Join MTEB Forum if your are in wireless / telecomms

Join MTEB Forum if your are in wireless / telecomms

.
If you work in forensics and/or examination devices, investigations or deal with evidence then the MTEB forum puts you in contact with other professionals when you need help with technical issues, technical discussions or generally want to stay up to date. Due to the make up of the forum members: experts, high level security, law enforcement and senior investigators requests to join are vetted.
.
.
Invitation to Join Mobile Telephone Examination Board
--------------------------------------------------------
The MTEB forum is dedicated to evidential standards, forensic examination and lawful interception dealing with mobile telephones/SIM/USIM/MMC, bluetooth, IrDA, USB, cell site analysis and mobile networks GSM, CDMA, 3G, 4G.
.
Link if you are NOT a LinkedIn member:

http://www.linkedin.com/groupInvitation?groupID=141739&sharedKey=35E59F107179

Link if you are a LinkedIn member:
http://www.linkedin.com/groupsDirectory?results=&sik=1216135556335

Join MTEB Forum if your are in wireless / telecomms

Join MTEB Forum if your are in wireless / telecomms

.
If you work in forensics and/or examination devices, investigations or deal with evidence then the MTEB forum puts you in contact with other professionals when you need help with technical issues, technical discussions or generally want to stay up to date. Due to the make up of the forum members: experts, high level security, law enforcement and senior investigators requests to join are vetted.
.
.
Invitation to Join Mobile Telephone Examination Board
--------------------------------------------------------
The MTEB forum is dedicated to evidential standards, forensic examination and lawful interception dealing with mobile telephones/SIM/USIM/MMC, bluetooth, IrDA, USB, cell site analysis and mobile networks GSM, CDMA, 3G, 4G.
.
Link if you are NOT a LinkedIn member:

http://www.linkedin.com/groupInvitation?groupID=141739&sharedKey=35E59F107179

Link if you are a LinkedIn member:
http://www.linkedin.com/groupsDirectory?results=&sik=1216135556335

SonyEricsson Hidden Evidence

SonyEricsson Hidden Evidence

.

I have discovered that it is possible when manually examining some SonyEricssons (such as "K" range etc) that after a user has deleted the Last Number Dialled (LND) from the call register that it is possible to recover the last ten numbers dialled on the handset using the 'menu keys'.

.

Here is the routine**:

.

- Select Menu

- Select Messages

- Select Write New

- Select Text Message: this displays the screen to commence entering text but no need to enter any text leave screen blank

- Select Continue

- Select Addr. book look-up (can also state Contacts look-up): the screen now displays phonebook contacts

- Select More

- Select "Unsaved numbers": displays dialled numbers for LND that had been deleted

.

There are some noteworthy points to consider:

.

a) the recovered numbers cannot have already been saved into either the Phonebook of the handset or *SIM;

b) there are no dates and times when numbers were dialled;

c) the unsaved recovered numbers appear in a random order.

.

*Checks were also made to ensure the recovered deleted numbers were not stored in 7F10 6F44 (EFLND) in SIM.

.

In recovering this information I found when conducting tests using handset readers *none* detected what may amount to important evidence. Most importantly, if produced in evidence (by one party against another) that failure to detect such evidence may suggest a systemic failure of practises/practices and/or procedures regarding the examination of this make and its various models.

.

I do not think that the above analogy could be suggested as fair as an overall statement of affairs because:

.

d) the latest "w" range of SonyEricsson does not appear to have this functionality as far as I can tell, but further research is needed;

e) The English user manual for the K600i and K800i makes no mention of such a function, which I am describing as 'recovery of data that may have evidential value arising from an undocumented functionality of a particular handset'. Thus, this matter needs to be considered on a case by case (model by model) approach.

.

Ultimately this finding underpins the principle that examiners cannot solely rely and transfer their responsibility onto so called 'forensic devices' to produce reliable findings, that human intervention is paramount when dealing with mobile telephone examination and evidence. My observations therefore do not rule out using forensic devices or software device readers that are used to recover data that are commonly served in evidence. The objective of raising this matter is one of awareness and that the skillsets required for manual examination must be retained.

.

**Note: I have been informed that the above routine doesn't work on the SonyEricsson K850.

GSM Mast Installations (Density)

GSM Mast Installations (Density)

.

When planning a cellular radio network there are many aspects to consider. The matter of radio technology and their frequencies (carriers) are but two examples. A relevance to be understood from these examples relate to what services may be obtained and delivered through these carriers? GSM for basic voice and text services and W-CDMA providing high data rates for video, gaming and conferencing etc.
.

Germane and relevant to obtaining radio services are the radio access technologies needed for that - Masts and Antennas. In radio engineering terms, antennas provide the physical technology to access the services obtained in the radio coverage by use of transmitters and receivers, commonly referred to by the acronym TRXs. The Masts provide the physical location for the siting of the TRXs. An important aspect of Mast installations is knowing the potential customer numbers that will use the services obtained from them. The calculation used for the number of customers and the number of calls that can be handled by one Mast's TRXs is calculated using the Erlang formulae - the number of calls and time length of each call in an hour.
.

Generally, though, to understand how Erlang can be used to determine the number of Masts and TRXs for an area let's just say there are 50,000 potential customers for a particular area. Let us also say to retain quality of service three sectors with 2 or 4 TRXs per sector, s222 or s444 respectively, are required. Let's also indicate that it is known that:

.

