Monday, August 31, 2009

Forensic Focus Interviews

Forensic Focus Interviews
.
Forensic Focus regularly interviews well known personalities from the world of computer and mobile phone forensics.
.
This month it was my turn:
.
Mobile Telephone Expert Witness, 29/08/09
.
Readers of trewmte.blogspot may also want to read the Interviews of past personalities, available at the link below:
.
  • Sean McLinden, Outcome Technology Associates, Inc. - 21/07/09
  • Graham Brown-Martin, Digital Safety Conference - 12/06/09
  • Lee Whitfield, Forensic 4cast - 10/06/09
  • Robert Botchek, President & Founder – Tableau, LLC - 09/06/09
  • Dr Chris Pamplin, Editor – UK Register of Expert Witnesses - 31/05/09
  • Ben Levitan, US Telecommunications Expert Witness - 08/05/09
  • Nick Furneaux, MD CSITech & Director, Bright Forensics - 07/05/09
  • Jan Collie, The Digital Detective - 24/04/09
  • Professor Tony Sammes, Cranfield University - 31/03/09
  • Simon Biles, Thinking Security - 27/11/08
  • Gene Spafford, CERIAS - 12/09/08
  • Paul Wright, City of London Police - 05/09/08
  • Jonathan Krause, Forensic Control - 27/08/08
  • Ian Kennedy, Forensic Consultant & Open University Lecturer - 14/07/08
  • Matt Shannon, Founder and Chief Software Architect F-Response - 19/06/08
  • David Sullivan, Appointments-UK - 28/04/08
  • Stefan Fleischmann, CEO X-Ways Software Technology AG - 27/02/08
  • John Patzakis, Guidance Software - 28/06/07
  • Harlan Carvey - 07/03/07
Posted by at No comments:
Labels: , , , ,

Wednesday, August 26, 2009

Cell Site Analysis (CSA) Images Part 2

Cell Site Analysis (CSA) Images Part 2
.
It may interest those reading the discussions that I post that Cell Site Analysis (CSA) results from terrain and clutter analysis and radio test measurements can be defined in many different ways that can demonstrate particular elements of importance to a case.
.


Image 5
.
First we need to model (Image 5) the landscape that represents the geographical area and natural and manmade phenomenon in the surrounding area. In this case the scene of crime is close to a crossroads in the middle of small urban town.
.
For the sake of comfort, juries rarely understand radio coverage that is verbally discussed but respond much better to discussion revolving around a visual aid presentation.
.

Image 6
.
In this particular case I want to show the jury that two microcells* were used and each microcell first needs to be defined (Image 6) to the jury so they have it clearly in their minds the origin and direction of the radio coverage that forms part of the discussion.
.
In the first posting below (Cell Site Analysis (CSA) Images) coverage maps were shown defining large cell/macrocell coverage. Here, it is possible to refine and finesse coverage to a specific area with microcell coverage. Importantly, it is a really good idea to make sure the first image the jury sees represents the first radio coverage that a particular mobile phone has used that you want to talk about.
.
Image 7
.
The second microcell coverage (Image 7) should also be defined and distinguished. It's always best to remember with microcell coverage radio path is shaped in the same way as the High Street. Microcells don't go around corners.
.


Image 8
.
Finally the culmination of the presentation defines how the coverage from both microcells blend (Image 8 ) at particular points along the radio path.
.
*Remember that mobile telephones need to be encouraged to use microcell coverage and the microcell location, coverage boundary, speed at which a mobile phone is moving and cell reselection cause system challenges that required the use of a new criterion that was introduced into the GSM Phase 2 Standards in 1996. Do you know what that criterion is called and how it works?
.
Lastly, having mentioned microcell and large cell, the image below (Image 9) represents a visual indication about very important technical aspects concerning radio coverage and the layers depicted are often referred to in evidence. Indeed, if you care to read some of the Mobile Telephone Case Law you can find Appeal Courts referring to the importance of comprehending how far coverage extends.
.
Image 9

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Posted by at No comments:
Labels: , , , , , , , , , ,

Tuesday, August 25, 2009

Cellphone starts Gas Stove

Cellphone starts Gas Stove


The New York Times has just published a great news story 21st August 2009 titled 'Hello, Oven? It’s Phone. Now Let’s Get Cooking!' Apparently, a New Yorker's cellphone keeps switching on the Gas Stove with worrying consequences. Updated the link below.

http://www.nytimes.com/2009/08/23/nyregion/23about.html?_r=1&scp=1&sq=cellphone%20starts%20Gas%20Stove&st=cse#

From a technical point of view, Radio and EMI folks will love this story.

