USB2USB File Management

Now here is a brilliant design highly lauded by the design media back in 2012/2013 that for some reason has yet to see the light of day. Which is a pity really as this has the potential to provide the answer to a number of student final year project ideas. For instance:

[Idea by Kkie21] "I was thinking about writing a program that would be put onto a USB stick and then once connected to a android device it will forensically image it. Everything will be placed on the USB stick which will be write protected once the data is copied."

There had been the suggestion that a USB stick has no screen thus making it difficult to see any form of displayed comparison between DUT storage device and recording device transferred data etc.

I had suggested "Before you give up on your idea, are you are willing to compromise on your physical device?

ChipDrive from Towitoko has previously been used for mobile SIM Card reading. Maybe check with the company to see if they have a USB version. If so then this would be a GUI sufficient to display commands, icons and/or progress indicator. Also there are control keys around the edge that could be used for stop/start etc.

As mentioned above, this device has been used previously and programmed for reading and writing in fields other than time keeping and SIM card reading.

Have a look and see whether it meets your 13-weeks project management schedule.

http://www.chipdrive.de/index.php/en/smart-card-solutions/time-tracking-solutions/chipdrive-time-recording-kit.htm"

However, when I look at this prototype design below and the ability of USB2USB to connect with varying interfaces, user navigation buttons and screen etc etc could make this product, subject to spec, suitable for the above project idea. I really like the design of this product.

- 3 millimeters thick
- fits easily into your wallet
- equipped with an OLED touchscreen
- SD card slot
- 2 USB connectors.

[*Yankodesign said] This device reads most popular types of external memory cards and flash drives. Users only need to plug in the external cards or flashdrives to view the files and folders. Then they can browse the contents of the USB flashdrive and a preview of the selected file will be displayed on the background of the touchscreen display. The files can be transferred or copied by using its drag-and-drop function. The USB connectors, which come with flexible rubberized wires that integrate with the shape of the device, are detachable when in use. This device can be charged directly using the USB connector.








Designers: Saharudin Busri, Mohd Nizam Najmuddin, Mohd Rohaizam Mohd Tahar, Nuzairi Yasin, Nazjimee Amat Omar - MIMOS Berhad http://www.mimos.my/

*http://www.yankodesign.com/2013/01/02/usb-2-usb-and-more%E2%80%A6/

(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later).  This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber. 

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference. 

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later).  This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber. 

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference. 

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

Mobile Markets: Nokia 'Mobile Man'...it tells of a story

Mobile Markets: Nokia 'Mobile Man'...it tells of a story

This excellent construction, made up entirely of mobile phones, is Nokia's collaborative project with Beijing postal service to encourage recycling of mobile phones that can be handed in at post offices, according to the news article at news.cnet.com.   

It's great to see projects like, which tend to draw promotions using creative and talented ideas demonstrating the evolving and transforming world of mobile phones and its market places. Back in 2007 I posted on another creative work cellphone-transformer, which, yet again, shows a design that captures the imagination displaying the versatile uses to which a mobile phone might be put.

The business and ecomonic philosophy that resides behind these creative images equally tells of a story of growth and success. If recycling is happening then, perhaps, that is as a likely consequence of mobile ubiquity taking hold. That is a nice statement, but can I back it up?  I don't have my finger on every financial and market research pulse, but, apart from anecdotal references, there are various stats out there from the market research firms. Indeed, back in 2008 I blogged (staggering-figures-for-mobile-phone) on the state of the mobile data market when the economic downturn (which appears to have started in 2007 so we are led to believe) had got a firmer grip on global markets. In 2010 the stats still showed extraordinary figures (text.it), although the exact detail where all this activity occurs to generate such figures may not be obvious. It may be compelling to want to know how many consumers send text and mms messages (see OFCOM website for stats), but that is not the full picture. There are the other data markets in business to consider, such as the M2M market place (winwin) and comments by industry pundits on the mobile payments market (cellular-news).

It is useful to see how industry people collate information and bring amassed facts together in order to express their views and vision on what all the facts mean to them in aggregrate. An example of this can be seen in Tomi Ahonen's enthusiastic commentary found in Insiders Guide To Mobile (lulu) with references to trillion dollar market, over 4 billion users and the segmented factors when drawn together identified to him what is forecast for mobile. A view of one segment of the mobile phone market, apps, is simply a further illustration of information to be sourced to underpin market trends (windows-phone-apps-reach-new-market), another is sales and market penetration, such as Apple's iPhone outrageously outstanding sales growth.

If I removed from the context of the above commentary discussion about modern technology, and simply focussed on what an image might communicate, I could have been talking about social, cultural and economic life that might have been depicted by way of an 18th/19th century painting (irrespective of whether the painting is by an impressionist or not). Whilst the image above may not be an old master piece, the image still has a story to explicitly convey and that, in forensic terms, requires understanding all or part of any implicit subtext the image can also communicate.

My forensic skills, acquired over the years, meant that my reaction to seeing this image (even though photo/art imagery is not my subject), was to look at it as evidence and then set out to see what I could deduce from there. In reality we do this everyday in our work. We see a SIM card. We then want to know what it is and what is inside. In order to know what we are dealing with we need to know how it works and what can be held inside and whether all or part thereof can be revealed. Moreover, we need to know what amounts to 'conformance' and within that framework which conforming element is 'mandatory' and which is 'optional'. Once we have that background we can then begin to understand what is 'non-conforming' and/or 'unusual'. This path can equally be taken when dealing with mobile phones and RF investigations.

In conclusion, the subtext of this discussion can be revealed. However mobile phones maybe presented to the world, it is our job in forensics not to change that messsage, but to break down the presentation into its various building block elements in order that we know how each piece works and then how the pieces fit together and work and cooperate together.  This is because a true forensic standard requires of the individual to obtain knowledge by way of commentary, appropriate training, standards, specs and investigation, that includes examination and testing (trial and error), which is one side of the coin. The other side of this coin is knowing what the 'thing' in its final state is intended to do, which requiries understanding of the market place it which the 'thing' is to be adopted.  Using skills and techniques like these provide for a rich source of experience, too. Essentially, learning to bring all the pieces that are needed into play and being able to demonstrate that identifies the forensic examiner working with a well hone, self-principled approach of high standard.

