iOS 4.3.3 deletion of Location Cache

iOS 4.3.3 deletion of Location Cache

Apple responded in April 2011 to concerns in the marketplace about location data that enables a user to be tracked without their knowledge or without knowing such a mechanism existed in the iPhone:

http://www.apple.com/pr/library/2011/04/27location_qa.html

By 3rd May 2011 an early fix was suggested would be available pending the outcome of Beta tests. That the fix would deal with location backups to iTunes when Location Services was switched OFF.  

On the 5th May the promised iOS patch to resolve the iPhone location tracking went live and reduced the size of the cache of information that had been backed up. Noticeable the cache file is now considerable smaller, however the size of the update to do that was over 650 megabytes.

Loss of evidence in the cache is one observation and another is with Location Services switched OFF on the handset this may impact on historical and current Cell Site Analysis investigations.

Answer To Reset (ATR)

Answer To Reset (ATR)

It is an endless investigation when dealing with SIM/USIM. The intention of this discussion is to highlight discoveries that you may not be aware. In this instance ATR is the first data read from every SIM/USIM and can provide potentially useful information to an investigation or when making analysis about end-to-end (SIM to Network) mobile telephone evidence.  

What might be interpreted from first eight bytes of an ATR recovered? From research, this is an interpretation of the ATR from a particular manufacturer's GSM SIM:

[B1][B2][B3][B4][B5][B6][B7][B8]
3B....34...11...00...6B...C?..16...0?

Byte 6 - options
3B 34 11 00 6B C2 16 0? normal SIM+OTA
3B 34 11 00 6B C3 16 0? SIM-Toolkit (STK) SIM

Byte 7
16 EEPROM size (16K)

Byte 8 - options
3B 34 11 00 6B C? 16 01 GSM security algorithm
3B 34 11 00 6B C? 16 02
3B 34 11 00 6B C? 16 03
3B 34 11 00 6B C? 16 0A

  

As interpretation of the ATR can be possible, do all SIM ATRs follow the same identification process or when personalised uniquely characterise the ATR to instruct the handset/network with similar information about the SIM's technical profiling but identified at different byte locations in the ATR string?

Evolving Cell Site Analysis (CSA)

Evolving Cell Site Analysis (CSA)

In 23 years of dealing with a range of cellular radio systems TACS, GSM and WCDMA and, lately, a little of LTE, in addition to NFC work, generates a measured confidence in dealing with change when it occurs.

The word 'Re-farming' of 900 MHz , largely a play word, the core of which is based upon re-allocation of spectrum from one technology and service to another (eg GSM TDMA to 3G WCDMA), and local inter-operator roaming (Orange and T-Mobile) are two such changes to which CSA is exposed. These changes are, though, nothing more than evolution in a innovation driven and commercially challenging market place. Knowledge doesn't simply disappear overnight because these changes have occurred.

Operator and spectrum imposed changes appear to have generated perhaps understandable concerns, but the premise of these concerns might actually be based upon misconceptions about how those changes impact on cell site analysis. Concerns, such as, a no-can do approach; a patch fix is needed; the notion that is all you are going to get; to a loss of evidence with the introduction of changes, are a variety I have heard. The introduction of Everything Everywhere is another good example in point. Many of the constraints currently being purveyed in the marketplace would require ignoring a considerable body of information.

Photo courtesy of www.dailymail.co.uk article-0-001097AB00000258-251_468x315.jpg

Don't Panic Mr Mainwaring!! Simply running out with a piece of test equipment and having a few shots at a target, chatting with several people or referring to comments on the web really isn't appropriate qualification for the matter under scrutiny when one is not fully certain of (figuratively speaking) the enemy.

Cell site analysis doesn't suffer from evidential menigitis just because changes take place, as there are a huge range of factors and information that need to be considered first when making a diagnosis of the matter in order to determine a prognosis.

