Important principles in digital forensics

Schrodinger's Cat
https://upload.wikimedia.org/wikipedia/commons/thumb/9/91/Schrodingers_cat.svg/1200px-Schrodingers_cat.svg.png

At a time when digital forensics is under the spotlight and taking salvos of criticism for poor performance and lack of knowledge about its own scientific subject matter (http://parliamentlive.tv/Event/Index/7767e1b9-0e44-4de3-8627-baf9d091f487 and https://www.theguardian.com/uk-news/2018/feb/12/police-outsource-digital-forensic-work-to-unaccredited-labs) there is no better time than to refresh on principles to signpost the way to go or leave a breadcrumb trail to find the way back to safe ground.

I posted comments back in November 2006 (http://trewmte.blogspot.co.uk/2006/11/cell-site-analysis.html) identifying principles to remember, recall and apply, when conducting Cell Site Analysis (CSA) - but they apply to examinations also -  that are still relevant to today (2G/3G/4G/5G/etc....) as they were since the inception of digital cellular radio services back in the late 1980s/1990s.

The requirements identified in standards as "mandatory", "conditional", "recommendations" and so on are not written for fun;  nor to be wilfully disregarded just because they appear complex, complicated or difficult e.g. cannot be bothered to learn them, my device/machine does the thinking for me; both render the human-being to be no more than a perfunctory-goffer (human obsolescence) for the processes generated by software and algorithms in a device or machine.

The four principles to easily remember, recall and apply:

- There are mandatory requirements with mandatory outcomes
- There are mandatory requirements with optional outcomes
- There are optional requirements with mandatory outcomes
- There are optional requirements with optional outcomes

Moreover, and a fundamental (and one might suggest absolute) requirement, is the importance to understanding 'Modal verbs terminology' adopted in the standards.

Modal verbs terminology

In the present document "shall", "shall not", "should", "should not", "may", "may not", "need", "need not", "will", "will not", "can" and "cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions)

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

Metrology - USB part 1

With smartphones, tablets and other devices fitting the description Size-Scaled Digital Technology (SSDT) using USB physical connectivity provides for the simplest of examination DUT illustrations e.g the combination of three separate entities involved in inter-connection during an examination.

1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence

It is possible to extrapolate even greater numbers of inter-connected entities but then it would be simpler, if I were to do that, to simply write a book instead of writing this blog post. Moreover, greater numbers of inter-connections exponentially introduce the potential for higher risk of failure relevant to an entity's MTBF (mean time between failure) and MTTF (mean time to failure). 

                [”British scientist, Sir William Thomson (Lord Kelvin, 1824 - 1907),
                   concisely captured the aspect of knowledge so that others can study
                   the observations and apply the results without having to repeat the
                   experiment, when he wrote: “When you can measure what you are
                   speaking about and express it in numbers, you know what you are
                   talking about.”]

SSDT - USB - ET provides a useful basis upon which to consider metrological traceability:

"A core concept in metrology is metrological traceability,^[7] defined by the Joint Committee for Guides in Metrology as "property of a measurement result whereby the result can be related to a reference through a documented unbroken chain of calibrations, each contributing to the measurement uncertainty".^[8] Metrological traceability permits comparison of measurements, whether the result is compared to the previous result in the same laboratory, a measurement result a year ago, or to the result of a measurement performed anywhere else in the world."
http://en.wikipedia.org/wiki/Metrology#Metrological_traceability

An excellent source of reference for definitions for the science of measurement is:

International vocabulary of metrology — Basic and general concepts and associated terms (VIM)

Vocabulaire international de métrologie — Concepts fondamentaux et généraux et termes associés (VIM)
http://www.bipm.org/utils/common/documents/jcgm/JCGM_200_2008.pdf


International vocabulary of metrology – Basic and general concepts and associated terms  (VIM) 3rd edition  (2008 version with minor corrections)
Vocabulaire international de métrologie – Concepts fondamentaux et généraux et termes associés (VIM)
3e édition  (Version 2008 avec corrections mineures).
http://www.bipm.org/utils/common/documents/jcgm/JCGM_200_2012.pdf

Why have I shown two versions of the same document? Traceability is the answer. Building a quality system requires identification of reference materials upon which test measurements are (or have been in the past) conducted.  Anyone involved in lab preparation and of running a lab should be aware that standards iso17025 and iso9001 identify principles that may be adopted for a wide range of industries etc. It is only when drilling down into how these principles should be applied in practice does one become aware of how, metaphorically speaking, naked one is without something or someone else pointing to a path to follow.