For MTEB students, the summer recess is now here. Sure, have a great time and relax and enjoy the break, but don't waste valuable time. Great people strive in life because they want to go beyond what has already been achieved. Take time out from relaxing to bring together the exposure you have had to mobile knowledge and experience you have acquired, thus far. Select a particular line of investigative enquiry and see how far you get with it. I have identified some links above to illustrate a way forward or choose a different subject matter; remember to be able to demonstrate the primary basics of 'bush' methodology.

iCloud MobileMe Quota Storage

iCloud MobileMe Quota Storage

As with most things in the digital world and examining evidence, it is essential for an examiner to understand the way in which a product or service works and the options that brings, as opposed to only considering the stored data that is discovered upon initial examination.

There has been alot of discussions in the forensic community about iCloud and its impact on off-device storage access and examination. Interesting to note then that MobileMe storage quotas are in place, as recently observed:

http://www.macrumors.com/2011/06/20/if-you-use-all-your-icloud-storage-apple-sends-you-this-email/


If the user only wants to keep to the 5GB limit and doesn't delete data and the devcie storage is equally full, is newer data automatically deleted or stored elsewhere? I only raise the point because with increased data flowing in and out of mobile phones, this could impact on data connected to one issue being spread across several storage locations. 

Google says PC will be irrelevant in 3 years

Google says PC will be irrelevant in 3 years

Interesting article in The Register:



http://www.theregister.co.uk/2010/03/05/google_says_pc_will_be_irrelevant_in_three_years/



I can see where Google is coming from because I have similar thoughts about how mobile phones and SIM/USIM cards, as devices, are making significant inroads to provide functions and features traditionally provided by computers. This is another area that is forcing change on the work we do and why I believe we cannot afford to rest on any laurels we think we may have in our field of distinction and move as quickly as is reasonably practicable to do so to generate Certified/Validated tools.

Google says PC will be irrelevant in 3 years

Google says PC will be irrelevant in 3 years

Interesting article in The Register:



http://www.theregister.co.uk/2010/03/05/google_says_pc_will_be_irrelevant_in_three_years/



I can see where Google is coming from because I have similar thoughts about how mobile phones and SIM/USIM cards, as devices, are making significant inroads to provide functions and features traditionally provided by computers. This is another area that is forcing change on the work we do and why I believe we cannot afford to rest on any laurels we think we may have in our field of distinction and move as quickly as is reasonably practicable to do so to generate Certified/Validated tools.

Forensic Science Regulator

Forensic Science Regulator

.

I would urge all of you who examine mobile telephones and computers that if you want to do public sector work for evidence in civil and criminal proceedings in the UK and you are not on the Forensic Science Regulator's (FSR) list of approved suppliers then you may not get any work at all.

.

Dr Chris Pamplin from the UK Register of Expert Witnesses has presented some open discussion on the FSR's report.

.

One recommendation is the demise of the Council for the Registration of Forensic Practitioners (CRFP)

.

Here is the weblink and go to the section on Understanding the Issues and read all the threads...very informative.

.

www.jspubs.com/surveys/fsr0901/

.

Writing To Mobile Phones Under Examination

Writing To Mobile Phones Under Examination

There is always the debate as to what amounts to "forensic" processes and whether that can be left to human intervention to do that, whether a device alone can do that or whether it is the combination of human intervention and the device working together that can fulfil the objective? Perhaps germane and relevant to the above question is (1) knowing the potential of each to write to a mobile telephone should be understood first? (2) Whether, as a consequence of using the process, what data are or might be altered/lost? (3) To then decide whether "forensic" is an appropriate and applicable statement to label the process in the first place?

The discussion below starts to address Point 1. When examining mobile telephones there are at least five separate categories under which an examiner can or may write to a mobile telephone due to automated processes (indirect intervention) and/or direct human intervention. The categories and their contents below are not exhaustive, but have been used to illustrate some elements involved with Point 1.

A) Standard powering ON (direct human intervention) a mobile telephone can invoke automated processes (indirect intervention):

- wearleveling - can overwrite physical data

- updating files - writes new content to file

- setting off calendars alarms

B) Connecting data aquisition devices (direct human intervention) to mobile telephones to obtain stored data (indirect intervention):

- AT Command sets; to instruct mobile to identify its profile, fetch data (IMEI and SMS text messages etc). The example below illustrates a typcial communication of seeking the profle of a mobile telephone and the response received:-

SENDING frametype 0x00/length 0x08/8


41A54T2B+43C47G4DM49I0D AT+CGMI.


1 "AT+CGMI"


2 "Sony Ericsson"


3 "OK"


RECEIVED frametype 0x00/length 0x1F/31


41A54T2B+43C47G4DM49I0D 0D 0A 53S6Fo6En79y2045


AT+CGMI...Sony E


72r69i63c73s73s6Fo6En0D 0A 0D 0A 4FO4BK0D 0A


ricsson....OK..


Manufacturer info received


Sony Ericsson [Manufacturer: Sony Ericsson]





SENDING frametype 0x00/length 0x09/9


41A54T2B+43C53S43C53S3F?0D


AT+CSCS?.


1 "AT+CSCS?"


2 "+CSCS:


"GSM""


3 "OK"





SENDING frametype 0x00/length 0x0A/


10 41A54T2B+43C53S43C53S3D=3F?0D


AT+CSCS=?.


1 "AT+CSCS=?"


2 "+CSCS: ("GSM","IRA","8859-1","UTF-8","UCS2")"


3 "OK"





RECEIVED frametype 0x00/length 0x40/64


41A54T2B+43C53S43C53S3D=3F?0D 0D 0A


2B+43C53S43


AT+CSCS=?...+CSC


53S3A:20 28


(22"47G53S4DM22"2C,22"49I52R41A22"2C S:


("GSM","IRA",


22"3883883553992D-31122"2C,22"55U54T46F2D-38822


"8859-1","UTF-8"


2C,22"55U43C53S32222"29)0D 0A 0D 0A 4FO4BK0D 0A ,


"UCS2")....OK..