Aggregated SIM

Aggregated SIM

Interesting news story out of  Reuters that has been posted by many website that states that Apple has proposed a standardized SIM card smaller than those it currently uses in the iPhone and iPAD in order to be able to produce thinner devices, an Orange executive told Reuters on Tuesday. The news story also mentions Apple having gone along the Standards path and approached ETSI (European Telecommunications Standards Institute) and a hint that something could be seen as early as next year.

http://www.reuters.com/article/2011/05/17/us-summit-orange-apple-idUSTRE74G4WY20110517

This is SIM card developmental news and fascinating to watch as SIM and the microprocessor electronic card (ICC/UICC) that it uses takes further steps on its evolutionary journey.  We already know some of the form factors for ICC/UICC:

The integrated and non-integrated examples


A closer look at an integrated example


When SIM (subscriber identity module) cards were introduced for GSM (global systems for mobile) communication devices (handset/terminal devices) ETSI standardised the ID-1 format which was an ISO-size card as defined in the international standard ISO-7816 and commonly referred to as a 'credit card' size. A plug-in size (the size of a 'postage stamp') was also introduced and these designs are commonly seen in the standard GSM11.11. Distinctively, the shape, size and operational performance of the card means that the card, called an ICC- integrated circuit card (or Universal ICC following the introduction of 3G-WCDMA cellular radio) - should be distinguished from the SIM module, which is itself a programmable area on the card.   However, a further card size emerged and was defined in the 2004-03 ETSI standard TS 102.221 as "mini-UICC". It should be noted that where I have mentioned GSM11.11 this standard refers to the use of SIM cards with GSM technology and services. The lineage of GSM SIM and its standards are linked to ETSI standards including TS 102.221 and, of course, ISO standards. A similar path can be trod when dealing with U-ICC/U-SIM.

As for Apple's suggested development, what we don't know at this stage is what the aggregated SIM (but I think I might want to read that as form factor and size) will look like or its content for that matter. We can only guess at this stage.

Forensic Mobile Examination Posts

Forensic Mobile Examination Posts

Latest posts at: http://forensicmobex.blogspot.com/

Nokia s40 Forensic Analysis - Call Release
Deleted Text Messages 3GS iPhones
Blackberry Forensic Analysis

The criteria for authorised access to cell site analysis blog is either:

a) Law Enforcement
b) Security Services (MI5, MI6, CID, SB, FBI....)
b1) Security Specialists - a proveable record in security for
networks, digital forensics, handsets, SIM, CDR etc
c) Authorised individuals (people whom I know)

Cell Site Analysis Posts

Cell Site Analysis Posts

Latest posts at: http://cellsiteanalysis.blogspot.com/

Requesting Cell Site Data
Blackberry Forensic Analysis
GSM Radio DNA Bracelet - RACH
GSM Radio DNA Bracelet

The criteria for authorised access to cell site analysis blog is either:

a) Law Enforcement
b) Security Services (MI5, MI6, CID, SB, FBI....)
b1) Security Specialists - a proveable record in security for
networks, digital forensics, handsets, SIM, CDR etc
c) Authorised individuals (people whom I know)

Requesting Cell Site Data

Requesting Cell Site Data

Engaging with defence solicitors or law enforcement with respect to seeking cell site evidence can be a tricky business. Invariably the request for data is largely governed by the type of case and the instruction of work. Problematical with the latter point is there maybe the notion that the person instructing actually has sufficient technical knowledge and understanding to comprehend the technical details to be analysed and the types of detail the CSA expert will need.

A mistake in common practice that I have noted with examiners and experts is to assume the CDR contains the complete cell site details, and clearly that cannot be the case. The structure and content of CDR vis-a-vis TAP files both are different and have different purposes, but ae not generated for the purposes to include cell site details. I have seen some company websites identifying themselves as experts and suggesting cell site details are found in extended CDRs. I do not agree as cell site details have absolutely nothing to do with a generated per call CDR or indeed TAP file for that matter. There are a minimal references to cell sites by way of cell ID (start/end) and a few other bits and pieces, but nothing more would be generated by the mobile phone, radio network, the switch or data capture machine for inclusion into a CDR/TAP file.