UPDATED COMMENTS:

Naturally reading news articles like these, this one is reported in the respected New York Times, they are still often taken with a certain amount of scepticism and caution. The implication of this could be huge, not for sensations sake, but it opens up the doors to those who already have concerns about radio signal saturation.

There are, to put it conservatively, many many millions of mobile phones used everyday around the World. In the UK with a burgeoning population creaking up to 61-million, mobile phone numbers still out-number the population at minimum 2:1. And to create 1-billion texts a month (that's without voice calls/data calls) in UK networks, clearly lots of mobile phones are switched ON and in use.

The underlying concern with this story is that which device will be found to be the culprit (if at all):

- will it be the handset generating spurious emissions causing interference at a particular n-Hz level to unprotected circuitry

- will it be the electronic circuitry on the Gas Stove having poor EMC (electro-magntic compatibility) protection allowing conducted interference

or

- will it be both

It is not clear what will be the outcome of this matter, it may just fizzle out, but if not then this little story could have an impact on the World than even the "radiating us to death" protestors have hitherto made.

The implications could be wide spread, should the findings unearth the conclusion of random occurences of this type of event, because it opens the door to many other possibilities with possible horrible consequences:

- Scenario 1: My house burnt down because the mobile phone ignited the oven/stove without my knowledge

- Scenario 2: There was no trace of an accelerant, save to say, we found an appliance that had started the fire and we cannot rule out that it wasn't a mobile telephone that caused the appliance to ignite it

- Scenario 3: Two bodies were found in a house with no traces of attack or arson, the authorities are puzzled

So the potential for the unforeseen disaster perhaps shouldn't be ruled out, at this stage, but it would be useful to have the exact findings and conclusions published.

In the meantime I wont be having my mobile telephone left switched ON in MY trouser pocket.

Posted by at No comments:
Labels: , , , , ,

Cell Site Analysis (CSA) Images

Cell Site Analysis (CSA) Images
.
Cell Site Analysis (CSA) has had a good deal of airing recently here on the forum, so I thought you might like to see images from the work that I get involved.
.

Image 1
.
Image 1 is one slide from the training course material to introduce students to CSA when starting out discussing radio test measurements. It should be noted that this image represents less than 1% of all data acquired during radio test measurements.
.
Image 2
.
I thought it would be useful to include this Terrain and Clutter Map (Image 2) as I use this software to assist me in complex cases. Terrain and Clutter are discussed during training and as it was a topic of the discussion about UK Criminal Evidence Delays I thought it would be helpful to let forum members see that I am not referring to theoretical matters, terrain and clutter analysis actually takes place.
.
.
Image 3
.
It is essential to understand, when conducting radio test measurements, that just because radio signals can travel some distance from a particular Mast (Image 3) that coverage should not be dismissed or excluded. Operators set threshold limits, hard limits and boundary limits. It does not follow that just because a mobile is in the Green area shown in the Single Cell Prediction Map that the mobile will be excluded from using that coverage.
.
Do you remember the discussion that I put up here about fringe coverage?: http://trewmte.blogspot.com/2008/11/mobile-phones-and-fringe-coverage.html
.
Image 4
.
Best serving coverage is often posed as the deal-clincher to suggest the mobile phone was most likely or consistent with being at a particular location. There can be numerous points that could (and I say 'could' advisedly) point to best server coverage being used but rarely does it come up in evidence because the radio content in evidence rarely gets disclosed these days.
.
It is possible with best serving coverage that it can induce a negative outcome that may prevent calls taking place, so it is always important to see the other side of the coin, so to speak:
.
- http://trewmte.blogspot.com/2007/02/gsm-radio-test-measurements-non.html
- http://trewmte.blogspot.com/2007/01/gsm-radio-test-measurements.html
.
I hope the above provides a further illustration of how smart and intelligent a science Cell Site Analysis really is and that by not applying it properly and dumbing down this art of this forensic science:
.
- is not only a great loss to the law of evidence
- it reduces the examiner's/expert's knowledge and understanding about the subject with which they are dealing - mobile telephone evidence.