- Simply connecting a plug and cable to a mobile phone will write a nibble of data to the phone's memory in order to register the communications path along which data shall pass

C) By use of a communications protocol (direct human intervention) in order to extract and harvest data from a mobile telephone can write and overwrite data (indirect intervention):

- Bluetooth: to pair devices requires an identical code to be loaded by examiner on to the mobile telephone and can overwrite previously stored code

- Some Symbian mobile telephones require an agent to be loaded on to the phone in order for the examiners devices to communicate with the phone and then has to be deleted after examination

- Hex-dumping can require the use of flash boxes to flash clips (code) to flash memory that can overwrite blocks of data containing user data

D) To gain access to a mobile telephone may require the entry (direct human intervention)of security codes -

- Passwords/PINS

- Re-setting Passwords/PINs

E) Examiners using devices to select (direct human intervention) specific data can cause the operating system of a mobile telephone to handle data in a particular way (indirect intervention):

-some smart phones write to files in order to keep track of data and in some instances shift data around to accommodate the "fetch" request for certain data

Essentially the categories and content illustrated above merely sets the stage to highlight what an examiner faces when seeking to conduct data aquisition from a mobile telephone. Plug and play (PnP) devices cannot be used in isolation, that they need supervision (direct human intervention). Direct human intervention, with ot without a device, can have consequences too. Furthermore the mobile telephone under examination can as a consequence react to direct human intervention, as well as indirect intervention.

FORENSIC RECRUITMENT

FORENSIC RECRUITMENT

I get alot of enquiries asking about computer and mobile telephone recruitment. I try and answer as many queries as I can but I can't deal with all enquiries for those seeking employment. Moreover, it seems to me, at any rate, that alot of enquiries I get would be better directed to a recruitment consultant who specialises in this area and is more able to deal with the employment questions and vacancies in the forensic arena.

I have added a new link in the weblinks block under FORENSIC RECRUITMENT (on the right-hand side of this blog) so that students and professionals seeking employment etc can consult those who specialise in this area. I have spoken with David Sullivan of Appointments-UK (www.appointments-uk.co.uk) and he has confirmed to me that he is happy to field enquiries for those seeking employment.

Forensic CaseNotes

Forensic CaseNotes

John Douglas of QCC Information Security (http://www.qccis.com/content.php?section=forensics) has produced a new program for preparing contemporaneous notes during examination. Forensic CaseNotes is available free of charge. Nice one, John.

Introduction
The purpose of CaseNotes is to provide a single lightweight application program to run on the Microsoft Windows platform to allow forensic analysts and examiners of any discipline to securely record their contemporaneous notes electronically.

The main features are:
- Flexible configuration of case meta-data (case details, like the reference number, etc.)
- Secure “write-once, read-many” style of case note data capture
- Full audit trail of case note data entry and meta data edits in a self contained log
- Tamper evident storage of data using internal MD5 hashes for all data entered
- No use of heavy database technologies – all you need is the program and your case file
- Use of AES 512bit encryption (optional) to further secure data in sensitive cases
- Storage of configuration information in a user editable text based .ini file
- Support for running multiple copies of CaseNotes at the same time Tested and works in languages other than English (Japanese, Russian, Greek, Italian, ...)
- Tested on Windows XP, Server 2003 and Windows Vista. (sorry if you use a Mac)
- It’s free! That means no dongles and no restrictions on how many copies you use!

CaseNotes Quick Start Guide
http://www.gastric.com/casenotes/CaseNotesQuickStartGuide.pdf

CaseNotes Setup Program
http://www.gastric.com/forensics/CaseNotesSetup.msi

*Microsoft .NET framework v 2.0
http://www.microsoft.com/downloads/details.aspx?FamilyID=0856eacb-4362-4b0d-8edd-aab15c5e04f5&displaylang=en

*John Douglas informs http://trewmte.blogspot.com that Microsoft .NET framework v 2.0 is required to be installed.

GSM radio coverage bounces backward

GSM radio coverage bounces backward

A characteristic of radio signals is that they reflect off surfaces. Not startling or new news in itself, unless one considers its impact on radio coverage propagated North, but due to reflection, can be detected for instance in the South East or South West, behind the Sector of the Mast. In yet another case, I am told that at the Central Criminal Court evidence in a case confirmed that coverage in the opposite direction from its angle of propagation was detected and useable. It is useful to know this in cases for instance where the location of a mobile 'phone and a Cell ID's radio coverage at a location are not compatible with the investigation evidence. Importantly, the case does not set a universal principle, as this phenomenon does not happen in every case due to flat earth, no clutter etc. Tests will still need to be conducted on a case by case basis. It does though cast doubt over simply conducting spot-tests at one location.

Deleted SMS text messages

Deleted SMS text messages

GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.

Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:

GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."

Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?

http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf

Deleted SMS text messages

Deleted SMS text messages

GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.

Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:

GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."

Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?

http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf

Mobile Telephone Evidence

MCC AND MNC CODES

As examination of SIM Cards and Handsets is on the increase internationally, thus roaming is relevant, the list below identifies Mobile Country Codes (e.g. 234) and Mobile Network Codes (e.g. 44) for global Mobile Operators. Please note the data are subject to change.