Another matter I have noted, when dealing with expert and examiner cell site reports and those conducting radio test measurements is this vague suggestion allude to an implicit fact that because the examiner took GPS measurements when conducting tests this somehow creates a fact that the cellular radio coverage is corroborated by this or the movements of the handset user is somehow tracked this way. There appears on the face of it at least a confusion between GPS and the mobile network. Neither GSM or WCDMA propagate GPS signals, merely they take data output in the form of a packet of data from a GPS module/unit and forward that packet through the device/network to the terminal that will somehow make use of the data. If I need support for that fact then I find it at first instance in the radio frequencies adopted for GSM and WCDMA and from which all else will follow when dealing with cellular radio propagation and communications.

So what are the data field elements that the examiner/expert might seek at first instance. Clearly there needs to be corroboration of a GSM originated/terminated and start and/or end of a mobile communication. The list below is not data (email/internet/download etc) communication related.

----------------------------------------
Date ?
Time ?
Calling party ?
Called party ?
Type of call ?
Duration ?
Registration (ringing time before answer) ?


Mast location Details for start of call
---------------------------------------
[Start of call] Site ID number?
[Start of call] Site Name?
[Start of call] Site Address?
[Start of call] Site Post code?
[Start of call] Type of transmission 3G WCMDA site or GSM site?
[Start of call] Frequency Range?
[Start of call] Macrocell or Microcell?
[Start of call] Height of Antennas?
[Start of call] Is this a omni-directional site?
[Start of call] How many sectors at site (e.g. 3, 6 etc)?
[Start of call] Easting and Northing?
[Start of call] Longitude and Latitude?
[Start of call] Cell ID (hex)?
[Start of call] Cell ID (dec)?
[Start of call] Cell ID (last digit as sector)?
[Start of call] Broadcast Control Channel (BCCH) number?
[Start of call] Azimuth (bearing of coverage)?


Mast location Details for end of call
-------------------------------------
[End of call] Site ID number?
[End of call] Site Name?
[End of call] Site Address?
[End of call] Site Post code?
[End of call] Type of transmission 3G WCMDA site or GSM site?
[End of call] Frequency Range?
[End of call] Macrocell or Microcell?
[End of call] Height of Antennas?
[End of call] Is this a omni-directional site?
[End of call] How many sectors at site (e.g. 3, 6 etc)?
[End of call] Easting and Northing?
[End of call] Longitude and Latitude?
[End of call] Cell ID (hex)?
[End of call] Cell ID (dec)?
[End of call] Cell ID (last digit as sector)?
[End of call] Broadcast Control Channel (BCCH) number?
[End of call] Azimuth (bearing of coverage)?

The cell site details should relate at minimum to the material time of the mobile communications and at least  upto the date the request for  information is being made in order to comprehend any changes at the Masts for the Mast that handled the start of the call and the Mast that handled the end of the call.

Request notification of any Mast alterations
-----------------------------------------
[Any change to Mast] Decommissioned?
[Any change to Mast] Height of Antenna altered?
[Any change to Mast] Azimuth Bearing of coverage?
[Any change to Mast] Mechanical or electrical tilt changes and to what degree?
[Any change to Mast] Licenced Power or Transmission power?
[Any change to Mast] Type of transmission from 2G GSM to 3G WCDMA or vice versa?

It is quite possible to seek considerably more about the arrangements at each Mast, but that often means dealing with each operator's specific matters on a case by case basis.   These elements are not included here.

Blackberry Forensic Analysis

GSM Radio DNA Bracelet - RACH

GSM Radio DNA Bracelet - RACH (Random Access Channel)

The logical channels set out http://cellsiteanalysis.blogspot.com/2011/01/gsm-radio-dna-bracelet.html each provide useful information that is of use to cell site analysis (CSA). A common misunderstanding that arises with CSA is it has been used in evidence in such away that only a minutiae of information is considered. This in turn has led to some believing CSA can be defined by a limited selection of elements. The world of CSA is far, far larger in rich content than those limited elements. An examiner only comes to know about the rich content having first applied him/herself to learning the symbiotic, co-partnership between the science & technology and examination & forensic procedure leading to evidence & opinion.