=======

.
1 TRX = 3 erlang, 2 TRXs = 5 erlang, 3 TRXs = 15 erlang, 4 TRXs = 20 erlang
.

The relevant TRXs selected for this Mast installation scenario are 2 TRXs and 4 TRXs.
.

Let:
.

50,000 x 0.02 erlang, where 0.02 erlang is used per customer = **1000 erlang
.

Each sector of an s444 may carry up to 20 erlang x 3 sectors = **60 erlang
.

**1000/**60 = 16.7
.

Therefore:
.

16.7 (17) Mast installations would be needed where a configuration of TRXs s444
.

or where
.

33.4 (35) Mast installations would be needed where a configuration of TRX s222
.

================

.

Remember the above is intended only to be illustrative so that it can be used to draw inferences about Masts installations and potential user numbers based upon the density of Masts in an area. An inference, such as, why a Mast further away than Masts sited closer to where a mobile station (MS) may be located routed the text message to the MS?

.

There are a large number of issues to be considered but let us take it two important issues to be considered are:

.

- Point-to-Area predictions for terrestrial services 30 MHz to 3000 MHz

- Point-to-Point short message service (SMS)

.

In relation to point-to-area it could be the height of buildings surrounding the MS may be a cause for a distant Mast routing a point-to-point SMS text message. Alternatively, it may be the routing of the point-to-point SMS text message from a distant Mast occurred because the MS, in the idle mode, was surrounded by Masts that were at call traffic capacity. Alternatively it could be because of a combination of both buildings and call traffic capacity.

.

Knowing matters like these are very useful when dealing cell site analysis and a reason why they are incorporated into the Core Skills Knowledge of the TrewMTE training courses:

.

GSM Cell Site Analysis Training Course

-------------------------------------------------------

.

Course One: GSM Core Skills Knowledge Course (CSA Part 1)

3-days training

.
Course Two: GSM Cell Site Analysis Course (CSA Part 2)

3-days training
.

Course Three: GSM Cell Site Analysis Course (CSA Part 3)

3-days training
.

3G Cell Site Analysis Training Course

----------------------------------------------------

Course One: 3G Core Skills Knowledge Course (CSA Part 1)

4-days training

.
Course Two: 3G Cell Site Analysis Course (CSA Part 2)

3-days training

.
Course Three: 3G Cell Site Analysis Course (CSA Part 3)

3-days training

.

SIM Card Training

-------------------------
GSM SIM Card Training Course

3-days training

.
USIM/UICC Card Training

------------------------------------

3G USIM/UICC Training Course

3-days training

.
GSM/3G Handset Examination Training

------------------------------------------------------

GSM/3G Mobile Telephone Training Course

4-days training

.
All courses now have credits towards the MTEB Mobile Telephone Evidence Diploma (MTEdip).

GSM MS List of States for the cell selection process

GSM MS List of States for the cell selection process

The GSM mobile station (MS) enters various states when switched on, but in the idle mode. Three such states are PLMN selection, cell selection and location registration that GSM standards described as a "set of states". The overall state of the mobile is thus a "composite of the states of the three processes". As TS 100 930 makes mention "In some cases, an event which causes a change of state in one process may trigger a change of state in another process, e.g., camping on a cell in a new registration area triggers an LR request." Below are those states relevant for MS cell selection but for a more detailed description of the behaviour of these states read GSM05.08.

C1 Normal Cell Selection ‑ This is the process of initial cell selection, searching all RF channels.
.
C2 Stored List Cell Selection ‑ This is the process of initial cell selection where BCCH carrier information (e.g. a BA list) for the selected PLMN is stored in the MS.
.
C3 Camped Normally ‑ This is where the MS is camped on a cell of the selected PLMN and may be able to make and receive calls. (Whether or not the MS can make and receive calls depends on the state within the location registration process). The MS monitors received level and the system information and checks whether cell reselection is needed.
.
C4 Normal Cell Reselection ‑ This is where the MS has determined that cell reselection is needed and an attempt is being made to reselect a new cell.
.
C5 Choose Cell ‑ This is where the MS has returned to idle mode from "connected mode" and is choosing a suitable cell to camp on.
.
C6 Any Cell Selection ‑ This is where the MS is unable to camp normally on any cell of the selected PLMN, or cannot obtain service because of certain responses to a location registration (LR) attempt. It is searching for a cell of any PLMN to camp on (so that emergency calls can be made).
.
C7 Camped on any Cell ‑ This is where the MS has camped on a cell irrespective of its PLMN identity, so that emergency calls can be made.
.
C8 Any Cell Reselection ‑ This is where the MS is attempting to reselect a cell, irrespective of PLMN identity.
.
C9 Choose Any Cell ‑ This is where the MS is returning to idle mode, after having entered "connected mode" from the "camped on any cell" state to make an emergency call. It is attempting to find an acceptable cell to camp on.

US Court recognises expectation text message privacy

US Court recognises expectation of text messages privacy

Violation the Fourth Amendment

Right to privacy under Art. I, Sec. 1 of the California Constitution

Interesting case, worth reading, as it relates to a Police Office for the Ontario Police Department and others (one said to be a SWAT Officer) who apparenly used work text messaging services to send personal messages unrelated to work.

U.S. 9th Circuit, June 18, 2008 -

Quon v. Arch Wireless Operating Co., No. 07-55282

Users of text-messaging services have a reasonable expectation of privacy in the contents of copies of messages the service provider stores on its network, the Ninth U.S. Circuit Court of Appeals held on June 18, 2008.

http://www.metnews.com/articles/2008/quon061908.htm

Looking back at the future of SIM in 2002

Looking back at the future of SIM in 2002

.