20201 Cosmote Greece
20205 Vodafone Greece
20209 Q-Telecom Greece
20210 Telestet Greece
20404 Vodafone Netherlands
20408 KPN Netherlands
20412 O2 Netherlands
20416 T-Mobile Netherlands
20420 Orange Netherlands
20601 Proximus Belgium
20610 Mobistar Belgium
20620 Base Belgium
20801 Orange France
20810 SFR France
20820 Bouygtel Telecom France
21303 S.T.A. MobilAnd Andorra
21401 Vodafone Spain
21402 Movistar Spain
21403 Amena Spain
21404 Xfera Spain
21407 Telefonica Movistar Spain
21601 Pannon GSM Hungary
21630 Westel 900 GSM Mobile Hungary
21670 Vodafone Hungary
21803 Eronet Bosnia Herzegovina
21805 Mobi's Bosnia Herzegovina
21890 GSM BIH Bosnia Herzegovina
21901 Croatian Telecoms Cronet Croatia
21910 VIP Croatia
22001 MOBTEL Yugoslavia
22002 ProMonte GSM Yugoslavia
22003 03 Yugoslavia
22004 Monet Yugoslavia
22201 Telecom Italia Mobile TIM Italy
22210 Vodafone Italy
22288 Wind Telecomunicazioni Italy
22298 BLU Italy
22299 3 Italy
22601 MobiFon CONNEX GSM Romania
22603 Cosmorom Romania
22610 Mobil Rom DIALOG Romania
22801 Swisscom NATEL Switzerland
22802 Sunrise Switzerland
22803 Orange Switzerland
23001 T-mobile Czech Republic
23002 EuroTel Praha Czech Republic
23003 Oskar Czech Republic
23101 Orange GSM Slovak Republic
23102 EuroTel GSM Slovak Republic
23201 MobilKom Austria A1 Austria
23203 T-Mobile Austria
23205 Connect Austria One Austria
23207 Tele.ring Austria
23210 3AT Austria
23400001 Virgin United Kingdom
23410 02 United Kingdom
23415 Vodafone United Kingdom
23420 3 United Kingdom
23430 Virgin United Kigndom (others)
23430 T-Mobile United Kingdom
23433 Orange United Kingdom
23450 Jersey Telecom GSM United Kingdom
23455 Guernsey Telecoms GSM UK
23458 Manx Telecom Pronto GSM UK
23800001 Debitel Denmark
23801 Tele-Danmark Mobil Denmark
23802 Sonofon Denmark
23820 Telia Denmark Denmark
23830 Orange Denmark
24001 Telia Mobitel Sweden
24002 3 Sweden
24003 Orange Sweden
24007 Comviq GSM Sweden
24008 Vodafone Sweden
24201 Telenor Mobil Norway
24202 NetCom GSM Norway
24403 Telia Finland Finland
24405 Radiolinja Finland
24407 AT&T U.S.A.
24409 Finnet Group Finland
24412 2G Finland
24414 AMT Finland
24491 Sonera Corporation Finland
24601 Omnitel Lithuania
24602 UAB Bite GSM Lithuania
24603 Tele 2 Lithuania
24701 Latvian Mobile Tel. Latvia
24702 Tele 2 Latvia
24801 Estonian Mobile Telephone Estonia
24802 RadioLinja Eesti Estonia
24803 Tele 2 Estonia
25001 MTS Moscow Russia
25002 Megafon Russia
25005 Siberian Cellular Russia
25007 Zao Smarts Russia
25010 Don Telecom Russia
25012 New Telephone Company Russia
25013 Kuban GSM Russia
25039 Uratel Russia
25044 North Caucasian GSM Russia
25099 BeeLine Russia
25501 Ukrainian Mobile Comms Ukraine
25502 Ukrainian Radio Systems Ukraine
25503 Kyivstar GSM Ukraine
25505 Golden Telecom Ukraine
25701 Velcom
25702 MTS
25901 Voxtel Moldova
25902 Moldcell Moldova
26001 Polkomtel PLUS GSM Poland
26002 ERA GSM Poland
26003 IDEA Centertel Poland
26201 T-Mobile Germany
26202 Vodafone Germany
26203 E-Plus Mobilfunk Germany
26207 O2 Germany
26213 MobilCom Germany
26214 Quam Germany
26601 Gibraltar Telecoms Gibtel Gibraltar
26801 Vodafone Portugal
26803 Optimus Telecom. Portugal
26806 Telecom Moveis Nac. TMN Portugal
27001 P+T LUXGSM Luxembourg
27077 Millicom Tango GSM Luxembourg
27201 Vodafone Ireland
27202 O2 Ireland
27203 Meteor Ireland
27401 Iceland Telecom Siminn Iceland
27402 TAL hf Iceland
27403 Islandss Iceland
27404 Viking Iceland
27601 Albanian Mobile Comms Albania
27602 Vodafone Albania
27801 Vodafone Malta
27821 Go Mobile Malta
28001 Cyprus Telecoms Authority Cyprus
28201 Geocell Limited Georgia
28202 Magti GSM Georgia
28203 Geo 03 Georgia
28301 ArmenTel Armenia
28401 MobilTel AD Bulgaria
28405 Globul Bulgaria
28601 Turkcell Turkey
28602 TELSIM Turkey
28603 Aria Turkey
28604 Aycell Turkey
28801 FT-GSM
28802 KALL
29001 Tele Greenland Greenland
29340 Si.mobil Slovenia
29341 Si-GSM Slovenia
29370 Si VEGA 070 Slovenia
29401 MobiMak Macedonia
29402 MTS AD Macedonia
29501 Telecom
29502 Montel
29505 FL1
29577 Tango
30200001 Fido Canada
30237 Microcell Connexions Inc Canada
30272 Rogers AT&T Canada
31001 Pacific Mobile Comms Pap New Guinea
31002 APC Sprint Spectrum U.S.A.
31011 Wireless 2000 Telephone U.S.A.
31015 BellSouth Mobility DCS U.S.A.
31017 Cingular (Pacific Bell Wireless) U.S.A.
31020 T-Mobile U.S.A.
31026 Western Wireless Voicestream U.S.A.
31027 Powertel U.S.A.
31031 Aerial Communications U.S.A.
31038 AT&T U.S.A.
31077 Iowa Wireless Services U.S.A.
33805 Digicel JM
34001 Orange French West Indies
34020 BouygTel French West Indies
36801 C-Com CU
37412 TSTT
40001 Acell Telekom B.M. Azerbaijan
40002 BKcell GSM 2000 Azerbaijan
40101 K-Mobile Kazaksthan
40102 KCELL Kazaksthan
40217 B-Mobile BT
40401 Aircel Digilink Essar Cellph. India
40402 Bharti Cellular Telecom Airtel India
40403 Bharti Cellular Telecom Airtel India
40405 Hutch India
40407 TATA Cellular India
40408 Ushafon India
40410 Bharti Cellular Telecom Airtel India
40411 Hutch India
40412 Escotel Mobile Comms India
40413 Hutch India
40414 Ina Spice India
40415 Aircel Digilink Essar Cellph. India
40419 Escotel India
40420 Orange India
40421 BPL USWest Cellular India
40422 Idea India
40423 Usha Martin Tel. Command India
40424 Idea India
40426 Usha Martin Tel. Command India
40427 BPL USWest Cellular India
40430 Usha Martin Tel. Command India
40431 Bharti Cellular Telecom Airtel India
40432 Ushafone India
40434 BPL USWest Cellular India
40438 BPL USWest Cellular India
40440 INA AIRTel India
40441 RPG MAA India
40442 Srinivas Cellcom India
40443 BPL USWest Cellular India
40444 Spice India
40445 Bharti Cellular Telecom Airtel India