VIM is an acknowledged and established international standard that can be referenced for defining the naming conventions for testing. Of course, there is still the need for knowledge, skill and experience for operating under lab conditions. Early works of Scroggie and Johnstone even today provide useful observations about various aspects of testing involved in a laboratory environment can be found in Radio and Electronic Laboratory Handbook 1980 edition (Marcus Graham Scroggie and George Gordon Johnstone ISBN 0-408-00373-1 and ISBN 13: 9780408003735). The book is available from Amazon and from reputable booksellers.

There are a range of other reference materials from testing through to calibration. For instance NASA (Deep Space Network) http://deepspace.jpl.nasa.gov/dsndocs/810-005/214/214-1.pdf ;  Laboratories for the Design and Assembly of Electronic Devices using Surface Mount Components conferencepaper.pdf ;  Handbook of Laboratory Experiments in Electrical and Electronics Vol.3 (Adamu Murtala Zungeru; James G. Ambafi ISBN 9781497507203) ; and the list goes on. These reference materials are in addition to publications produced by the FBI, NIST, ACPO etc...

This discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT can be at fault, is the ET can be at fault or are both DUT/ET together faulty?

To understand the technical properties for USB look here:

USB Type C
http://www.usb.org/developers/usbtypec/
http://www.usb.org/developers/docs/
http://www.usb.org/developers/docs/usb_31_060115.zip

This version of USB specification is identified, not simply from personal experience, but due to industry adoption of the standard:

(a) http://www.usb.org/press/USB_Type-C_Specification_Announcement_Final.pdf  

(b) http://arstechnica.com/gadgets/2014/08/small-reversible-usb-type-c-connector-finalized/



Image credited to http://arstechnica.com/gadgets/2014/08/small-reversible-usb-type-c-connector-finalized/

(c) https://support.apple.com/en-gb/HT204360 etc...

A testing schedule for MTBF and MTTF cannot be created unless the device class using a version of the USB specifications is corroborated:

Device Classes (some useful resource materials)
http://www.usb.org/developers/docs/devclass_docs/
http://www.atmel.com/dyn/resources/prod_documents/doc4322.pdf
http://www.linux-usb.org/usbnet/
http://cscott.net/usb_dev/data/devclass/usbcdc11.pdf

Moreover, if USB 3.0 is backward compatible with USB 2.0 could USB 3.0 be used as the de facto standard for all SSDTs to assist defining MTBF and MTTF?

What about USB plug/port sizes, would these create different test requirements?

Lastly, and to close Part 1 of this blog discussion, there is another question equally worth asking: "Does a manufacturer's/supplier's warranty for 12 or 24 months mean that lab testing is not necessary for that period of the warranty in question?


Previous discussion under Metrology
http://trewmte.blogspot.co.uk/2015/05/metrology.html

Knowing DUT memory
http://trewmte.blogspot.co.uk/2015/05/knowing-dut-memory.html

International Telecommunications Union and CSA

International Telecommunications Union and CSA

Were the standards to be made binding that could have political implications / ramifications regarding national sovereignty etc. However, a standard adopted by the ITU are called "recommendations". The recommendations carry a voluntary adoption by members states. The recommendations can though become directly or indirectly binding if it is incorporated into member states legislation where the legislation refers to a particular ITU recommendation. That would have a direct binding agreement. An indirect binding agreement could be where European legislation does not mention ITU recommendation per se but refers to CEPT or ETSI standards that become recorded that are in-turn derived from ITU recommendations. Were there to be an inextricable link requiring identical wording for CEPT/ESTI standard/ITU recommendation then that may amount to an indirect binding agreement with or to the ITU recommendation.

CSA - Site Survey Method 2/ITU - http://cellsiteanalysis.blogspot.co.uk/2014/07/csa-site-survey-method-2itu.html

As this discussion relates to CSA and identified recommendations listed here ( http://cellsiteanalysis.blogspot.co.uk/2014/07/csa-survey-method-2.html ) the detail below highlights the radio subject matter from the division ITU-R.