I have always thought looking to the future is important, but equally looking back at what we know or think might be happening, from an historical perspective, can help see what problems can occur in the future and also to note whether foreseeable problems have been addressed or not, over time.

.

I have selected a summary of issues discussed in training back in 2002, which are set out in the downloadable .pdf document "SIM - The Future as Viewed in 2002".

.

http://www.filebucket.net/files/2537_89xfv/SIM%20The%20Future%20As%20Viewed%20in%202002.pdf

.

For example, did you know or remember the slow down in SIM Card manufacturing in 2001? This is hard to believe when we think about the saturation levels of SIMs and handsets in the marketplace today.

.

What about SIM Application Toolkits, applets and the exciting development of Java Standard Edition for mobile phones (KJava and PJava)? Our concerns then were how these advancements were going to impact on mobile telephone and SIM examination. Remember at that time we saw problems and tried to anticipate how to combat problems, but we had no immediate solutions which invariable had to be produced in some instance "on-the-hoof", so to speak.

.

Cloning of SIM Cards had raised its head back in 1998 and devices were starting to appear on the market in 2000/01. The problems we faced then was knowing what to look for to deternmine whether a SIM was cloned or not? And then if the SIM was a clone what impact on evidence could/would it have?

.

What about SIM Cards with multiple IMSIs? Still an issue today as it was then in 2002. The problem being is that SIM readers do not have the capability to read more than one IMSI from a SIM Card at any one time. Consequently, invocation of an IMSI selection in EF-7F20 6F07 is not possible other than the SIM being placed in the handset and another IMSI being selected using the handset menu Network selection. Moreover, once that has been done the green button on the handset needs to be pushed and a location update (and an IMSI-attach) to the network is required, which cannot be performed in a faraday bag, radio dampening field or isolation chamber. The question arises when do you search for more than one IMSI recorded into a SIM? What cases warrant it? How many cases have been missed in the past where more than one IMSI resided in SIM but has gone undetected? Put simply, when should allocution take place?

.

There were a huge range of issues to be addressed then in early 2000, as there are now. When reading these brief discussion documents representing issues spoken about on my training courses, I hope they convey the message that plug and play (PnP) or universal plug and play (UPnP) systems used to extract and harvest data are simply not enough to satisfy the requirements for mobile telephone examination.

Looking back at the future of SIM in 2002

Looking back at the future of SIM in 2002

.

I have always thought looking to the future is important, but equally looking back at what we know or think might be happening, from an historical perspective, can help see what problems can occur in the future and also to note whether foreseeable problems have been addressed or not, over time.

.

I have selected a summary of issues discussed in training back in 2002, which are set out in the downloadable .pdf document "SIM - The Future as Viewed in 2002".

.

http://www.filebucket.net/files/2537_89xfv/SIM%20The%20Future%20As%20Viewed%20in%202002.pdf

.

For example, did you know or remember the slow down in SIM Card manufacturing in 2001? This is hard to believe when we think about the saturation levels of SIMs and handsets in the marketplace today.

.

What about SIM Application Toolkits, applets and the exciting development of Java Standard Edition for mobile phones (KJava and PJava)? Our concerns then were how these advancements were going to impact on mobile telephone and SIM examination. Remember at that time we saw problems and tried to anticipate how to combat problems, but we had no immediate solutions which invariable had to be produced in some instance "on-the-hoof", so to speak.

.

Cloning of SIM Cards had raised its head back in 1998 and devices were starting to appear on the market in 2000/01. The problems we faced then was knowing what to look for to deternmine whether a SIM was cloned or not? And then if the SIM was a clone what impact on evidence could/would it have?

.

What about SIM Cards with multiple IMSIs? Still an issue today as it was then in 2002. The problem being is that SIM readers do not have the capability to read more than one IMSI from a SIM Card at any one time. Consequently, invocation of an IMSI selection in EF-7F20 6F07 is not possible other than the SIM being placed in the handset and another IMSI being selected using the handset menu Network selection. Moreover, once that has been done the green button on the handset needs to be pushed and a location update (and an IMSI-attach) to the network is required, which cannot be performed in a faraday bag, radio dampening field or isolation chamber. The question arises when do you search for more than one IMSI recorded into a SIM? What cases warrant it? How many cases have been missed in the past where more than one IMSI resided in SIM but has gone undetected? Put simply, when should allocution take place?

.

There were a huge range of issues to be addressed then in early 2000, as there are now. When reading these brief discussion documents representing issues spoken about on my training courses, I hope they convey the message that plug and play (PnP) or universal plug and play (UPnP) systems used to extract and harvest data are simply not enough to satisfy the requirements for mobile telephone examination.

Starter Kit Mobile Phone CPD Training Barristers & Solicitors

Starter Kit Mobile Phone CPD Training Barristers & Solicitors

CPD training delivered in 2005 to Bar Council and Law Society Members at the Chambers of Mr Ferguson QC.

http://www.rfqc.co.uk/images/lecture_notes/CPD_training_Pt1.pdf

http://www.rfqc.co.uk/images/lecture_notes/CPD_Training_Pt2.pdf

Barristers - Surrey Chambers

Barristers - Surrey Chambers

One of the most overlooked parts of the law when dealing with crimnal and civil cases is that an expert, professional and client comes into contact with Barristers and Barristers' Chambers. That is quite shocking really as we meet with Barristers virtually on a daily basis for mobile telephone, computer, software and technology evidence in criminal cases and other commerical and civil matters.