40446 BPL USWest Cellular India
40449 Bharti Cellular Telecom Airtel India
40451,53,54,55 BSNL Mobile India
40456 Escotel India
40457,58,59 BSNL Mobile India
40460 Aircel Digilink Essar Cellph. India
40462,64,66 BSNL Mobile India
40468 Dolphin India
40469 Dolphin India
40470 Oasis India
40471,72,73,74,75,76,77 BSNL Mobile India
40478 IDEA India
40479,80,81 BSNL Mobile India
40486 Hutch India
40490,92,93,94,95,96,97,98 Bharti Cellular
Telecom Airtel India
41001 Ufone Pakistan
41201 AWCC AF
41302 MTN Networks Dialog GSM Sri Lanka
41303 CellTel Sri Lanka
41401 MPTGSM
41501 FTML Cellis Lebanon
41503 LibanCell Lebanon
41601 J.M.T.S Fastlink Jordan
41677 MobCom Jordan
41701 SyriaTel Syria
41702 94 Syria
41709 MOBILE Syrian Telecom Est. Syria
41793 SyriaTel Syria
41801 Iraq Telecom Iraq
41902 Mobile Telecoms MTCNet Kuwait
41903 Wataniya Kuwait
42001 Ministry of PTT Al Jawal Saudi Arabia
42007 Electronics App' Est. EAE Saudi Arabia
42202 General Telecoms Oman
42401 UAE ETISALAT-G1 United Arab Emirates
42402 UAE ETISALAT-G2 United Arab Emirates
42501 Orange Israel
42502 Cellcom Israel
42505 JAWWAL Israel
42601 Batelco Bahrain
42701 QATARNET Qatar
42899 MobiCom MN
43211 TCI Iran
43214 Kish Iran
43400 Uzmacom Uzbekistan
43401 Buztel Uzbekistan
43402 Uzmacom Uzbekistan
43404 Daewoo Unitel Uzbekistan
43405 Coscom Uzbekistan
43407 UZD Uzbekistan
43603 MLT TJK
43605 TajikTel
43701 Bitel Kyrgyz Republic
44010 DoCoMo Japan
45201 Mobifone Vietnam
45202 Vinaphone Vietnam
45400 Hong Kong Telecom CSL Hong Kong
45404 Hutchison Telecom Hong Kong
45406 SmarTone Mobile Comms Hong Kong
45410 New World PCS Hong Kong
45412 Peoples Telephone Hong Kong
45416 Mandarin Com. Sunday Hong Kong
45418 Pacific Link Hong Kong
45422 P Plus Comm Hong Kong
45501 C.T.M. TELEMOVEL+ Macau
45601 Mobitel Cambodia
45602 SM Cambodia
45618 Camshin Cambodia
45701 Lao Shinawatra Telecom Lao
45702 ETLMNW Lao
45703 LatMil Lao
45708 Tango Lao
46000 China Telecom GSM China
46001 China Unicom GSM China
46002 Liaoning PPTA China
46601 Far EasTone Telecoms Taiwan
46606 TUNTEX Telecom Taiwan
46688 KG Telecom Taiwan
46692 Chunghwa Telecom Taiwan
46693 Mobitai Communications Taiwan
46697 Pacific Cellular TWNGSM Taiwan
46699 TransAsia Telecoms Taiwan
46701 Sun KP PRK
47001 Grameen Phone Bangladesh
47002 Aktel Bangladesh
47003 Sheba Telecom Bangladesh
47201 DHI Mobile MV
50202 Binariang Malaysia
50212 Maxis Malaysia
50213 Telekom Cellular TM Touch Malaysia
50216 DiGi Telecommunications Malaysia
50217 TimeCel Wireless Adam Malaysia
50219 Celcom Malaysia
50501 Telstra Mobile Comms Australia
50502 Optus Australia
50503 Vodafone Australia
50503 3 Australia
50508 OneTel Australia
51001 PT. SATelindo C Indonesia
51008 Lippo Telkomsel Indonesia
51010 TelKomSel Indonesia
51011 Pro XL Indonesia
51021 IM3 Indonesia
51501 Isla Comms Philippines
51502 Globe Telecom Philippines
51503 Smart Communications Philippines
51505 DigiTel Philippines
52001 Advanced Info Service AIS Thailand
52010 Orange Thailand
52018 DTotal Access Worldphone Thailand
52023 GSM 1800 Thailand
52099 Orange Thailand
52501 Sing. Tel. GSM 900 Singapore
52502 Sing. Tel. GSM 1800 Singapore
52503 MobileOne Asia Singapore
52504 M1-3GSM Singapore
52505 StarHub Singapore
52811 DST Communications Brunei Darussalam
53001 Vodafone New Zealand
53901 O-Call ton
54101 Smile VUT
54201 Vodafone Fiji Fiji
54601 Mobilis New Caledonia
54720 Vini French Polynesia
55001 FSM Telecom FSM
60201 MobiNil Egypt
60202 Vodafone Egypt
60301 Algerian Mobile Network Algeria
60302 Djezzy Algeria
60400 Meditel Marocco
60401 Itissalat Al-Maghrib IAM Marocco
60502 Tunisie Telecom Tunicell Tunisia
60503 Tunisiana Tunisia
60701 GamCel GMB
60702 AfriCELL GMB
60801 Sonatel ALIZE Senegal
60802 Sentel Senegal
60901 Mattel MR
61001 Matitel ML
61002 Ikatel ML
61201 Comstar Cellular Network Cote d'Ivoire
61203 Orange Cote d'Ivoire
61205 Telecel Cote d'Ivoire
61302 CelTel BF
61402 CelTel NE
61501 Togo Telecom TOGO CELL Togo
61602 TLCL-Ben BJ
61603 Benincell BJ
61604 BBcom BJ
61701 Cellplus Mobile Comms Mauritius
61710 Emtel Mauritius
61801 Lonestar Liberia
62001 ScanCom Ghana
62002 OneToch Ghana
62003 Mobitel Ghana
62120 Econet NG
62130 MTN NG
62140 Nitel NG
62201 CelTel TC
62202 Libertis TD
62401 MTN Cameroon
62402 Orange Cameroon
62501 Cabo Verde Movel Cape Verde
62601 CSTMovel STP
62701 GNQ01 GNQ
62801 Libertis GA
62802 GAB TeleCel
62803 CelTel GA
62901 CelTel CD
62910 Libertis CD
63002 CelTel RC
63004 CellCo GSM RC
63089 OASIS
63102 Unitel AGO
63301 Seychelles Cellular Services Seychelles
63310 AIRTEL Seychelles
63401 Mobile Telephone Company Sudan
63510 Rwandacell Rwanda
63601 Ethiopian Telecoms Auth. Ethiopia
63701 Barakaat SOM
63782 Telsom SOM
63902 Safaricom KE
63903 KenCell KE
64001 Tritel Tanzania
64002 Mobitel Tanzania
64003 Zantel Tanzania
64005 CelTel Tanzania
64101 Celtel Cellular Uganda
64110 MTN Uganda Uganda
64111 UTL Telecel Uganda
64201 Spacetel BI
64202 Busafa BI
64301 mCel MOZ
64501 Celtel Zambia
64601 Madacom Madagascar
64602 SMM Antaris Madagascar
64603 Sacel Madagascar
64700 Orange
64702 OMT
64710 Societe Reunionnaise SRR Reunion
64801 NET*ONE Zimbabwe
64803 Telecel Zimbabwe
64804 Econet Zimbabwe
64901 MTC Namibia
65001 Telekom Network Callpoint Malawi
65010 CelTel Malawi
65101 VCL Comms Lesotho
65102 Ezi Cel Lesothp
65201 Mascom Wireless Botswana
65202 Vista Botswana
65310 Swazi MTN SZ
65501 Vodacom South Africa
65507 Cell C South Africa
65510 MTN South Africa
71201 ICE CRI
72235 Port Hable ARG
72402,03,04 TIM Brazil
72431 Oi Brazil
732101 Comcel Columbia
73401 Infonet Venezuela
73402 Digitel Venezuela
74601 ICMS SR
74602 TeleG SR