CSA - Site Survey Method 2/ITU

The International Telecommunications Union (ITU) combines standards making capability and also has regulatory functions specific to mobile telecommunications. Therefore the ITU goes beyond standards making that may not create obligations in contrast with issuing regulatory measures that clearly do create regulation for it members who are signatories to the Convention.

 

 

Three important functions of the ITU are:

1) Regulation and Recommendations

Where there is an international aspect involved the ITU has the responsibility to manage the radio-frequency spectrum. The ITU allocates frequency bands to certain applications that would make use of the RF bands (see list below) e.g. Radio/Television Broadcast; Microwave Links; Radio-Astronomy; Mobile Telephony. The technical means and the physical nature of the frequency bands form the basis of the allocations. That is to say where a frequency band can be used and doesn't interfere with prescribed wide-ranging criteria; and the technical means exists or can be developed that enables the physical radio medium to be manipulated for use. Member states are bound to this allocation prepared by the ITU but assigning the frequencies to users is within the power and autonomy for each member state. ITU decisions are, in principle, binding to its members. The relevance behind that statement is that the ITU origins began to facilitate and enable subsequent amendments of the agreements to be agreed upon made at the Interntaional Telegrahy Convention of 1865. The principle of being bound only comes into effect when member states ( http://www.itu.int/online/mm/scripts/mm.list?_search=ITUstates&_languageid=1 ) ratify the text of an evolving Convention. Changes to any text in the Convention thereafter also need to be ratified. A member state ( http://www.itu.int/en/membership/Documents/signatories-pp10.pdf compare with http://www.itu.int/en/membership/Documents/signatories-pp06.pdf ) failing to ratify new text is not bound by it thus watering down the effects of any binding powers over national sovereignty.

Essentially, whilst understanding ITU's can make decisions when it comes to Band allocations we know that ITU does not hold regulatory functions when it comes to standards. When dealing with interntional bodies like ITU the term standard, as we commonly understand it, is more profound at the ITU's level. This is because international technical issues are being addressed. Were the standards to be made binding that could have political implications / ramifications regarding national sovereignty etc. However, a standard adopted by the ITU are called "recommendations". The recommendations carry a voluntary adoption by members states. The recommendations can though become directly or indirectly binding if it is incorporated into member states legislation where the legislation refers to a particular ITU recommendation. That would have a direct binding agreement. An indirect binding agreement could be where European legislation does not mention ITU recommendation per se but refers to CEPT or ETSI standards that become recorded that are in-turn derived from ITU recommendations. Were there to be an inextricable link requiring identical wording for CEPT/ESTI standard/ITU recommendation then that may amount to an indirect binding agreement with or to the ITU recommendation. It may be accepted that *CEPT/ETSI might be in the driving seat but isn't this nothing more than that old adage 'What is in a name? That which we call a rose by any other name would smell as sweet...(Romeo and Juliet)?'

* At an appropriate juncture in another discussion CEPT/ETSI will also be discussed.

2) Recommendations as Standards

ITU draws up standards (recommendations) and provides them to the telecommunications community that are relevant for telecommunications between countries.  There are numerous diverse tasks requiring standards under the umbrella and responsibility of the ITU that are prepared and developed by numerous advisory groups that are split into divisions.

As this discussion relates to CSA and identified recommendations listed here ( http://cellsiteanalysis.blogspot.co.uk/2014/07/csa-survey-method-2.html ) the detail below highlights the radio subject matter from the division ITU-R.

Radio:
http://www.itu.int/en/ITU-R/Pages/default.aspx
-- http://www.itu.int/pub/R-REG
--- http://www.itu.int/en/membership/Documents/WRC-12.pdf
--- http://www.itu.int/en/membership/Documents/signatories-wrc07.pdf
---- http://www.itu.int/pub/R-REC

Individual Recommendations for allocated bands
BO - Satellite delivery
BR - Recording for production, archival and play-out; film for television
BS - Broadcasting service (sound)
BT - Broadcasting service (television)
F - Fixed service
M - Mobile, radiodetermination, amateur and related satellite services
http://www.itu.int/rec/R-REC-M/e
P - Radiowave propagation
http://www.itu.int/rec/R-REC-P/e
RA - Radio astronomy
RS - Remote sensing systems
S - Fixed-satellite service
SA - Space applications and meteorology
SF - Frequency sharing and coordination between fixed-satellite and fixed service systems
SM - Spectrum management
SNG - Satellite news gathering
TF - Time signals and frequency standards emissions
V - Vocabulary and related subjects