For instance let us accept that RACH is a GSM uplink common control channel. In that little nugget of information given by the statement there is firstly the science and technology. The technology is Global System for Mobile (communications) a digital cellular radio system. The adopted GSM system manipulates (modulates) the physical radio signals such that physical signals whilst analogue in nature when manipulated hold a secret inside that is revealed when de-modulated revealing the important data (digital). Moreover, the statement uplink is relevant to note, as is common control channel (CCCH). There are four nominated logical control channel assigned connected with CCCH - Paging Channel (PCH), Access Grant Channel (AGCH), Notification Channel (NCH) and, of course, RACH.  The term 'common' needs clarification, too, because it identifies that the channels are common to all users (mobile users) in a geographical radio area via their handsets. 'Uplink' defines the direction to which the control channel data are transmitted.

In combination, the examination of transmitted data becomes highly significant for it represent an action by the user's mobile phone creating the 'first' step in radio DNA evidence. A Layer 3 trace (example below), and when we say Layer 3 we are taking about RR (radio resources), identifies the access request RACH message sent to the network and a response from the network to it. The example below has been extrapolited (thus goes beyond) what would normally be seen from the raw data. The network and handset are programmed to understand each other and do not needs man's convoluted and verbose explanations but should the machinery, so to speak, need such explanation, god help us, for access to the GSM radio network would probably take three months just to camp on the network without using further resources.

Equally, for cell site analysis we need to know what information can be gleaned from RACH. The image below identifies a screen from an Ericsson handset with TEMS pocket (a radio diagnostic tool) in active mode. I will deal with the paging details in another discussion thread. 

We first see the string '0 1 4 1 0E'. The point to note is that it only contains basic GSM info and not GPRS. Had it included GPRS info the string would consist of seven different separate elements instead of five. So how do we understand the order in which the data appears?  

First element '0':  refers to Cell Barred (0: No, 1: Yes)
Second element '1': refers to Call Re-establishment (0: Allowed, 1: Not allowed)
Third element '4': refers to Max number of retransmissions (1, 2, 4, 7)
Fourth element '1': refers to Number of RACH bursts sent for the last connection (1–7)
Fifth element '0E': refers to Establishment Cause/Random: Reference used in the latest RACH burst (00–FF)

The fifth element is, as referred to above, the 'first' step in radio DNA evidence. As this is generated by the user's handset it makes it interesting as it shows the examiner has understanding of seeking out evidence from the science and technology under test and that the data should be obtained using forensic methodology to secure unaltered data. Importantly, it illustrates to the examiner how to start to establish a link within the chain of data created by a mobile phone from when it is first switched ON, when using resources, until it it is switched OFF.  

The actually RACH access request generated is no more than 8-bits in length. The GSM standard TS04.08 defines the message content format as seen below:

How to interpret the access request message content for establishment cause can be found in TS04.08:

And when the mobile is answering to paging for radio resources connection establishment.

There is so much detail associated with RACH it is possible to write a book solely dealing with this single subject. I do not have the time or luxury to put all that detail here, but to provide a flavour to you that the radio DNA evidence in the bracelet contains a gold mine of evidential information that is largely and randomly ignored and apparently seen by some as not being relevant. I wonder with the little I have mentioned above whether you would think the same?

In the next RACH discussion I shall open up to you more and give insight into RACH and some evidential possibilities.

Sir Henry Cooper World Boxing Legend Has Died

Sir Henry Cooper World Boxing Legend Has Died

Sir Henry Cooper, a boxing legend to British boxing fans and boxing fans all over the world, has died. A great advocate and ambassador for boxing, to me Sir Henry was a Gentleman Boxer, an advocate for fair play and clean boxing in the sport. A great man of his time, a World class boxer. Respects and commiserations to his family.  

Photo courtesy of::
http://www.solarnavigator.net/sport/sport_images/henry_cooper.jpg

Daily Telegraph report:
http://www.telegraph.co.uk/sport/othersports/boxingandmma/8487084/Sir-Henry-Cooper-the-former-boxer-dies-aged-76.html

Faraday containers found unsafe

Faraday containers found unsafe

A report that focuses on the results, following conducted practical tests, on the reliability of mobile phone shielding devices (eg 'faraday' containers) found the device shielding failed in a number of instances that the author of the report placed under test and did not prevent RF signalling reaching the test mobile phones inside the containers, the findings in this recently published paper suggests:

https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/2010-27.pdf

The implications might require that an 'impact assessment' on evidence that is seized and placed in shielding devices at the scene of a crime and transported from Police Station to Police Station etc may need to be 'reconducted'. The findings in the report raise the notion whether published Guidelines advocating the use of shielding devices may now need to identify exactly the tests and research considered prior to adopting published policy on the use of shielding devices, although it is unclear at present whether that will happen at all.