Mobile Telephone Evidence

MCC AND MNC CODES

As examination of SIM Cards and Handsets is on the increase internationally, thus roaming is relevant, the list below identifies Mobile Country Codes (e.g. 234) and Mobile Network Codes (e.g. 44) for global Mobile Operators. Please note the data are subject to change.

20201 Cosmote Greece
20205 Vodafone Greece
20209 Q-Telecom Greece
20210 Telestet Greece
20404 Vodafone Netherlands
20408 KPN Netherlands
20412 O2 Netherlands
20416 T-Mobile Netherlands
20420 Orange Netherlands
20601 Proximus Belgium
20610 Mobistar Belgium
20620 Base Belgium
20801 Orange France
20810 SFR France
20820 Bouygtel Telecom France
21303 S.T.A. MobilAnd Andorra
21401 Vodafone Spain
21402 Movistar Spain
21403 Amena Spain
21404 Xfera Spain
21407 Telefonica Movistar Spain
21601 Pannon GSM Hungary
21630 Westel 900 GSM Mobile Hungary
21670 Vodafone Hungary
21803 Eronet Bosnia Herzegovina
21805 Mobi's Bosnia Herzegovina
21890 GSM BIH Bosnia Herzegovina
21901 Croatian Telecoms Cronet Croatia
21910 VIP Croatia
22001 MOBTEL Yugoslavia
22002 ProMonte GSM Yugoslavia
22003 03 Yugoslavia
22004 Monet Yugoslavia
22201 Telecom Italia Mobile TIM Italy
22210 Vodafone Italy
22288 Wind Telecomunicazioni Italy
22298 BLU Italy
22299 3 Italy
22601 MobiFon CONNEX GSM Romania
22603 Cosmorom Romania
22610 Mobil Rom DIALOG Romania
22801 Swisscom NATEL Switzerland
22802 Sunrise Switzerland
22803 Orange Switzerland
23001 T-mobile Czech Republic
23002 EuroTel Praha Czech Republic
23003 Oskar Czech Republic
23101 Orange GSM Slovak Republic
23102 EuroTel GSM Slovak Republic
23201 MobilKom Austria A1 Austria
23203 T-Mobile Austria
23205 Connect Austria One Austria
23207 Tele.ring Austria
23210 3AT Austria
23400001 Virgin United Kingdom
23410 02 United Kingdom
23415 Vodafone United Kingdom
23420 3 United Kingdom
23430 Virgin United Kigndom (others)
23430 T-Mobile United Kingdom
23433 Orange United Kingdom
23450 Jersey Telecom GSM United Kingdom
23455 Guernsey Telecoms GSM UK
23458 Manx Telecom Pronto GSM UK
23800001 Debitel Denmark
23801 Tele-Danmark Mobil Denmark
23802 Sonofon Denmark
23820 Telia Denmark Denmark
23830 Orange Denmark
24001 Telia Mobitel Sweden
24002 3 Sweden
24003 Orange Sweden
24007 Comviq GSM Sweden
24008 Vodafone Sweden
24201 Telenor Mobil Norway
24202 NetCom GSM Norway
24403 Telia Finland Finland
24405 Radiolinja Finland
24407 AT&T U.S.A.
24409 Finnet Group Finland
24412 2G Finland
24414 AMT Finland
24491 Sonera Corporation Finland
24601 Omnitel Lithuania
24602 UAB Bite GSM Lithuania
24603 Tele 2 Lithuania
24701 Latvian Mobile Tel. Latvia
24702 Tele 2 Latvia
24801 Estonian Mobile Telephone Estonia
24802 RadioLinja Eesti Estonia
24803 Tele 2 Estonia
25001 MTS Moscow Russia
25002 Megafon Russia
25005 Siberian Cellular Russia
25007 Zao Smarts Russia
25010 Don Telecom Russia
25012 New Telephone Company Russia
25013 Kuban GSM Russia
25039 Uratel Russia
25044 North Caucasian GSM Russia
25099 BeeLine Russia
25501 Ukrainian Mobile Comms Ukraine
25502 Ukrainian Radio Systems Ukraine
25503 Kyivstar GSM Ukraine
25505 Golden Telecom Ukraine
25701 Velcom
25702 MTS
25901 Voxtel Moldova
25902 Moldcell Moldova
26001 Polkomtel PLUS GSM Poland
26002 ERA GSM Poland
26003 IDEA Centertel Poland
26201 T-Mobile Germany
26202 Vodafone Germany
26203 E-Plus Mobilfunk Germany
26207 O2 Germany
26213 MobilCom Germany
26214 Quam Germany
26601 Gibraltar Telecoms Gibtel Gibraltar
26801 Vodafone Portugal
26803 Optimus Telecom. Portugal
26806 Telecom Moveis Nac. TMN Portugal
27001 P+T LUXGSM Luxembourg
27077 Millicom Tango GSM Luxembourg
27201 Vodafone Ireland
27202 O2 Ireland
27203 Meteor Ireland
27401 Iceland Telecom Siminn Iceland
27402 TAL hf Iceland
27403 Islandss Iceland
27404 Viking Iceland
27601 Albanian Mobile Comms Albania
27602 Vodafone Albania
27801 Vodafone Malta
27821 Go Mobile Malta
28001 Cyprus Telecoms Authority Cyprus
28201 Geocell Limited Georgia
28202 Magti GSM Georgia
28203 Geo 03 Georgia
28301 ArmenTel Armenia
28401 MobilTel AD Bulgaria
28405 Globul Bulgaria
28601 Turkcell Turkey
28602 TELSIM Turkey
28603 Aria Turkey
28604 Aycell Turkey
28801 FT-GSM
28802 KALL
29001 Tele Greenland Greenland
29340 Si.mobil Slovenia
29341 Si-GSM Slovenia
29370 Si VEGA 070 Slovenia
29401 MobiMak Macedonia
29402 MTS AD Macedonia
29501 Telecom
29502 Montel
29505 FL1
29577 Tango
30200001 Fido Canada
30237 Microcell Connexions Inc Canada
30272 Rogers AT&T Canada
31001 Pacific Mobile Comms Pap New Guinea
31002 APC Sprint Spectrum U.S.A.
31011 Wireless 2000 Telephone U.S.A.
31015 BellSouth Mobility DCS U.S.A.
31017 Cingular (Pacific Bell Wireless) U.S.A.
31020 T-Mobile U.S.A.
31026 Western Wireless Voicestream U.S.A.
31027 Powertel U.S.A.
31031 Aerial Communications U.S.A.
31038 AT&T U.S.A.
31077 Iowa Wireless Services U.S.A.
33805 Digicel JM
34001 Orange French West Indies
34020 BouygTel French West Indies
36801 C-Com CU
37412 TSTT
40001 Acell Telekom B.M. Azerbaijan
40002 BKcell GSM 2000 Azerbaijan
40101 K-Mobile Kazaksthan
40102 KCELL Kazaksthan
40217 B-Mobile BT
40401 Aircel Digilink Essar Cellph. India
40402 Bharti Cellular Telecom Airtel India
40403 Bharti Cellular Telecom Airtel India
40405 Hutch India
40407 TATA Cellular India
40408 Ushafon India
40410 Bharti Cellular Telecom Airtel India
40411 Hutch India
40412 Escotel Mobile Comms India
40413 Hutch India
40414 Ina Spice India
40415 Aircel Digilink Essar Cellph. India
40419 Escotel India
40420 Orange India
40421 BPL USWest Cellular India
40422 Idea India
40423 Usha Martin Tel. Command India
40424 Idea India
40426 Usha Martin Tel. Command India
40427 BPL USWest Cellular India
40430 Usha Martin Tel. Command India
40431 Bharti Cellular Telecom Airtel India
40432 Ushafone India
40434 BPL USWest Cellular India
40438 BPL USWest Cellular India