Most professional people or companies one way or another require legal advice about professional matters for business and there are others who need assistance when initiating or facing civil or criminal proceedings. I have found a very good Set run by Mr James Tucker, Surrey Chambers of 1A Middle Temple Lane and Global House, Epsom http://www.surreychambers.org/. Not only does Surrey Chambers handle full range of commercial and civil matters but also prosecution, police and defence work. Really excellent Set.

USIM-D Images

Global Mobile Telephone Forensics and Evidence

Global Mobile Telephone Forensics and Evidence

It is interesting to note, and a subject matter I have been keenly watching since this webblog started, the importance of mobile telephone forensics and evidence is receiving around the globe. It is very easy to get submersed into one's own country's (UK) activities in this area and forget how other countries have significantly increased their activities in forensics and evidence too. Below is a sample of the global visitors to trewmte.blogspot in the last 20 days. Some countries will have more visitors than others, but in itself that does not dent the relevance of the global following interested in mobile telephone forensics and evidence.
.

Albania

Algeria
Aruba

Austria
Australia
Belarus
Belgium
Brazil

Bulgaria
Canada

Colombia
Cote D'ivoire
Denmark
Egypt

Estonia
Finland

France
Germany
Greece

Hungary
India

Indonesia
Iran, Islamic Republic Of
Ireland
Israel
Italy

Jamaica
Japan

Kenya
Korea, Republic Of
Kuwait
Macao
Malaysia

Mauritania
Mauritius
Morocco

Netherlands
New Zealand
Nigeria

Norway

Pakistan

Philippines
Poland
Portugal

Qatar
Romania

Russian Federation
Serbia And Montenegro

Sri Lanka

Saudi Arabia
Senegal
Serbia
Seychelles
Slovakia
South Africa
Sudan
Sweden

Thailand

Taiwan
Turkey

United Arab Emirates
United Kingdom
United States

Viet Nam

.

It would be good to get more feedback from law enforcement, universities, forensic examiners and experts from around the global who, rather than lurk in the background, may like to suggest the type of information you would like to see at this webblog. I have been dealing with a variety of mobile telephone examination and evidence issues (SIM/USIM, handset and cell site) for many years and hopefully topics you raise for discussion can be answered here. I should point out, as I have in the past at this webblog (http://trewmte.blogspot.com/2006/11/cell-site-analysis.html), the more I know, the more I need to know, therefore I don't know everything, but I am willing to try and find out.
.
Additionally, as there are no academic qualifications designed precisely for mobile telephone forensics and evidence - no PhD, MSc, BSc, CEng or anything else, this means qualifications in other subjects other than this subject matter tend to get used as a passport, suggesting qualification to deal with mobile telephone forensics and evidence. To overcome that difficulty I have prepared a Diploma in Mobile Telephone Evidence that may help those who seek recognition for the skillsets they have acquired. The Diploma is not a PhD, MSc etc but it is the good old fashioned Diploma where your knowledge and skillsest need to be demonstrated and will be tested.
.

If you would like to know more about the Diploma please send an email to me, Greg Smith. My email is shown at the top righthand side of this webblog page.

Mobile Calls on Aeroplanes

Mobile Calls on Aeroplanes

.

Back in November 2006 I wrote here at trewmte.blogspot a brief piece regarding "Switch On, Update, Lose Evidence":

.

http://trewmte.blogspot.com/2006/11/switch-on-update-lose-evidence.html

.

The discussion thread related to the same but more indepth discussion in "Switch On, Update, Lose Evidence" that could be found in MTE (Mobile Telephone Evidence) Newsletter - copy of the May 2006 Newsletter can be downloaded here:

.

http://www.filebucket.net/files/1579_ov3rx/Switch%20On%20Update%20Lose%20Evidence%20.pdf

.

The purpose of the indepth discussion related to how evidence can be corrupted and contaminated where poor Seizure, Handling and Examination Procedures had been adopted. The discussion illustrated where a user with a mobile telephone steps off an aeroplane and the attempt to discover where the mobile phone had been used.

.

I had been aware for some years before I wrote the MTE Newsletter article that Airline companies were looking at and developing ways passengers could use their mobile phones on planes. At the time of writing the article it wasn't too difficult to imagine that "Switch On, Update, Lose Evidence" implicitly gave a heads up as early as May 2006 to pay attention to formulating various procedures for mobile telephone evidence at airports. Importantly, the indepth discussion wasn't then and isn't now intended to suggest victimising everyone who gets off a plane holding a mobile phone as being involved with something suspicious.

.

It would appear that the MTE Newsletter advanced warning though was well placed, for it now appears March 20th 2008 that according to BBC online middle east news that "Dubai-based airline Emirates has become the first commercial airline to allow passengers to make mobile phone calls during flights. Emirates said the first permitted mobile phone call was made on a flight between Dubai and Casablanca.":

.

http://news.bbc.co.uk/1/hi/world/middle_east/7308041.stm

.

The technology behind Emirates being able to offer mobile calls on their flights originates from http://www.aeromobile.net using pico-cell radio access technology inflight:

.

"AeroMobile allows the use of GSM phones and can also support GPRS mobile data (for BlackBerry’s etc), Wi-Fi, CDMA and 3G/UMTS. AeroMobile comprises an aircraft cabin ‘pico cell’ system that interfaces with the aircraft’s air-to-ground communications systems, typically a satellite-based system. Once transmitted to the ground, signals are sent to AeroMobile’s ground system and on to the destination mobile phone and telecoms networks around the world."