Telecommunications
http://www.itu.int/en/ITU-T/Pages/default.aspx

Development
http://www.itu.int/en/ITU-D/Pages/default.aspx

Whether a member state has signed up to using the standards (recommendations) or not predominantly it is inescapable the technical information in the standards provides useful advice to countries and industry concerning: interconnection, access, terminal device standards, reference standards etc. Certainly in the areas of GSM, TDMA, CDMA, WCDMA/UMTS-UTRA etc many of those standards specific to these technologies constantly refer to ITU recommendations, thus further underpinning how useful ITU recmmendations are to use as references and guidance for cell site analysis.

3) Forums and Facilitors

Agreements between members require a commonality in understanding as to the reliability of international services available; thus technical services and commercial agreements need to be acceptable to both parties. ITU offers forums that help facilitate international agreements.


Final thoughts

The intention of this mini-overview about ITU recommendations was to demonstrate the value they offer given that they have weight due to the requirement of reliability to assist commonality and provide useful guidance for member states for that purpose. When dealing with CSA we are usually not involved at the member state level but at the operational performance of radio communications and services at the local level of which the ITU recommendations can and do provide useful reference material for reports and useful knowledge, skill and experience when conducting in the field surveys.

(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later).  This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber. 

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference. 

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later).  This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber. 

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference. 

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

Examination Techniques7: Bluetooth Headset

Examination Techniques7: Bluetooth Headset
Examiners may find it useful to be reminded to obtain a copy the bluetooth headset (DUT) user guide prior to examination.  There are numerous reasons and some of these observations may prove fruitable.

1. A common headset feature that can be enabled for a particular headset is pairing with a primary device and a secondary device. This can mean a particular headset working with two mobile phones (at the same time???), or other devices such as laptops, PCs and PDAs.

2. As the identity of a headset is broadcast and then maybe associated to a target handset and/or another device (and not normally the other way around) understanding the identities in the bluetooth broadcast, is relevant, as is the bluetooth standard used by the headset can be equally as important.

3. Powering on a headset (DUT) can also reveal on certain makes/models the remaining battery level. Some headsets e.g. HM1200 require the examiner to press and HOLD the talk button and the volume button at the time forcing the headset to respond using a sequence of LED 5 flashes in a particular colour to identify the level (as a percentage) of charge remaining in the battery.

The above points are so often over looked in evidence, but can produce important facts or inferences about evidence that maybe relevant to a case.

An additional point, not connected with the user guide. If an examiner intends to perform a chip-off examination then a word of caution. The lettering/digits printed for chip identitification on some of the memory chips are so small an examiner may need a microscope (e.g. with software in order to display image results on a computer screen ).

GSM Radio Test Measurements

GSM Radio Test Measurements

Radio Test Measurements 1

The screen image (Radio Test Measurements 1) represents the output results of radio coverage detected at the receiver (mobile telephone) and represent a single static view of that coverage at one instance. During cell site analysis there will be many screens obtained but for the purposes of this discussion this single screen image will do the job. Firstly, the reader will need to comprehend, at least, an interpretation that can be given to the identifiers in the screen image above.

TOP ROW
1. Chan: this indicator refers to the Broadcast Control Channel number.
2. RxLv: this indicator refers to the received strength of signal at the test handset measured in deciBel milliwatts, (dBm), where dBm is the notion for the measurement of power of the received radio signal e.g -75dBm.
3. C1: this is a quality indicator (path loss criterion) and is used for cell selection and cell reselection. The parameters are determined from the signal strength, the minimum received power levels for initiation of signals between the mobile and network, the maximum transmit power for accessing the network and the power of the mobile phone itself.
4. C2: this is an indicator used only for cell reselection optimisation and identifies parameters to aid the mobile phone in its cell reselection process.

LEFT COLUMN
5. 'ACT' denotes the strongest, thus dominant, serving cell coverage at that location providing the best quality associated with the BCCH number (Chan). Meaning the mobile telephone has completed the cell selection/reselection processes for normal service and has chosen a cell from which it plans to receive all available services (known as "camping on a cell").
6. 'NC2-NC6' denotes other cells available in an area that may equally offer service, but that the mobile phone has not camped upon them. However, the mobile network is aware that the mobile phone has choices available to it. Displayed beside the NCs are the cells, identified by their respective Broadcast Control Channel (BCCH) numbers.

