U-N-I update on posts

- Diameter - Online Charging Systems (OCS)
- Big / Fresh / Deep - Data : Huaewi overview
- Hot technologies to know about
- ARP.pcap
- bgp.pcap
- https.pcap
- ICMP-ARP-OpenFlow1.0.pcap
- ICMP-DHCP-DNS.pcap
- Russians target Telegram App
- Wireshark
- Protocols Relevant to U-N-I
- Industrial Networks Hit By WannaCry
- IM Telegram Replay Attack - Android
- Whisper Signal WhatsApp
- Subpico Intelligent Appication Layer Software
- Subpico LI with evidential integrity
- TraceWrangler
- old_GUTI_IMSI_Critical_Reject (updated)

https://www.linkedin.com/groups/13536130

Universal Network Investigations

Just started a new LinkedIn group called 'Universal Network Investigations (UNI)'. It is a group only for those involved in the wider area of fixed, mobile and large-scale computer networks. The group exists to assist cyber, forensics and fault-finding investigations: to exchange observations and sharing 'intel' in a closed forum discussing fixed and mobile network investigations - trace data and other forms of evidence (including but not limited to PCAP, CDRs, traffic logs, exchange and switch data, cell details, dumps, etc.) If you are a member of LinkedIn and want to participate in the group here is the link: https://www.linkedin.com/groups/13536130

GPRS Cell Site Analysis

GPRS CSA

http://cellsiteanalysis.blogspot.co.uk/2013/11/gprs-csa.html

GPRS CSA

There are often forum discussions about GPRS (general packet radio switching) and how to conduct CSA (cell site analysis). Given that GPRS is expected to form a basic data service across GSM/WCDMA/LTE it is always worth starting at the beginning with GSM/GPRS as GPRS has numerous influences on GSM that have evolved for today's mobile networks.

As the old adage goes "time and tide wait for no man" it is important to get to grips with GPRS at its easiest stages and when understood move on to track down changes and comprehend them found in the additional layers involved with later transmission technologies.

When I was teaching/training at the Institute the Professor in-charge of educational studies, at that time, wanted me to show where mobile communication research material originated, authenticate sources and compiled the material before student/delegate training could go ahead. Invariably this meant starting out producing hand-drawn sketches that would be converted and re-produced for slide/powerpoint presentations. The information in the sketehes being sourced from standards, books, articles, whitepapers, manufacturer specs etc, and experience (testing), of course. From my GPRS CSA course researched material prepared back in 2002/2003 I have pulled out the folder one hand-drawn sketch (below) from the collection of sketches prepared for GPRS CSA.

The sketch layout is heavily influenced by the existing standards and industry illustrations available at that time. I have added a few personal touches in order to produce this at-a-glance sketch. Perhaps students, investigators and examiners may find it a useful starting point. I shall add more here, at this blog, about GPRS CSA but I do have quite a few other research projects on the go and I want to write about those too.

Just briefly though, GPRS CSA is not possible simply by referring 'only' to CDRs.

Firstly, There are two CDRs to consider. GPRS usage is not soley defined by a Call Detail Record. GPRS has its own record called the Charging Data Record (also referred to by the acronym CDR) defined to confirm data usage, irrespective of the content transmitted in the data, and services used etc.

Secondly, GPRS CSA should not be undertaken lightly and should not be progressed where the investigator/examiner is being given partial information or being denied access to information.

Thirdly, to avoid mishaps associated with the second point mentioned above, examiners/investigators should establish at first instance the MS, (U)SIM/handset, used at the material time. Confirrmation which cells were GPRS enabled and were available for the relevant location/s at the material time; the requirement is also relevant identifing those cells that were not enabled for GPRS for the relevant location/s.

Fourthly, make sure it is clear which GPRS usage is in the home network and which is GPRS usage caused to be transported across donor roaming partner networks but within the same country (cf. Vodafone and Hutchinson 3G (H3G)).

Update on Forensic Webblog Posts

Update on Forensic Webblog Posts

Cell Site Analysis

http://cellsiteanalysis.blogspot.com/
-------------------------------------
Radio Survey Field Notes
CSA Training Explanatory Diagram
iOS 4.3.3 deletion of Location Cache
Requesting Cell Site Data

Forensic Mobile Examination

http://forensicmobex.blogspot.com
---------------------------------
Handset Examination in 1995
sn0wbreeze unthethering Windows iPhones
Symbian OS v9.4, Series 60 rel. 5

Examination and Evidence from SIM and USIM Cards

http://sim2usim.blogspot.com
----------------------------
Answer To Reset (ATR)
Blackberry Forensic Analysis

Billing & Call Detail Record Analysis

http://cdranalysis.blogspot.com/
--------------------------------
Vodafone CDR data
Mobile Evidence CDR/Billing Course
Call Detail Record (CDR) GSM Mobile Telephone Call

ABOUT THE BLOGS

Mobile Telephone Blogs Approved Access Only

I have endeavoured to be free with sharing knowledge and information over many years through my blogs, but given the changing economy, UK and global events and advancements in forensics, the nature of the technical content, new developments and examination techniques and legal information will only be accessible to approved law enforcement personnel, security specialists and authorised individuals. The following blogs are now approved access only:

Cell Site Analysis
http://cellsiteanalysis.blogspot.com

Forensic examination and evidence from SIM an USIM
http://sim2usim.blogspot.com

Forensic examination and evidence from Mobile and Smart Phones
http://forensicmobex.blogspot.com

Forensic analysis of Billing and CDR Records
http://cdranalysis.blogspot.com/

Mobile Telephone Evidence (http://trewmte.blogspot.com) will of course remain an open.