.

Evidentially, this could be very interesting but the use of mobile phones on planes may seem problematical at first. But we will cope, we always do. The evidence from the device shouldn't be too much of a problem although issues of dead-man's trap should always be considered. Equally of interest will be usage, call records and cell site analysis. The latter, cell site analysis, should prove thought provoking, for is there sovereignty on an aeroplane? If there is not (and sovereighty is only applicable to airspace) and a call starts and terminates within the same airspace the sovereignty of which belongs to country XYZ then there may well be some jurisdictional issues to deal with. However, given the confines of the plane's cabin it may well be difficult for a user, if you follow my drift, to suggest that when the call was made s/he wasn't in the plane, but somewhere in the neighbourhood.

World's first cellphone 'telepathic' chat

World's first cellphone 'telepathic' chat

Looking something like out of a future robot cops technology tool kit and been described as a "Nerve-tapping neckband used in 'telepathic' chat", the World's first cellphone telepathic call has taken place (12th March 2008). This new technology basically takes the neurological signals from the brain translates them into a transmission signal which is then sent and decoded through a processor into either, speech, communicate to a computer or communicate to move a wheel chair are just some of the possibilities, and all from a band around the neck and the receiver at the other end.

When this technology fully matures, it only understand "150-words and phrases" at present, and can be made portable, there could be some amazing possibilities for applications in the various cellular technologies and two-way radio fields. Obviously, there appear uses for surveillance, which immediately springs to mind, but other areas as well in high-noise environments such as war zones, industrial sites and airplanes etc.

.

Have a look at the video on the New Scientist's website:

http://technology.newscientist.com/article/dn13449

.

Ambient's website URL below (and where the photo above comes from) is well worth visiting.

http://www.theaudeo.com/

Updating Mobile Telephone Seizure Procedure

Updating Mobile Telephone Seizure Procedure

Every year we work on a Mobile Telephone Seizure Procedure now in its 7-th year. It originated back in 2002 with personnel from law enforcement TSUs adding their wish list as to how mobile telephones should be seized and now the Procedure has input from front line officers as well. The document itself initially started out as a check sheet but this year it is going to have a makeover and more sections with a bit of editorial added.

There will be four sections to the overall document:

- Seizure Procedure

- Examination Procedure

- Investigation Techniques

- Analysing Data

The first section that we are working on is updating and improving the Procedure chart and I wondered whether you may like to have an input on the Seizure Procedure side. Perhaps you may think we have missed something that is worthy of mentioning. Everyone who contributes is mentioned in the credits and receives a full copy of the document when its complete, free. We already have requests for the Procedure from other countries, including the US.

Why would you want to help? If you are a front line officer, when you seize a mobile telephone you are infact the first person that is looked at when evidence gets corrupted or contaminated. Think of the chain of custody.. Imagine that you seize a mobile telephone still switched ON and data that is changed points to you because beyond that point the evidence is in the exhibit bag...until it reaches the Technical Support Unit (TSU), so the theory goes. In practice it can be very different. So if awareness how to avoid corrupting or contaminating evidence is proivded free... then surely that is a good thing. This principle is how the Mobile Telephone Seizure Procedure started back in 2002.

If you are interested and a serving front line police officer send an email to trewmte@googlemail.com and the relevant seizure Procedure chart shall be emailed to you for your comments.

Writing To Mobile Phones Under Examination

Writing To Mobile Phones Under Examination

There is always the debate as to what amounts to "forensic" processes and whether that can be left to human intervention to do that, whether a device alone can do that or whether it is the combination of human intervention and the device working together that can fulfil the objective? Perhaps germane and relevant to the above question is (1) knowing the potential of each to write to a mobile telephone should be understood first? (2) Whether, as a consequence of using the process, what data are or might be altered/lost? (3) To then decide whether "forensic" is an appropriate and applicable statement to label the process in the first place?

The discussion below starts to address Point 1. When examining mobile telephones there are at least five separate categories under which an examiner can or may write to a mobile telephone due to automated processes (indirect intervention) and/or direct human intervention. The categories and their contents below are not exhaustive, but have been used to illustrate some elements involved with Point 1.

A) Standard powering ON (direct human intervention) a mobile telephone can invoke automated processes (indirect intervention):

- wearleveling - can overwrite physical data

- updating files - writes new content to file

- setting off calendars alarms

B) Connecting data aquisition devices (direct human intervention) to mobile telephones to obtain stored data (indirect intervention):

- AT Command sets; to instruct mobile to identify its profile, fetch data (IMEI and SMS text messages etc). The example below illustrates a typcial communication of seeking the profle of a mobile telephone and the response received:-

SENDING frametype 0x00/length 0x08/8


41A54T2B+43C47G4DM49I0D AT+CGMI.


1 "AT+CGMI"


2 "Sony Ericsson"


3 "OK"


RECEIVED frametype 0x00/length 0x1F/31


41A54T2B+43C47G4DM49I0D 0D 0A 53S6Fo6En79y2045


AT+CGMI...Sony E


72r69i63c73s73s6Fo6En0D 0A 0D 0A 4FO4BK0D 0A


ricsson....OK..


Manufacturer info received


Sony Ericsson [Manufacturer: Sony Ericsson]





SENDING frametype 0x00/length 0x09/9


41A54T2B+43C53S43C53S3F?0D


AT+CSCS?.