OBSERVATIONS

If it is accepted that Chan (Channel) identifies the BCCH frequencies of the radio coverage that the receiver (mobile telephone) has detected in the ether (or as Professor Clerk-Maxwell (1886) so put it "ethereal wind" when describing electro-magnetic energy in the air ) then the consideration of the RxLv (signal strength) and C1 and C2 can then be considered.

Signal Strength

The maximum received signal strength at the receiver is understood to be -40dBm for GSM (see e.g GSM 11.10 etc) and commonly -40dBm is said to be at or very close to the transmitter. However, when looking at Radio Test Measurement 1 for ACT and NC1 we see Chan 81 and 87 detected at the receiver with signal strength -27dBm and -37dBm respectively. This raises the suggestion of saturation by the transmitter's coverage determined at the receiver, where the receiver is located on the ground. So what could be the reason for this?

One suggestion might be the sensitivity at the receiver is out of spec. For this instance it would be wrong. When I conduct cell site analysis I have five (5) mobile telephones with me set in network engineering mode in order to account for a faulty handset and other anomolies and for the purposes to determine when several mobile telephones are switched ON and side by side whether they would detect and camp on the same cell (GSM terminology for radio coverage from a particular Mast) or other cells. For the radio test measurements in this case all five (5) were switched ON and all detected Chan 81 with signal strength ranging from -27dBm / -30dBm.

So if it is accepted that the mobile telephones collectively are not revealing false-positives, what other occurrence might cause this to occur. To determine this matter readers may wish to investigate by way of the GSM Standards to comprehend the standard for upper and lower limits of signal strength and review the requirements for BTS (Base Transceiver Station) transmission power etc.

It may equally be helpful to mention at this point that the signal strengths for NC2 (- 44dBm), NC3 (-67dBm), NC4 (-68dBm), NC5 (-69dBm) and NC6 (-70dBm) are very respectable levels of signal strength being that they are of high quality. When I refer to high quality I am of course referring to the term as used by the objective GSM Standard GSM03.22. It contains a useful reference when considering the quality of signal strength (RxLv) recorded in radio test measurements that a mobile network "shall be understood to be received with high quality signal if the signal level is above ‑85 dBm".

Moreover, GSM05.08 identfies the threshold RXLEV (same as RxLv) on the downlink for handover process to commence. Typical range -103 to -73 dBm. Thus NC2 to NC6 received signal strength at the receiver, being above -73dBm, could one conclude from that were the mobile telephone to have camped on either one of NC2 to NC6 the network is unlikely to handover the mobile to another cell in the list? My observation to any reader would be investigate the GSM Standards in order to consider all the elements in order to produce a more rounded opinion on this matter.

C1/C2

Cell selection and cell reselection are rather complex and convoluted matters to discuss in this short discussion thread. My observation to the reader would be to look at C1/C2 and see whether at first instance the threshold results are identical or different? What does it mean if they are not identical? Also look closely to see if cells are indicated as not available for selection or reselection - denoted in Radio Test Measurement 1 as -99. Why would a cell not be selected and/or reselected? Is it due to poor signal strength; the mobile telephone has calculated its own power capability as low; or is it detecting interference etc?

The above is just a fraction of the information that needs to be considered during and following cell site analysis and from the little I have extrapolated above means that a casual approach to radio test measurements and cell site analysis can result in erroneous conclusions being drawn.

For more on Cell Site Analysis, see Cell Site Analysis Part 1.

Seminar on GSM Standards Updated

Seminar on GSM Standards Updated

.
Updated for Seminar on GSM Standards (previous link):