Whilst the report dealt primarily with external factors (radio communications) and how the shielding devices  coped with them, it also includes some other influences shielding devices can have on touch screen mobile phones, for example.

There have previously been mixed reviews about shielding devices and their impact on seized evidence that is left switched ON within shielding containers:

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3914
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4277&postdays=0&postorder=asc&start=0 

If a mobile phone is already OFF, or is switched OFF at the point of seizure, then such shielding devices shouldn't be necessary at that particular juncture.

Easter Remembered

Easter Remembered

I thought I would post this as in the news this Easter period it has been suggested Christian beliefs are declining. This may be so, or it might not be so. Britain has had to absurb some huge changes of the last two decades, cultural and otherwise, with little or no time to stop and pores for thought and to understand what those changes actually meant and mean.

I am not so sure that Christian belief is declining or any other faith-belief for that matter. Merely people are walking away from confrontation where religious beliefs, that are deeply personal to each of us, are used daily as political or scaremongering ends of some sort or other. 

This poem was given to me at Easter when I was sixteen. I enjoy the poem as I like the connotation the name 'Abou Ben Adams' brings. For it seems not to matter if the person is black, white, brown, yellow..., christian, muslim or jew...., and so on. All these matters are set aside to express a personal wish, a desire, a belief. As Easter is the time to remember in the Christian calender this poem reflects many of the doctrines set out in the tenets of the Christian faith. It may also be reflected in the tenets of many other faith-beliefs, too.  


============================
Abou Ben Adam, may his tribe increase,
Awoke one night from a sweet dream of peace,
And saw within the moonlight in his room,
Painting it rich, like a lilly in bloom
An Angel wirting in a book of gold.
Exceeding peace had made Ben Adam bold,
And to the presence in the room he asked,
"What writeth thou", the vision raid its head,
 And with a look made of all sweet accord, replied,
"The names of those who love the Lord".
"And is mine one" said Abou?
"Ney no so replied" the Angel.
Abou spoke more low, but cheerily still and said,
"I pray thee then, write me as one who loves his fellow men".
The Angel wrote and vanished.
The next night it came again with a great wakening light
And showed teh names of those whom love of God had blessed
And lo, Ben Adams name led all the rest.
=============================

http://trewmte.blogspot.com/2009/02/god-is-wireless-scientist-too.html

I trust everyone had a great St George's Day, yesterday, 23rd April 2011
http://trewmte.blogspot.com/2010/04/st-georges-day-23rd-april.html

MTEB - International Mobile Forensics Conference 2011

MTEB - International Mobile Forensics Conference 2011

2011 International Conference presentations and workshops:

- Session 1 The Impact of Mobile Cybercrime

- Session 2 iPhone, Android, Microkia, Blackberry et al

- Session 3 New crimes require new mobile examination methods

- Session 4 Forensic Mobile SSD FTL & Chip Off

- Session 5 Imaging and Data Carving

- Session 6 Indepth with SIM & USIM Examination

- Session 7 Achieving Laboratory Accreditation

- Session 8 Forensic Tools - Performance & Evaluation
- Session 9 Security and deleted data on mobile devices 
- Session 10 Hacks, Cracks and Whacks
- Session 11 Cell Site Analysis
- Session 12 Forensic Mobile Computing Laptops to Pads & Tablets 
- Session 13 Employment and Market Trends
- Session 14 GSM/WCDMA/GPS Jammers and examination methodology
- Session 15 Call Record Analysis
- Session 16 Student Presentation 
- Session 17 Mobile Phone Programming
- Session 18 Wireless technology comparisons
- Session 19 Handset Examination
- Session 20 Wireless technology comparisons
- Session 21 An expert's view of mobile phone evidence
- Session 22 Retained Data: Handover Interface for the request and delivery of retained data 
- Session 23 Standards Review
- Session 24 UK perspective - the future of Law Enforcement's involvement in mobile forensics
- Session 25 A Practitioner's view of moble phone examination

There will be a good selection of speakers and presentations. Remember this is a learning conference and due to timings - speakers -v- workshops - the streams occur in some instances at the same time. It would be within your interest to book at least two people to attend the conference. One to listen to the Conference Speakers and the other to attend training workshops. Session presentations or workshops maybe subject to change. 