1 "AT+CSCS?"


2 "+CSCS:


"GSM""


3 "OK"





SENDING frametype 0x00/length 0x0A/


10 41A54T2B+43C53S43C53S3D=3F?0D


AT+CSCS=?.


1 "AT+CSCS=?"


2 "+CSCS: ("GSM","IRA","8859-1","UTF-8","UCS2")"


3 "OK"





RECEIVED frametype 0x00/length 0x40/64


41A54T2B+43C53S43C53S3D=3F?0D 0D 0A


2B+43C53S43


AT+CSCS=?...+CSC


53S3A:20 28


(22"47G53S4DM22"2C,22"49I52R41A22"2C S:


("GSM","IRA",


22"3883883553992D-31122"2C,22"55U54T46F2D-38822


"8859-1","UTF-8"


2C,22"55U43C53S32222"29)0D 0A 0D 0A 4FO4BK0D 0A ,


"UCS2")....OK..

- Simply connecting a plug and cable to a mobile phone will write a nibble of data to the phone's memory in order to register the communications path along which data shall pass

C) By use of a communications protocol (direct human intervention) in order to extract and harvest data from a mobile telephone can write and overwrite data (indirect intervention):

- Bluetooth: to pair devices requires an identical code to be loaded by examiner on to the mobile telephone and can overwrite previously stored code

- Some Symbian mobile telephones require an agent to be loaded on to the phone in order for the examiners devices to communicate with the phone and then has to be deleted after examination

- Hex-dumping can require the use of flash boxes to flash clips (code) to flash memory that can overwrite blocks of data containing user data

D) To gain access to a mobile telephone may require the entry (direct human intervention)of security codes -

- Passwords/PINS

- Re-setting Passwords/PINs

E) Examiners using devices to select (direct human intervention) specific data can cause the operating system of a mobile telephone to handle data in a particular way (indirect intervention):

-some smart phones write to files in order to keep track of data and in some instances shift data around to accommodate the "fetch" request for certain data

Essentially the categories and content illustrated above merely sets the stage to highlight what an examiner faces when seeking to conduct data aquisition from a mobile telephone. Plug and play (PnP) devices cannot be used in isolation, that they need supervision (direct human intervention). Direct human intervention, with ot without a device, can have consequences too. Furthermore the mobile telephone under examination can as a consequence react to direct human intervention, as well as indirect intervention.

GSM Timers

GSM Timers

In the thread cell site anslysis call analysis <http://trewmte.blogspot.com/2006/12/cell-site-analysis-call-analysis.html> it highlighted the range of Cause Failures for mobile calls. The overview it provided can be quite helpful, but behind those Cause Failures there can be a range of Timers and some of them can be the reason a Cause Failure occurs (positive or negative outcome). For example we can see that timer T3216 (below) in essence relates to the failure of a Immediate Assignment Request, but the "root cause" of the failure can infact be due to SDCCH congestion or poor radio link, such as: interference, coverage restriction or radio path imbalance. Understanding the "Causes for the cessation or loss of mobile communication" requires more than knowing the Cause Code or Timer but all the "root cause" behind them.



The Timer table below provides a useful but not exhaustive list. It essential to keep monitoring the GSM and 3GPP standards. Finally, it is important to recognise that Timers have different durations dependent upon when the timer is applicable. For instance, for radio resources management the durations are often denoted in seconds and some timers are in milliseconds.



However, other timer durations (expiration) are used for internal operation for devices such as mobile telephone or SIM and can be in minutes and in some instances hours. An example of the latter can be the elementary file EFHPLMN (7F206F31) - see GSM11.11. The Timer is set in decimal-digit increments e.g. 01, 02, 03 and so on. Each increment represents a value of n-minutes which the standard GSM0211 refers to as 6 minutes, but commonly rapid updates can cause drain on the mobile telephone's battery it is understood that n-minutes can be 30-minutes. The maximum the timer can be set for is 8-hours. The timer value is network operator dependent, which means either timer method may be used.

Timers and counters for radio resource management

Timers on the mobile station side

T3122: This timer is used during random access, after the receipt of an IMMEDIATE ASSIGN REJECT message.Its value is given by the network in the IMMEDIATE ASSIGN REJECT message.



T3124: This timer is used in the seizure procedure during a hand-over, when the two cells are not synchronized.Its purpose is to detect the lack of answer from the network to the special signal. Its value is set to 675 ms if the channel type of the channel allocated in the HANDOVER COMMAND is an SDCCH (+ SACCH); otherwise its value is set to 320 ms.



T3126:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during an immediate assignment procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the immediate assignment procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T. The maximum value of this timer is 5 seconds.



T3128:This timer is started when the mobile station starts the uplink investigation procedure and the uplink is busy.It is stopped at receipt of the first UPLINK FREE message. At its expiry, the uplink investigation procedure is aborted. The value of this timer is set to 1 second.



T3130:This timer is started after sending the first UPLINK ACCESS message during a VGCS uplink access procedure.It is stopped at receipt of a VGCS ACCESS GRANT message.At its expiry, the uplink access procedure is aborted.The value of this timer is set to 5 seconds.



T3110:This timer is used to delay the channel deactivation after the receipt of a (full) CHANNEL RELEASE. Its purpose is to let some time for disconnection of the main signalling link. Its value is set to such that the DISC frame is sent twice in case of no answer from the network. (It should be chosen to obtain a good probability of normal termination (i.e. no time out of T3109) of the channel release procedure.)