http://trewmte.blogspot.com/2010/03/seminar-on-gsm-standards.html
.
It doesn't appear easy to take in the mobile telephone technical standards and that the numerous standards that are out there add an additional layer of perceived complexity.
.
To address this particular matter and demonstrate that dealing with technical standards is far easier than is imagined, as part of the presentation at the Seminar on GSM Standards, diagrams will be shown that reference common elements dealt with during examination. The diagrams are to demonstrate that it is far easier to address technical issues starting with a GSM perspective than it is jumping in at the deep end trying to understand 3G and work backwards.
.
One of the illustrations to be presented at the Seminar (shown below) relates to UICC with SIM and USIM environments. At the Seminar the illustration will be completed with identification of the relevant technical standards that should ease perceived complexity issues with UICC with SIM/USIM environment using this identification process.
.
.
UICC with SIM/USIM environments there are over 80 standards that can be referred to, but an examiner only need start with knowing approximately 20 technical standards at first instance and then expand into the other standards. Be sure of what I am saying here. You need to know the standards that exist and have a copy. Reading standards is not though a matter the Seminar will be addressing, but some helpful tips will be provided.
.
With GSM SIM there are over 40 standards that can be referred to, but knowing approximately 8 technical standards to start with can help kick start getting to the other standards and the realisation that dealing with technical standards need not be a daunting task at all, particularly as acquiring majority of the standards are free, as well.

Seminar on GSM Standards

Seminar on GSM Standards

.
It is clear that associated with mobile phone examination to obtain evidence that examiners must read the GSM Standards to understand the data evidence and whether the devices used acquire the data. The concern amongst examiners still exists because there are so many Standards current and historical and each providing variations on obtaining evidence and interpretation that it is a daunting task to know where to start. Would it be worth having a one-day seminar in the UK to go through the GSM Standards. Standards can change 2-3 times a year and presenting the information at a seminar would assist in getting across important facts and guide through how to get to the appropriate information in them. I wont be charging for my time to prepare the presentation and present the findings.
.
So that delegates can attend free of charge I am also looking for:
.
1) Sponsor (to pay) for the Seminar room/hall
2) A location must be near to a central train station (not requiring loads of train changes)
3) Sponsor (to pay) for the teas/coffee and sandwiches etc
4) Exhibitors at the Seminar
.
Can you send some feedback whether you are interested in attending or sponsoring.

UPDATE: Seminar on GSM Standards

Objectives

Upon completion of the seminar, the participant should:


• Understand the GSM Standards development and legal references

• Be aware of GSM system standards relevant to the examination or investigation

• Have an awareness of GSM interfaces to comprehend symbiotic relationships for call/data tracing

• To know where to look to attribute identity conventions

• Know availability of standards

There are five presentation modules:

1) Introduction

2) GSM System Standards

3) GSM Specified Interfaces (10 + 1)

4) Identifier Conventions

5) Access to Standards

Part 2 MOBILE FORENSICS AND EVIDENCE DEGREES

Part 2 MOBILE FORENSICS AND EVIDENCE DEGREES

I have received a question about the Degrees and whether there is sufficient educational material for them.

Q: Is there 10 years worth of educational material for a Degree?

A: Yes, I have been dealing with GSM for over 15 years and I have reference material and standards going back to 1991 and books that discuss GSM going back to 1988. There are, at mimimum, 100 academic books on GSM. If a starting point for the Degrees were needed then I would probably suggest 1992 as the best reference point to start.

With reference to GSM Standards, there are over a million pages of standards. For instance for GSM there are standards that originate from GSM Phase 1 (1991-1995), GSM Phase 2 (1995 onwards), GSM Phase 2+ (known as Releases R96, R97, R98 etc). To give an illustration how GSM is still going strong, the latest GSM 11.11 standard for SIM cards was published in June 2007.

The original discussion about Degrees can be found here:

http://trewmte.blogspot.com/2009/01/mobile-forensics-and-evidence-degrees.html

GSM Radio Test Measurements

GSM Radio Test Measurements

Radio Test Measurements 1

The screen image (Radio Test Measurements 1) represents the output results of radio coverage detected at the receiver (mobile telephone) and represent a single static view of that coverage at one instance. During cell site analysis there will be many screens obtained but for the purposes of this discussion this single screen image will do the job. Firstly, the reader will need to comprehend, at least, an interpretation that can be given to the identifiers in the screen image above.

TOP ROW
1. Chan: this indicator refers to the Broadcast Control Channel number.
2. RxLv: this indicator refers to the received strength of signal at the test handset measured in deciBel milliwatts, (dBm), where dBm is the notion for the measurement of power of the received radio signal e.g -75dBm.
3. C1: this is a quality indicator (path loss criterion) and is used for cell selection and cell reselection. The parameters are determined from the signal strength, the minimum received power levels for initiation of signals between the mobile and network, the maximum transmit power for accessing the network and the power of the mobile phone itself.
4. C2: this is an indicator used only for cell reselection optimisation and identifies parameters to aid the mobile phone in its cell reselection process.