Passcode locked iPhone may still make calls

Passcode locked iPhone may still make calls

We have known for awhile that many users can answer calls on their bluetooth earpiece even though they have the phone keypad lock set to ON. Moreover, handsets like Samsung GT-S5600 with keypad lock ON that have a synchronised bluetooth earpiece can call the last number received (LNR) or the number of the last received text message by simply pushing the key on the earpiece. Even if the user isn't using bluetooth earpiece, many handsets (eg Nokia 6303) with a locked keypad can still allow the user to answer a ringing phone.  

If you have a passcode lock on your iPhone it is possible, where the owner haven't yet changed the voice default security setting from when it was purchased, to still be able to make phone calls or worst still it can allow a thief (if your iPhone is stolen) to make calls with the handset. By switching the default setting to OFF can help prevent this occur. 

The image courtesy of The Register

The passcode lock vulnerability has been reaffirmed in a recent article published at the technology website, The Register: http://www.theregister.co.uk/2011/03/04/iphone_voice_dialling/.

Cell Phone Use May Have Effect On Brain Activity

Cell Phone Use May Have Effect On Brain Activity, But Health Consequences Unknown

February 28, 2011

In a preliminary study, researchers found that 50-minute cell phone use was associated with increased brain glucose metabolism (a marker of brain activity) in the region closest to the phone antenna, but the finding is of unknown clinical significance, according to a study in the February 23 issue of JAMA.

"The dramatic worldwide increase in use of cellular telephones has prompted concerns regarding potential harmful effects of exposure to radiofrequency-modulated electromagnetic fields (RF-EMFs). Of particular concern has been the potential carcinogenic effects from the RF-EMF emissions of cell phones. However, epidemiologic studies of the association between cell phone use and prevalence of brain tumors have been inconsistent (some, but not all, studies showed increased risk), and the issue remains unresolved," according to background information in the article. The authors add that studies performed in humans to investigate the effects of RF-EMF exposures from cell phones have yielded variable results, highlighting the need for studies to document whether RF-EMFs from cell phone use affects brain function in humans.


Nora D. Volkow, M.D., of the National Institutes of Health, Bethesda, Md., and colleagues conducted a study to assess if cell phone exposure affected regional activity in the human brain. The randomized study, conducted between January 1 and December 31, 2009, included 47 participants. Cell phones were placed on the left and right ears and brain imaging was performed with positron emission tomography (PET) with (18F)fluorodeoxyglucose injection, used to measure brain glucose metabolism twice, once with the right cell phone activated (sound muted) for 50 minutes ("on" condition) and once with both cell phones deactivated ("off" condition). Analysis was conducted to verify the association of metabolism and estimated amplitude of radiofrequency-modulated electromagnetic waves emitted by the cell phone. The PET scans were compared to assess the effect of cell phone use on brain glucose metabolism.


The researchers found that whole-brain metabolism did not differ between the on and off conditions. However, there were significant regional effects. Metabolism in the brain region closest to the antenna (orbitofrontal cortex and temporal pole) was significantly higher (approximately 7 percent) for cell phone on than for cell phone off conditions. "The increases were significantly correlated with the estimated electromagnetic field amplitudes both for absolute metabolism and normalized metabolism," the authors write. "This indicates that the regions expected to have the greater absorption of RF-EMFs from the cell phone exposure were the ones that showed the larger increases in glucose metabolism."

"These results provide evidence that the human brain is sensitive to the effects of RF-EMFs from acute cell phone exposures," the researchers write. They add that the mechanisms by which RF-EMFs could affect brain glucose metabolism are unclear.