T3134:This timer is used in the seizure procedure during an RR network commanded cell change order procedure. Its purpose is to detect the lack of answer from the network or the lack of availability of the target cell. Its value is set to 5 seconds.



T3142:The timer is used during packet access on CCCH, after the receipt of an IMMEDIATE ASSIGNMENT REJECT message. Its value is given by the network in the IMMEDIATE ASSIGNMENT REJECT message.



T3146:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during a packet access procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message during a packet access procedure, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the packet access procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T are defined in section 3.3.1.2. The maximum value of this timer is 5 seconds.



T3164:This timer is used during packet access using CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message. It is stopped at the transmission of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expire, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.



T3190:The timer is used during packet downlink assignment on CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message or of an PDCH ASSIGNMENT COMMAND message when in dedicated mode.It is stopped at the receipt of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expiry, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.



Timers on the network side

T3101:This timer is started when a channel is allocated with an IMMEDIATE ASSIGNMENT message. It is stopped when the MS has correctly seized the channels. Its value is network dependent. NOTE: It could be higher than the maximum time for a L2 establishment attempt.



T3103:This timer is started by the sending of a HANDOVER message and is normally stopped when the MS has correctly seized the new channel. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the HANDOVER COMMAND, plus the value of T3124, plus the maximum duration of an attempt to establish a data link in multiframe mode.)



T3105:This timer is used for the repetition of the PHYSICAL INFORMATION message during the hand-over procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.



T3107:This timer is started by the sending of an ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly seized the new channels. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the ASSIGNMENT COMMAND message plus twice the maximum duration of an attempt to establish a data link multiframe mode.



T3109:This timer is started when a lower layer failure is detected by the network, when it is not engaged in a RF procedure. It is also used in the channel release procedure. Its purpose is to release the channels in case of loss of communication. Its value is network dependent. NOTE: Its value should be large enough to ensure that the MS detects a radio link failure.



T3111:This timer is used to delay the channel deactivation after disconnection of the main signalling link. Its purpose is to let some time for possible repetition of the disconnection. Its value is equal to the value of T3110.



T3113:This timer is started when the network has sent a PAGING REQUEST message and is stopped when the network has received the PAGING RESPONSE message. Its value is network dependent. NOTE: The value could allow for repetitions of the Channel Request message and the requirements associated with T3101.



T3115:This timer is used for the repetition of the VGCS UPLINK GRANT message during the uplink access procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.



T3117:This timer is started by the sending of a PDCH ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly accessed the target TBF. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the PDCH ASSIGNMENT COMMAND message plus T3132 plus the maximum duration of an attempt to establish a data link in multiframe mode.



T3119:This timer is started by the sending of a RR-CELL CHANGE ORDER message and is normally stopped when the MS has correctly accessed the new cell. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent.NOTE: It could be higher than the maximum transmission time of the RR_CELL CHANGE ORDER, plus T3134, plus the maximum duration of an attempt to establish a data link in multiframe mode.



T3141:This timer is started when a temporary block flow is allocated with an IMMEDIATE ASSIGNMENT message during a packet access procedure. It is stopped when the mobile station has correctly seized the temporary block flow. Its value is network dependent.



More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

GSM Timers

GSM Timers

In the thread cell site anslysis call analysis <http://trewmte.blogspot.com/2006/12/cell-site-analysis-call-analysis.html; it highlighted the range of Cause Failures for mobile calls. The overview it provided can be quite helpful, but behind those Cause Failures there can be a range of Timers and some of them can be the reason a Cause Failure occurs (positive or negative outcome). For example we can see that timer T3216 (below) in essence relates to the failure of a Immediate Assignment Request, but the "root cause" of the failure can infact be due to SDCCH congestion or poor radio link, such as: interference, coverage restriction or radio path imbalance. Understanding the "Causes for the cessation or loss of mobile communication" requires more than knowing the Cause Code or Timer but all the "root cause" behind them.

The Timer table below provides a useful but not exhaustive list. It essential to keep monitoring the GSM and 3GPP standards. Finally, it is important to recognise that Timers have different durations dependent upon when the timer is applicable. For instance, for radio resources management the durations are often denoted in seconds and some timers are in milliseconds.

However, other timer durations (expiration) are used for internal operation for devices such as mobile telephone or SIM and can be in minutes and in some instances hours. An example of the latter can be the elementary file EFHPLMN (7F206F31) - see GSM11.11. The Timer is set in decimal-digit increments e.g. 01, 02, 03 and so on. Each increment represents a value of n-minutes which the standard GSM0211 refers to as 6 minutes, but commonly rapid updates can cause drain on the mobile telephone's battery it is understood that n-minutes can be 30-minutes. The maximum the timer can be set for is 8-hours. The timer value is network operator dependent, which means either timer method may be used.

Timers and counters for radio resource management

Timers on the mobile station side
T3122: This timer is used during random access, after the receipt of an IMMEDIATE ASSIGN REJECT message.Its value is given by the network in the IMMEDIATE ASSIGN REJECT message.

T3124: This timer is used in the seizure procedure during a hand-over, when the two cells are not synchronized.Its purpose is to detect the lack of answer from the network to the special signal. Its value is set to 675 ms if the channel type of the channel allocated in the HANDOVER COMMAND is an SDCCH (+ SACCH); otherwise its value is set to 320 ms.