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com
Posted by at No comments:
Labels: , , , , , , , , , ,

Thursday, August 20, 2009

Is section 133 Criminal Justice Act 2003 flawed?

Is section 133 Criminal Justice Act 2003 flawed?
.
The great cases of the 60s, 70s , 80s and 90s saw in the introduction of good quality case law involving audio, computers and mobile telephone evidence. Cases such as R .v. Maqsud Ali (nothing lost in translation), R .v. Mahon (handling evidence), R .v. Robson (genuineness and orginality) etc, many cases included evidence that required authentication and many made reference to s27 Criminal Justice Act 1988 regarding documents containing statements served in evidence requiring to be identified from a source that is/was original, part of an original, or copy of an original no matter how many times removed.
.
http://www.opsi.gov.uk/ACTS/acts1988/ukpga_19880033_en_4#pt2-l1g27
27 Proof of statements contained in documents
Where a statement contained in a document is admissible as evidence in criminal proceedings, it may be proved—
(a) by the production of that document; or
(b) (whether or not that document is still in existence) by the production of a copy of that document, or of the material part of it, authenticated in such manner as the court may approve;
and it is immaterial for the purposes of this subsection how many removes there are between a copy and the original.
.
Highlighted, in the text above, are all those passages in s27 that have either changed or have been removed from s133 in the 2003 Act, which appears below.
Where a statement in a document is admissible as evidence in criminal proceedings, the statement may be proved by producing either—
(a) the document, or
(b) (whether or not the document exists) a copy of the document or of the material part of it, authenticated in whatever way the court may approve.
.
When reading section 133 CJA 2003 where is states in parenthesis "(whether or not the document exists)" expands the horizons to import much more into its meaning than its predecessor might under s27 CJA 1988 "(whether or not that document is still in existence)" as s133 might suggest that the document or a statement in it may not have needed to exist in the first place.
.
Thus, in the case of s133 it might open the possibility to make admissible a false or erroneous document created for a specific a purpose and to suggest the original was no longer available, whereas s27 at least required confirmation that there was an original in the first place that could at least be authenticated in such a manner that such a document did exist in the first place.
.
I am not a lawyer and do not hold out to be one, but I have raised this to a few lawyers who all seem to gather the point I am making and have not rejected outright my comments as folly. It does seem to me, at any rate, if ignorance of the law is no defence, then surely ambiguity is not a defence or a replacement for clarity either; but I could be wrong.
Posted by at No comments:
Labels: , , ,

Mobile Telephone Case Law

Mobile Telephone Case Law
.
As you know for Judges, Lawyers, Practitioners, Experts, Law Enforcement and Students the webblog was set up for educational discussion points about mobile telephone forensics and evidence. Whilst visitors to this webblog liked the format and knowledge and experience being imparted, and want this to continue, due to the many posts I have put up since 2006 led to requests for having more discussion on these topics. To that end a discussion forum was set up relating to Mobile Forensics over at Jamie Morris' Forensic Focus Forum here:
Arising from the success of that we have now begun the extension of that fourm by introducing specialist sub-forums: the first sub-forum identifies case law that involves mobile telephone evidence to aid comprehension as to what principles are being argued at law regarding this subject matter; to learn about errors with evidence; to increase knowledge and act as an aid to improving skillsets.
.
Mobile Telephone Case Law
http://www.forensicfocus.com/index.php?name=Forums&file=viewforum&f=18
.
Below are a list of cases that have been posted to start this new specialist area sub-forum:
.
Mobile Phone Calls - Usage: Gun Crime Case
Call Records, Cell Site Analysis & Omagh Bombing
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4399
.
Civil Case about mobile phone functionality infringement
.
Movement, Collocation and Cell Site Analysis
Cell Site Analysis not available for Trial
Why wasn't Cell Site Analysis used?
.
I shall continue to add to the list of cases above.
.
Interception case
.
Conspiracy, mobile calls and text messages
.
Article: Courts wary of cellphone forensics
.
Thumbnail downloads, Mobile Phones and Google
.
US Cell Site Analysis cases
.
US Case: CSA, ESN/MIN and Cloning Equipment
.
Deleted data may not amount to possession
.
US Case: Electronic Wireless Vehicle Monitoring
.
US Case: Email interception defined
.
RIPA, Emails and Interception
.
Posted by at No comments:
Labels: , , , , , , , ,