LEFT COLUMN
5. 'ACT' denotes the strongest, thus dominant, serving cell coverage at that location providing the best quality associated with the BCCH number (Chan). Meaning the mobile telephone has completed the cell selection/reselection processes for normal service and has chosen a cell from which it plans to receive all available services (known as "camping on a cell").
6. 'NC2-NC6' denotes other cells available in an area that may equally offer service, but that the mobile phone has not camped upon them. However, the mobile network is aware that the mobile phone has choices available to it. Displayed beside the NCs are the cells, identified by their respective Broadcast Control Channel (BCCH) numbers.

OBSERVATIONS

If it is accepted that Chan (Channel) identifies the BCCH frequencies of the radio coverage that the receiver (mobile telephone) has detected in the ether (or as Professor Clerk-Maxwell (1886) so put it "ethereal wind" when describing electro-magnetic energy in the air ) then the consideration of the RxLv (signal strength) and C1 and C2 can then be considered.

Signal Strength

The maximum received signal strength at the receiver is understood to be -40dBm for GSM (see e.g GSM 11.10 etc) and commonly -40dBm is said to be at or very close to the transmitter. However, when looking at Radio Test Measurement 1 for ACT and NC1 we see Chan 81 and 87 detected at the receiver with signal strength -27dBm and -37dBm respectively. This raises the suggestion of saturation by the transmitter's coverage determined at the receiver, where the receiver is located on the ground. So what could be the reason for this?

One suggestion might be the sensitivity at the receiver is out of spec. For this instance it would be wrong. When I conduct cell site analysis I have five (5) mobile telephones with me set in network engineering mode in order to account for a faulty handset and other anomolies and for the purposes to determine when several mobile telephones are switched ON and side by side whether they would detect and camp on the same cell (GSM terminology for radio coverage from a particular Mast) or other cells. For the radio test measurements in this case all five (5) were switched ON and all detected Chan 81 with signal strength ranging from -27dBm / -30dBm.

So if it is accepted that the mobile telephones collectively are not revealing false-positives, what other occurrence might cause this to occur. To determine this matter readers may wish to investigate by way of the GSM Standards to comprehend the standard for upper and lower limits of signal strength and review the requirements for BTS (Base Transceiver Station) transmission power etc.

It may equally be helpful to mention at this point that the signal strengths for NC2 (- 44dBm), NC3 (-67dBm), NC4 (-68dBm), NC5 (-69dBm) and NC6 (-70dBm) are very respectable levels of signal strength being that they are of high quality. When I refer to high quality I am of course referring to the term as used by the objective GSM Standard GSM03.22. It contains a useful reference when considering the quality of signal strength (RxLv) recorded in radio test measurements that a mobile network "shall be understood to be received with high quality signal if the signal level is above ‑85 dBm".

Moreover, GSM05.08 identfies the threshold RXLEV (same as RxLv) on the downlink for handover process to commence. Typical range -103 to -73 dBm. Thus NC2 to NC6 received signal strength at the receiver, being above -73dBm, could one conclude from that were the mobile telephone to have camped on either one of NC2 to NC6 the network is unlikely to handover the mobile to another cell in the list? My observation to any reader would be investigate the GSM Standards in order to consider all the elements in order to produce a more rounded opinion on this matter.

C1/C2

Cell selection and cell reselection are rather complex and convoluted matters to discuss in this short discussion thread. My observation to the reader would be to look at C1/C2 and see whether at first instance the threshold results are identical or different? What does it mean if they are not identical? Also look closely to see if cells are indicated as not available for selection or reselection - denoted in Radio Test Measurement 1 as -99. Why would a cell not be selected and/or reselected? Is it due to poor signal strength; the mobile telephone has calculated its own power capability as low; or is it detecting interference etc?

The above is just a fraction of the information that needs to be considered during and following cell site analysis and from the little I have extrapolated above means that a casual approach to radio test measurements and cell site analysis can result in erroneous conclusions being drawn.

[Update: For more on Cell Site Analysis, see:

http://trewmte.blogspot.com/2006/11/cell-site-analysis-part-1.html ]

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com