"Concern has been raised by the possibility that RF-EMFs emitted by cell phones may induce brain cancer. ... Results of this study provide evidence that acute cell phone exposure affects brain metabolic activity. However, these results provide no information as to their relevance regarding potential carcinogenic effects (or lack of such effects) from chronic cell phone use."

"Further studies are needed to assess if these effects could have potential long-term harmful consequences," the authors conclude. (JAMA 2011;305[8]:808-814. Available pre-embargo to the media at www.jamamedia.org)

Cell Phone Radiofrequency Radiation Exposure and Brain Glucose Metabolism
The results of this study add information about the possible effects of radiofrequency emissions from wireless phones on brain activity, write Henry Lai, Ph.D., of the University of Washington, Seattle, and Lennart Hardell, M.D., Ph.D., of University Hospital, Orebro, Sweden, in an accompanying editorial.

"Although the biological significance, if any, of increased glucose metabolism from acute cell phone exposure is unknown, the results warrant further investigation. An important question is whether glucose metabolism in the brain would be chronically increased from regular use of a wireless phone with higher radiofrequency energy than those used in the current study. Potential acute and chronic health effects need to be clarified. Much has to be done to further investigate and understand these effects."


The editorial authors also question whether the findings of Volkow et al may be a marker of other alterations in brain function from radiofrequency emissions, such as neurotransmitter and neurochemical activities? "If so, this might have effects on other organs, leading to unwanted physiological responses. Further studies on biomarkers of functional brain changes from exposure to radiofrequency radiation are definitely warranted."

SOURCE: American Medical Association 

Previous discussions about Mobile Phones and Health:
http://trewmte.blogspot.com/2009/09/cellphones-cause-brain-tumors.html

What comparisons between Taser and Stun Gun Mobile Phones?

What comparisons between Taser and Stun Gun Mobile Phones?

There is an interesting video released out on BLUtube about the potential understanding of a forensic component occurring within the use of Taser. The component relates to Taser discharge, as opposed to the actual result impacting on the target-human body.

BLUtube is powered by PoliceOne.com
The observations in the video nonetheless are only one dimension of the 'stun' story and, whilst useful, it would be interesting to see whether MSc/PhD students (always looking for dissertation ideas) would conclude similar forensic components exists when it comes to mobile phones that have stun capability?:

http://trewmte.blogspot.com/2007/10/another-mobile-telephone-stun-gun.html
http://trewmte.blogspot.com/2007/07/stun-gun-cellphone.html

Mobile Phone Chip Off

Mobile Phone Chip Off

If you have produced or know of a mobile phone chip off video showing methods and techniques for removing ICs/memory from various makes/models of mobile handsets then email (trewmte@gmail.com) your youtube link and then it can be added to the thread 'Mobile Phone Chip Off'.



UPDATED:

Thank you Paul for this N70 video


Nathan, thanks for the SonyEricsson W850 video


Another SE W850 video


Nokia UEM removal

Mobile Device Tech-Genetics

Mobile Device Tech-Genetics

I assume mobile phone examinations will start to see the introduction of mobile devices with human thumbs connected to them being brought into the Lab. Testing the thumbs for evidence wont be a problem. DNA and fingerprinting is common for mobile devices and their associated SIM/USIM/Memory Cards. But just how TFK (Trew Forensic Kit), Oxygen Forensics, Cellebrite, XRY, MobilEdit etc will cope with the thumbs, which provides the interface to the device, is another matter. Perhaps this requires developing some type of tech-generic ears that act as couplers/data interface in which to stick those thumbs, no!?
 
Future possibilities of video streaming data straight to the brain could also be offered, too. A commercial service of 100 megeBytes download at £16.50 a month, may be? I can visualise the advertisement: 'We make worthwhile products, even better. The Trewly best ideas are why Trew are the market innovator and leader.' Well, why not, everyone else says it.....

.....anyone got the number for the Stock Exchange?

The video, by the way, is courtesy of Sony Ericsson Xperia Play commercial available on YouTube.