Friday, August 14, 2009

Happy Birthday Hans Christian Ørsted (Oersted)

Happy Birthday Hans Christian Ørsted (Oersted)
.
Hans Christian Ørsted, one of the leading scientists of the nineteenth century, played a crucial role in understanding electromagnetism. In 1820 he discovered that a compass needle deflects from magnetic north when an electric current is switched on or off in a nearby wire. This showed that electricity and magnetism were related phenomena, a finding that laid the foundation for the theory of electromagnetism and for the research that later created such technologies as radio, television and fiber optics. The unit of magnetic field strength was named the Oersted in his honour.
.
.
James Clerk Maxwell
Would Ørsted's work have influenced James Clerk Maxwell? To research here are a few links that records Maxwell's published works and other historical events:
.
.
Relevance: these matters all relate to the fundamental building blocks of radio signals, not forgetting, of course, that although we operate today in a digital radio society the waveform of radio signals are still analogue by nature. It is the adopted modulation schemes that define the important information we know that hides and is transported inside the radio signals - data.
Posted by at No comments:
Labels: , , , , , , ,

Sunday, August 02, 2009

Non-Law Enforcement Mobile Forensics Conference UK

Non-Law Enforcement Mobile Forensics Conference UK
.
A queries that has been raised about "When and where are the Mobile Forensic Conferences usually held in the UK? Also are they open to non Law Enforcement?" A discussion about this is running over on the other website that I am connected with, which is owned by Jamie Morris, called Forensic Focus. My reply to the query is:
.
"We can have a Mobile Forensics Conference in the UK. The problem getting it off the ground is getting people to pay the entrance price or get the numbers to actually attend. It is impossible to hire a large enough conference centre when it presents high costs.
.
"I recently found a place where the combined costs for a suite for a 2-days conference, promotion of conference, producing handout material, getting conference speakers to attend and have some good grub (not that canteen cacky food that often gets thrown up) would generate an entrance charge of £150.00 + VAT per head but to breakeven 150 paying people attending the two days conference are needed.
.
"The agenda would need to reflect what people want to know more about or just to be able to attend and go through forensic and evidential issues to see if our understanding is the same.
.
"So here is something for Forensic Focus forum members to comment: Are there 150 forum members of the 10,000+ FF members willing to attend and more importantly can you afford and willing to pay £150 + VAT per person. I will create a new thread for this discussion containing a Poll to see what forum members would like to do."
.
The Poll is here:
.
To see or added to the discussion go here:
.
¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬
UPDATE
¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬
.
MTEB Mobile Forensics Conference UK we will be looking at the conservatively estimated £1-billion market for the criminal and civil mobile forensics marketplace. What are the likely business opportunites?
.
There will be the topics:
- Practises
- Procedures
- U/SIM Card
- Handsets
- Cell Site Analysis
- Directives
- Statutes
- Regulations
- Rules
- Standards
- etc
.
The list above is undefined because there will be new ideas and initiatives as we will be casting of the old, stagnated and stale that prevails in the marketplace - they are history.
.
A new, fresh age is starting in our forensic arena and you should be a part of it.
Posted by at No comments:
Labels: , , , , , ,
Subscribe to: Posts (Atom)