The criteria for authorised access to blogs:

a) Law Enforcement
b) Security Services (MI5, MI6, CID, SB, FBI....)
b1) Security Specialists - a proveable record in security for
networks, digital forensics, handsets, SIM, CDR etc
c) Authorised individuals

Requesting Cell Site Data

Requesting Cell Site Data

Engaging with defence solicitors or law enforcement with respect to seeking cell site evidence can be a tricky business. Invariably the request for data is largely governed by the type of case and the instruction of work. Problematical with the latter point is there maybe the notion that the person instructing actually has sufficient technical knowledge and understanding to comprehend the technical details to be analysed and the types of detail the CSA expert will need.

A mistake in common practice that I have noted with examiners and experts is to assume the CDR contains the complete cell site details, and clearly that cannot be the case. The structure and content of CDR vis-a-vis TAP files both are different and have different purposes, but ae not generated for the purposes to include cell site details. I have seen some company websites identifying themselves as experts and suggesting cell site details are found in extended CDRs. I do not agree as cell site details have absolutely nothing to do with a generated per call CDR or indeed TAP file for that matter. There are a minimal references to cell sites by way of cell ID (start/end) and a few other bits and pieces, but nothing more would be generated by the mobile phone, radio network, the switch or data capture machine for inclusion into a CDR/TAP file.

Another matter I have noted, when dealing with expert and examiner cell site reports and those conducting radio test measurements is this vague suggestion allude to an implicit fact that because the examiner took GPS measurements when conducting tests this somehow creates a fact that the cellular radio coverage is corroborated by this or the movements of the handset user is somehow tracked this way. There appears on the face of it at least a confusion between GPS and the mobile network. Neither GSM or WCDMA propagate GPS signals, merely they take data output in the form of a packet of data from a GPS module/unit and forward that packet through the device/network to the terminal that will somehow make use of the data. If I need support for that fact then I find it at first instance in the radio frequencies adopted for GSM and WCDMA and from which all else will follow when dealing with cellular radio propagation and communications.

So what are the data field elements that the examiner/expert might seek at first instance. Clearly there needs to be corroboration of a GSM originated/terminated and start and/or end of a mobile communication. The list below is not data (email/internet/download etc) communication related.

----------------------------------------
Date ?
Time ?
Calling party ?
Called party ?
Type of call ?
Duration ?
Registration (ringing time before answer) ?


Mast location Details for start of call
---------------------------------------
[Start of call] Site ID number?
[Start of call] Site Name?
[Start of call] Site Address?
[Start of call] Site Post code?
[Start of call] Type of transmission 3G WCMDA site or GSM site?
[Start of call] Frequency Range?
[Start of call] Macrocell or Microcell?
[Start of call] Height of Antennas?
[Start of call] Is this a omni-directional site?
[Start of call] How many sectors at site (e.g. 3, 6 etc)?
[Start of call] Easting and Northing?
[Start of call] Longitude and Latitude?
[Start of call] Cell ID (hex)?
[Start of call] Cell ID (dec)?
[Start of call] Cell ID (last digit as sector)?
[Start of call] Broadcast Control Channel (BCCH) number?
[Start of call] Azimuth (bearing of coverage)?


Mast location Details for end of call
-------------------------------------
[End of call] Site ID number?
[End of call] Site Name?
[End of call] Site Address?
[End of call] Site Post code?
[End of call] Type of transmission 3G WCMDA site or GSM site?
[End of call] Frequency Range?
[End of call] Macrocell or Microcell?
[End of call] Height of Antennas?
[End of call] Is this a omni-directional site?
[End of call] How many sectors at site (e.g. 3, 6 etc)?
[End of call] Easting and Northing?
[End of call] Longitude and Latitude?
[End of call] Cell ID (hex)?
[End of call] Cell ID (dec)?
[End of call] Cell ID (last digit as sector)?
[End of call] Broadcast Control Channel (BCCH) number?
[End of call] Azimuth (bearing of coverage)?

The cell site details should relate at minimum to the material time of the mobile communications and at least  upto the date the request for  information is being made in order to comprehend any changes at the Masts for the Mast that handled the start of the call and the Mast that handled the end of the call.

