC2 to NC6 the network is unlikely to handover the mobile to another cell in the list? My observation to any reader would be investigate the GSM Standards in order to consider all the elements in order to produce a more rounded opinion on this matter.

C1/C2

Cell selection and cell reselection are rather complex and convoluted matters to discuss in this short discussion thread. My observation to the reader would be to look at C1/C2 and see whether at first instance the threshold results are identical or different? What does it mean if they are not identical? Also look closely to see if cells are indicated as not available for selection or reselection - denoted in Radio Test Measurement 1 as -99. Why would a cell not be selected and/or reselected? Is it due to poor signal strength; the mobile telephone has calculated its own power capability as low; or is it detecting interference etc?

The above is just a fraction of the information that needs to be considered during and following cell site analysis and from the little I have extrapolated above means that a casual approach to radio test measurements and cell site analysis can result in erroneous conclusions being drawn.

[Update: For more on Cell Site Analysis, see:

http://trewmte.blogspot.com/2006/11/cell-site-analysis-part-1.html ]

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Forensic CaseNotes

Forensic CaseNotes

John Douglas of QCC Information Security (http://www.qccis.com/content.php?section=forensics) has produced a new program for preparing contemporaneous notes during examination. Forensic CaseNotes is available free of charge. Nice one, John.

Introduction
The purpose of CaseNotes is to provide a single lightweight application program to run on the Microsoft Windows platform to allow forensic analysts and examiners of any discipline to securely record their contemporaneous notes electronically.

The main features are:
- Flexible configuration of case meta-data (case details, like the reference number, etc.)
- Secure “write-once, read-many” style of case note data capture
- Full audit trail of case note data entry and meta data edits in a self contained log
- Tamper evident storage of data using internal MD5 hashes for all data entered
- No use of heavy database technologies – all you need is the program and your case file
- Use of AES 512bit encryption (optional) to further secure data in sensitive cases
- Storage of configuration information in a user editable text based .ini file
- Support for running multiple copies of CaseNotes at the same time Tested and works in languages other than English (Japanese, Russian, Greek, Italian, ...)
- Tested on Windows XP, Server 2003 and Windows Vista. (sorry if you use a Mac)
- It’s free! That means no dongles and no restrictions on how many copies you use!

CaseNotes Quick Start Guide
http://www.gastric.com/casenotes/CaseNotesQuickStartGuide.pdf

CaseNotes Setup Program
http://www.gastric.com/forensics/CaseNotesSetup.msi

*Microsoft .NET framework v 2.0
http://www.microsoft.com/downloads/details.aspx?FamilyID=0856eacb-4362-4b0d-8edd-aab15c5e04f5&displaylang=en

*John Douglas informs http://trewmte.blogspot.com that Microsoft .NET framework v 2.0 is required to be installed.

Blackberry to include Push To Talk (PTT)

Blackberry to include Push To Talk (PTT)

I have learned, having entered a licencing agreement, Research In Motion (RIM) are to launch a Blackberry version that has Push To Talk with PTT technology provider Kodiak Networks. A Java version of the Kodiak handset client is to be intergrated into RIM's Blackberry handsets, so I learned. Kodiak also has supporting mobile application suite features, such as: availability status, call me alerts, call waiting, contact list privacy, voice messaging and convert-to-cellular capabilities.

With ever increasing features and functions, Blackberry's are definitely going to get more difficult to examine. Note I said "more difficult" and not used the word "impossible". It takes a number of hours to deal with current versions of Blackberry. With increasing features, start to expect examination times to increase between 1-2 days per device.

3G USIM-Detective Training Course 2007

3G USIM-Detective Training Course 2007

This core course introduces mobile telephone examiners and computer investigators to foundation information about Universal Subscriber Identity Module (USIM) card computer architecture, operating functionality, file structures and elementary files. The course is intended to assist delegates understand the complexity of 3G USIM cards and potential locations where user and network data can be recorded.

Ideally, delegates on this course should already have undertaken study into GSM SIM cards as the course requires delegates to also examine 3G USIM cards using Quantaq Solutions USIM-Detective software.

Courses: March, April and May 2007

http://rapidshare.com/files/10245341/USIM-Detective_datahseet_2007.pdf.html

Downloading from Rapidshare:
1. Click the above URL link or copy and paste into browser address bar
2. Go to bottom of Rapidshare html page displayed and click box that says FREE
3. Enter the four alphanumeric code into box that says "here"
4. Click Download (that also displays mirror site from which download is being obtained)
5. File download dialogue box appears, choice Open or Save

3G USIM-Detective Training Course 2007

3G USIM-Detective Training Course 2007

This core course introduces mobile telephone examiners and computer investigators to foundation information about Universal Subscriber Identity Module (USIM) card computer architecture, operating functionality, file structures and elementary files. The course is intended to assist delegates understand the complexity of 3G USIM cards and potential locations where user and network data can be recorded.

Ideally, delegates on this course should already have undertaken study into GSM SIM cards as the course requires delegates to also examine 3G USIM cards using Quantaq Solutions USIM-Detective software.

Courses: March, April and May 2007

http://rapidshare.com/files/10245341/USIM-Detective_datahseet_2007.pdf.html

Downloading from Rapidshare:
1. Click the above URL link or copy and paste into browser address bar
2. Go to bottom of Rapidshare html page displayed and click box that says FREE
3. Enter the four alphanumeric code into box that says "here"
4. Click Download (that also displays mirror site from which download is being obtained)
5. File download dialogue box appears, choice Open or Save

Cell Site Analysis EMTE Training Course 2007

Cell Site Analysis EMTE Training Course 2007

Understand the core elements involved in the GSM mobile telephone network and how when combining their use can be used to assist determine geographical location of a mobile telephone for criminal cases and investigation purposes.

Download a copy of the data sheet content for our Cell Site Analysis EMTE Training Course to be run in February and March 2007. Places are limited, as only 10 delegates can attend per course. This is a three day course.

http://rapidshare.com/files/10241385/Cell_Site_Analysis_EMTE_Training_Course_2007.pdf.html

Downloading from Rapidshare:
1. Click the above URL link or copy and paste into browser address bar
2. Go to bottom of Rapidshare html page displayed and click box that says FREE
3. Enter the four alphanumeric code into box that says "here"
4. Click Download (that also displays mirror site from which download is being obtained)
5. File download dialogue box appears, choice Open or Save