T3126:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during an immediate assignment procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the immediate assignment procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T. The maximum value of this timer is 5 seconds.

T3128:This timer is started when the mobile station starts the uplink investigation procedure and the uplink is busy.It is stopped at receipt of the first UPLINK FREE message. At its expiry, the uplink investigation procedure is aborted. The value of this timer is set to 1 second.

T3130:This timer is started after sending the first UPLINK ACCESS message during a VGCS uplink access procedure.It is stopped at receipt of a VGCS ACCESS GRANT message.At its expiry, the uplink access procedure is aborted.The value of this timer is set to 5 seconds.

T3110:This timer is used to delay the channel deactivation after the receipt of a (full) CHANNEL RELEASE. Its purpose is to let some time for disconnection of the main signalling link. Its value is set to such that the DISC frame is sent twice in case of no answer from the network. (It should be chosen to obtain a good probability of normal termination (i.e. no time out of T3109) of the channel release procedure.)

T3134:This timer is used in the seizure procedure during an RR network commanded cell change order procedure. Its purpose is to detect the lack of answer from the network or the lack of availability of the target cell. Its value is set to 5 seconds.

T3142:The timer is used during packet access on CCCH, after the receipt of an IMMEDIATE ASSIGNMENT REJECT message. Its value is given by the network in the IMMEDIATE ASSIGNMENT REJECT message.

T3146:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during a packet access procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message during a packet access procedure, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the packet access procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T are defined in section 3.3.1.2. The maximum value of this timer is 5 seconds.

T3164:This timer is used during packet access using CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message. It is stopped at the transmission of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expire, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.

T3190:The timer is used during packet downlink assignment on CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message or of an PDCH ASSIGNMENT COMMAND message when in dedicated mode.It is stopped at the receipt of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expiry, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.

Timers on the network side
T3101:This timer is started when a channel is allocated with an IMMEDIATE ASSIGNMENT message. It is stopped when the MS has correctly seized the channels. Its value is network dependent. NOTE: It could be higher than the maximum time for a L2 establishment attempt.

T3103:This timer is started by the sending of a HANDOVER message and is normally stopped when the MS has correctly seized the new channel. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the HANDOVER COMMAND, plus the value of T3124, plus the maximum duration of an attempt to establish a data link in multiframe mode.)

T3105:This timer is used for the repetition of the PHYSICAL INFORMATION message during the hand-over procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.

T3107:This timer is started by the sending of an ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly seized the new channels. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the ASSIGNMENT COMMAND message plus twice the maximum duration of an attempt to establish a data link multiframe mode.

T3109:This timer is started when a lower layer failure is detected by the network, when it is not engaged in a RF procedure. It is also used in the channel release procedure. Its purpose is to release the channels in case of loss of communication. Its value is network dependent. NOTE: Its value should be large enough to ensure that the MS detects a radio link failure.

T3111:This timer is used to delay the channel deactivation after disconnection of the main signalling link. Its purpose is to let some time for possible repetition of the disconnection. Its value is equal to the value of T3110.

T3113:This timer is started when the network has sent a PAGING REQUEST message and is stopped when the network has received the PAGING RESPONSE message. Its value is network dependent. NOTE: The value could allow for repetitions of the Channel Request message and the requirements associated with T3101.

T3115:This timer is used for the repetition of the VGCS UPLINK GRANT message during the uplink access procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.

T3117:This timer is started by the sending of a PDCH ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly accessed the target TBF. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the PDCH ASSIGNMENT COMMAND message plus T3132 plus the maximum duration of an attempt to establish a data link in multiframe mode.

T3119:This timer is started by the sending of a RR-CELL CHANGE ORDER message and is normally stopped when the MS has correctly accessed the new cell. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent.NOTE: It could be higher than the maximum transmission time of the RR_CELL CHANGE ORDER, plus T3134, plus the maximum duration of an attempt to establish a data link in multiframe mode.

T3141:This timer is started when a temporary block flow is allocated with an IMMEDIATE ASSIGNMENT message during a packet access procedure. It is stopped when the mobile station has correctly seized the temporary block flow. Its value is network dependent.

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

3G USIM Phonebook

3G USIM Phonebook

Those familiar with the 3G USIM Phonebook (contacts) will know the relevance of examining this data area within USIM, thus the significance of Quantaq's announcement below. If, of course, you do not understand the relevance then coming on my USIM and USIM-D training course will open up the Phonebook (contacts) evidence and other important technical and evidential aspects of USIM, and yes you get trained in USIM-Detective, too. Send your request for training to trewmte [at] googlemail [dot] com or visit the training page at Quantaq's website.

Quantaq (www.quantaq.com) has introduced a major new release of USIM Detective (V2.0.0) - this version has support for the 3G USIM phonebook that is now appearing in many high end handsets.

3G USIM Phonebook

3G USIM Phonebook

Those familiar with the 3G USIM Phonebook (contacts) will know the relevance of examining this data area within USIM, thus the significance of Quantaq's announcement below. If, of course, you do not understand the relevance then coming on my USIM and USIM-D training course will open up the Phonebook (contacts) evidence and other important technical and evidential aspects of USIM, and yes you get trained in USIM-Detective, too. Send your request for training to trewmte [at] googlemail [dot] com or visit the training page at Quantaq's website.

Quantaq (www.quantaq.com) has introduced a major new release of USIM Detective (V2.0.0) - this version has support for the 3G USIM phonebook that is now appearing in many high end handsets.