Request notification of any Mast alterations
-----------------------------------------
[Any change to Mast] Decommissioned?
[Any change to Mast] Height of Antenna altered?
[Any change to Mast] Azimuth Bearing of coverage?
[Any change to Mast] Mechanical or electrical tilt changes and to what degree?
[Any change to Mast] Licenced Power or Transmission power?
[Any change to Mast] Type of transmission from 2G GSM to 3G WCDMA or vice versa?

It is quite possible to seek considerably more about the arrangements at each Mast, but that often means dealing with each operator's specific matters on a case by case basis.   These elements are not included here.

CSA: Directed Retry Can Alter Mobile Phone's Location

CSA: Directed Retry Can Alter Mobile Phone's Location

Class│Value│
0 0 0│1 1 0 1│ Directed Retry

The accuracy or inaccuracy of cell site analysis testing measurements largely depends upon what has been considered and there are indeed many points to consider. One handover (HO) procedure, if it is included within a mobile network's radio-availability and traffic-flow arsenal, is called Directed Retry (DR). The GSM and 3GPP standards refers to this procedure.



What is Directed Retry (DR)?
Directed retry has adjustable parameters in order to define thresholds that once passed can trigger DR. When DR is set as Not Use it is inactive. Once set to Use the default value is set until the parameter is adjusted. That is to say a 'value' that is set as default can be modified in response to condtions eg quality of service (QoS) or traffic observations. A manufacturer of the say the BSS may provide recommended values, but it might be the OMC-R or BSS engineering team may require to make their own determination about values for internal or external handover procedures.

Use DR enables for example the BSS to move a mobile phone's communications to another cell (Mast or sector of a Mast) prior to call set up. That can be for an outgoing or incoming communication.

DR may be triggered by, for instance, due to 'congestion' and therefore may require internal or external handover procedures to combat that traffic condition. An outcome is that a mobile phone that receives service from the current serving cell (maybe the Mast is seen as closer to the mobile phone as well) is handed over to a cell that originates from a Mast that could be eg:

- some distance from the mobile phone's actual location
- coverage from a adjacent Mast in an area
- etc

This is one of many radio cases that when conducting radio test measurments a 2G/3G passive radio detection device and its readings may not record the appropriate network messages and thus mis-inform their users attempts in assessing a mobile phone's general location when conducting cell site analysis, as the device's readings may be incomplete. The Cell ID obtained from a call detail record (CDR) can only reflect the antenna identities on a fixed-positioned Mast and that a mobile phone has had its communications routed to and from the network using a particular Mast (so to speak). It doesn't automatically follow that the Cell ID confirms the general local area in which the mobile phone was actually located without certain radio data and other necessary checks being made.

Diplomas: Mobile Telephone Evidence (MTEdipl)

Diplomas: Mobile Telephone Evidence (MTEdipl)

.
The Diplomas provide individuals with a path to recognition for demonstrating development of students knowledge, skill and experience for those involved in mobile telephone examination and evidence or for anyone interested in this field of distinction.
.
Empowering students to have confidence in themselves, their knowledge and skills, is one feature in the Diploma modules. Another feature is the Diplomas can have value-added benefits for employers. Each Diploma carries a requirement that the student MUST present as part of their assignment a tested practice and procedure plan and be able to offer a possible solution to potential employers for practices and procedures for dealing with mobile phone evidence along with other enhancement value-added benefits, such as market potentials for future planning options that may benefit an employer.
.
The Diplomas are recognised by the Mobile Telephone Examination Board, fully backed with my experience over two decades in forensics and evidence and additional guidance and support from other experienced examiners in the field and identified materials from academics and experts in mobile telephony. The Diplomas enable students to organise their own time and work, without pressure, to study, complete and produce assignments for each Diploma module undertaken.
.

• Diploma for Foundation and Research Skills - Mobile Telephone Diploma Core CFRS

• Diploma for Mobile Evidence QA and Evidence Handling - Mobile Telephone Diploma Core CQAE1

• Diploma for SIM and USIM Technology Examination - Mobile Telephone Diploma Core CSUT2

• Diploma for MS and UE Technology Examination - Mobile Telephone Diploma Core CMSU3

• Diploma for Call Records and Network Records Analysis - Mobile Telephone Diploma Core CCRN4

• Diploma for Cell Site Analysis - Mobile Telephone Diploma Core CCSA5

A Diploma Mobile Telephone Evidence (MTEdipl) is awarded for each module that has been completed and passed. An Advanced Diploma is issued only when a student has completed and passed all the Diploma modules and must produce based upon an expert assignment a report containing all of the subjects in the Diploma modules that is presented to a Peer Review Board.
.
Diploma Module Completion Period:

CFRS - completion: 3 months
[1 months study / 1 month to submit assignment / 1 month assessment]
.

CQAE1 - completion: 4 months
[2 months study / 1 month to submit assignment / 1 month assessment]
.

CSUT2 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.

CMSU3 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.

CCRN4 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.

CCSA5 - completion: 6 months
[4 months study / 1 month to submit assignment / 1 month assessment]
.
For further details, costs and registration form:

Email: trewmte@gmail.com