40440 INA AIRTel India
40441 RPG MAA India
40442 Srinivas Cellcom India
40443 BPL USWest Cellular India
40444 Spice India
40445 Bharti Cellular Telecom Airtel India
40446 BPL USWest Cellular India
40449 Bharti Cellular Telecom Airtel India
40451,53,54,55 BSNL Mobile India
40456 Escotel India
40457,58,59 BSNL Mobile India
40460 Aircel Digilink Essar Cellph. India
40462,64,66 BSNL Mobile India
40468 Dolphin India
40469 Dolphin India
40470 Oasis India
40471,72,73,74,75,76,77 BSNL Mobile India
40478 IDEA India
40479,80,81 BSNL Mobile India
40486 Hutch India
40490,92,93,94,95,96,97,98 Bharti Cellular
Telecom Airtel India
41001 Ufone Pakistan
41201 AWCC AF
41302 MTN Networks Dialog GSM Sri Lanka
41303 CellTel Sri Lanka
41401 MPTGSM
41501 FTML Cellis Lebanon
41503 LibanCell Lebanon
41601 J.M.T.S Fastlink Jordan
41677 MobCom Jordan
41701 SyriaTel Syria
41702 94 Syria
41709 MOBILE Syrian Telecom Est. Syria
41793 SyriaTel Syria
41801 Iraq Telecom Iraq
41902 Mobile Telecoms MTCNet Kuwait
41903 Wataniya Kuwait
42001 Ministry of PTT Al Jawal Saudi Arabia
42007 Electronics App' Est. EAE Saudi Arabia
42202 General Telecoms Oman
42401 UAE ETISALAT-G1 United Arab Emirates
42402 UAE ETISALAT-G2 United Arab Emirates
42501 Orange Israel
42502 Cellcom Israel
42505 JAWWAL Israel
42601 Batelco Bahrain
42701 QATARNET Qatar
42899 MobiCom MN
43211 TCI Iran
43214 Kish Iran
43400 Uzmacom Uzbekistan
43401 Buztel Uzbekistan
43402 Uzmacom Uzbekistan
43404 Daewoo Unitel Uzbekistan
43405 Coscom Uzbekistan
43407 UZD Uzbekistan
43603 MLT TJK
43605 TajikTel
43701 Bitel Kyrgyz Republic
44010 DoCoMo Japan
45201 Mobifone Vietnam
45202 Vinaphone Vietnam
45400 Hong Kong Telecom CSL Hong Kong
45404 Hutchison Telecom Hong Kong
45406 SmarTone Mobile Comms Hong Kong
45410 New World PCS Hong Kong
45412 Peoples Telephone Hong Kong
45416 Mandarin Com. Sunday Hong Kong
45418 Pacific Link Hong Kong
45422 P Plus Comm Hong Kong
45501 C.T.M. TELEMOVEL+ Macau
45601 Mobitel Cambodia
45602 SM Cambodia
45618 Camshin Cambodia
45701 Lao Shinawatra Telecom Lao
45702 ETLMNW Lao
45703 LatMil Lao
45708 Tango Lao
46000 China Telecom GSM China
46001 China Unicom GSM China
46002 Liaoning PPTA China
46601 Far EasTone Telecoms Taiwan
46606 TUNTEX Telecom Taiwan
46688 KG Telecom Taiwan
46692 Chunghwa Telecom Taiwan
46693 Mobitai Communications Taiwan
46697 Pacific Cellular TWNGSM Taiwan
46699 TransAsia Telecoms Taiwan
46701 Sun KP PRK
47001 Grameen Phone Bangladesh
47002 Aktel Bangladesh
47003 Sheba Telecom Bangladesh
47201 DHI Mobile MV
50202 Binariang Malaysia
50212 Maxis Malaysia
50213 Telekom Cellular TM Touch Malaysia
50216 DiGi Telecommunications Malaysia
50217 TimeCel Wireless Adam Malaysia
50219 Celcom Malaysia
50501 Telstra Mobile Comms Australia
50502 Optus Australia
50503 Vodafone Australia
50503 3 Australia
50508 OneTel Australia
51001 PT. SATelindo C Indonesia
51008 Lippo Telkomsel Indonesia
51010 TelKomSel Indonesia
51011 Pro XL Indonesia
51021 IM3 Indonesia
51501 Isla Comms Philippines
51502 Globe Telecom Philippines
51503 Smart Communications Philippines
51505 DigiTel Philippines
52001 Advanced Info Service AIS Thailand
52010 Orange Thailand
52018 DTotal Access Worldphone Thailand
52023 GSM 1800 Thailand
52099 Orange Thailand
52501 Sing. Tel. GSM 900 Singapore
52502 Sing. Tel. GSM 1800 Singapore
52503 MobileOne Asia Singapore
52504 M1-3GSM Singapore
52505 StarHub Singapore
52811 DST Communications Brunei Darussalam
53001 Vodafone New Zealand
53901 O-Call ton
54101 Smile VUT
54201 Vodafone Fiji Fiji
54601 Mobilis New Caledonia
54720 Vini French Polynesia
55001 FSM Telecom FSM
60201 MobiNil Egypt
60202 Vodafone Egypt
60301 Algerian Mobile Network Algeria
60302 Djezzy Algeria
60400 Meditel Marocco
60401 Itissalat Al-Maghrib IAM Marocco
60502 Tunisie Telecom Tunicell Tunisia
60503 Tunisiana Tunisia
60701 GamCel GMB
60702 AfriCELL GMB
60801 Sonatel ALIZE Senegal
60802 Sentel Senegal
60901 Mattel MR
61001 Matitel ML
61002 Ikatel ML
61201 Comstar Cellular Network Cote d'Ivoire
61203 Orange Cote d'Ivoire
61205 Telecel Cote d'Ivoire
61302 CelTel BF
61402 CelTel NE
61501 Togo Telecom TOGO CELL Togo
61602 TLCL-Ben BJ
61603 Benincell BJ
61604 BBcom BJ
61701 Cellplus Mobile Comms Mauritius
61710 Emtel Mauritius
61801 Lonestar Liberia
62001 ScanCom Ghana
62002 OneToch Ghana
62003 Mobitel Ghana
62120 Econet NG
62130 MTN NG
62140 Nitel NG
62201 CelTel TC
62202 Libertis TD
62401 MTN Cameroon
62402 Orange Cameroon
62501 Cabo Verde Movel Cape Verde
62601 CSTMovel STP
62701 GNQ01 GNQ
62801 Libertis GA
62802 GAB TeleCel
62803 CelTel GA
62901 CelTel CD
62910 Libertis CD
63002 CelTel RC
63004 CellCo GSM RC
63089 OASIS
63102 Unitel AGO
63301 Seychelles Cellular Services Seychelles
63310 AIRTEL Seychelles
63401 Mobile Telephone Company Sudan
63510 Rwandacell Rwanda
63601 Ethiopian Telecoms Auth. Ethiopia
63701 Barakaat SOM
63782 Telsom SOM
63902 Safaricom KE
63903 KenCell KE
64001 Tritel Tanzania
64002 Mobitel Tanzania
64003 Zantel Tanzania
64005 CelTel Tanzania
64101 Celtel Cellular Uganda
64110 MTN Uganda Uganda
64111 UTL Telecel Uganda
64201 Spacetel BI
64202 Busafa BI
64301 mCel MOZ
64501 Celtel Zambia
64601 Madacom Madagascar
64602 SMM Antaris Madagascar
64603 Sacel Madagascar
64700 Orange
64702 OMT
64710 Societe Reunionnaise SRR Reunion
64801 NET*ONE Zimbabwe
64803 Telecel Zimbabwe
64804 Econet Zimbabwe
64901 MTC Namibia
65001 Telekom Network Callpoint Malawi
65010 CelTel Malawi
65101 VCL Comms Lesotho
65102 Ezi Cel Lesothp
65201 Mascom Wireless Botswana
65202 Vista Botswana
65310 Swazi MTN SZ
65501 Vodacom South Africa
65507 Cell C South Africa
65510 MTN South Africa
71201 ICE CRI
72235 Port Hable ARG
72402,03,04 TIM Brazil
72431 Oi Brazil
732101 Comcel Columbia
73401 Infonet Venezuela
73402 Digitel Venezuela
74601 ICMS SR
74602 TeleG SR

Mobile Telephone Evidence

GSM radio coverage bounces backward

A characteristic of radio signals is that they reflect off surfaces. Not startling or new news in itself, unless one considers its impact on radio coverage propagated North, but due to reflection, can be detected for instance in the South East or South West, behind the Sector of the Mast. In yet another case, I am told that at the Central Criminal Court evidence in a case confirmed that coverage in the opposite direction from its angle of propagation was detected and useable. It is useful to know this in cases for instance where the location of a mobile 'phone and a Cell ID's radio coverage at a location are not compatible with the investigation evidence. Importantly the case does not set a universal principle, as this phenomenon does not happen in every case due to flat earth, no clutter etc. Tests will still need to be conducted on a case by case basis. It does though cast doubt over simply conducting spot-tests at one location.

Mobile Telephone Evidence

Code and Data go hand in hand

Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.

Mobile Telephone Evidence

Code and Data go hand in hand

Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.

Mobile Telephone Evidence

Mobile Telephone Call Records

Call Records obtained from the network operator provide the factual evidence of communications between parties to illustrate contact and association. Since July 2000 Single Point of Contact rules, the operator needs to exhibit call records and serve a statement of that fact. However, a compilation may be created by an case officer, served as an Exhibit using material from the original data. There is a glut of data appearing in evidence which is in the
form of compilation, but where the original material to create the compilation is not being automatically disclosed. This is creating problems and delays. It is essential to check originality and genuineness of compilation material against original data (R .v. Robson 1972) to determine any errors, but, equally to qualify the position of fact about each charged mobile call in the first place. You may think this is perhaps analogous to the discussion given by Professor Smith [1983] Crim LR 472 that a bank statement showing an entry of £100.00 into a bank account is not a statement that the account is in credit, but rather the fact of it.