GSM Radio DNA Bracelet

GSM Radio DNA Bracelet

We may wish to consider what might be forensically deduced from radio test measurements when conducting cell site analysis (CSA). CSA, as we know, in the majority of circumstances in which it may be deployed, takes account of historical perspectives of radio coverage in a particular geographical location after mobile communications have occurred. It does not automatically follow the precise area in which radio tests are conducted is identical to the precise area in which mobile calls took place. The results obtained from such tests are usually aligned and suggested to correspond to mobile communications usage on a particular subscriber account using data from call data record (CDR) details. The combined details of both may be presented, usually in a report and/or oral evidence, in legal proceedings.

Understanding the radio test measurement results requires at first instance knowing the technical identity, structure and content employed in the cycled (eg TDMA) frames containing overhead paramaters (control channel data) that a mobile phone may receive, decode, action commands and receive responses. In this discussion content associated with traffic channel data (voice communication. SMS, email, etc) is not dealt with due to the historical examination of control channel data arising from radio tests and assessment of coverage in an area obtained after the event of mobile communications.

As examiners will be using radio test equipment to collect radio information, the GSM heirachial frames (see below) displays the structure of the entire cycling processing designed for GSM. Essentially, examiners need to know the heirachial structure in order to identify where in the structure control data captured by the radio test equipment logically originates. The first point to note, since it is control channel data that is relevant, is that there are 51 TDMA frames set aside for the transportation of control channel signalling, albeit the control channel data can be duplicated over numerous frames.   

 

Analysis of the heirachial frames reveals that only a proportion of the frames are actually considered relevant to cell site analysis as the frames being monitored in the demesne are real time over the air interface at the time of conducting radio tests subject to the quantifying period an examiner remains at site conducting tests at a particular location. For instance, rarely, if ever, is it found an examiner stays at one location monitoring for 3.30hrs to allow for the entire GSM heirachial frames to complete their cycle (as set down by the GSM standards) because it is simply not practicable or relevant to do so. Instead, an examiner needs to know which control channels are available and the likelihood of signalling data being communicated within each control channel.

I shall deal with types of bursts and timing of frames in a later discussion. For now, it is perhaps useful to think about when examiners goes to site for testing that radio signals travel over the air in mico-seconds, the radio receiver (handset) detects the signals in milli-seconds and the entire decoding process occurs approximately in seconds and thereafter, at which point, the examiner may then be able to begin comprehending the resulting output of the processed data. It is the comprehension of data that significantly examiners needs to understand which control channel/s such data may be attributable (eg. for BCCH  - the examiner may expect to determine paramaters relating to cell specific data).

It is precisely the nature of control channels in the assigned frames that contains signalling data being constantly cycled at high speed in order to contact, connect and retain network communication with the radio receiver (handset) in order that the handset can process, understand, respond, where necessary. The range of control channels are defined by GSM and repetituously cycling of the control channels that led to identifying the GSM Radio DNA Bracelet, illustrated below. 

I shall stop here because there is a considerable body of information that I have condensed into this byte-size primer discussion. Readers may wish to take time to digest what I have stated. Also, I am in no hurry discuss everything. What I can state, I rely on evidence, analysis and facts drawn from standards and test results, each used to corroborate each other.  Over the years I have had mobile network operator staff, experts and examiners who have suggested something different or initially disagreed with the GSM Radio DNA Bracelet only for them to reconsider their own view down the line. This has largely been due to radio engineers/experts/examiners thinking in terms of KPIs, fault finding, radio planning or not fully appreciating the subject matter being discussed. The findings I am discussing: relate to forensic analysis and evidence; the findings have remained constant (in my opinion) over the years; control channel data used for CSA assigned only to those logical channels identified in the GSM Radio DNA Bracelet and no other logical channel. It is true to say operators may use various combinations of control channels (examples are set out in the GSM standards) but in each instant the control channels are constantly cycled in a pattern that forms a bracelet effect, the signalling data in them has unique identity properties analogous to the way DNA attributes can be understood. Objectively, if the aforementioned doesn't occur GSM handsets and SIM cards may not determine/understand control channel data to make effective use of the data and, logically, GSM would fail to work effectively with its claimed objecitives. It is because of these GSM constants that they fortify that a GSM Radio DNA Bracelet exists, subject to the caveat control channels used by particular operators at particular locations might vary.

The work above is Copyright and the entire original artistic work or part thereof may not be reproduced or distributed without the prior consent of the author. (c) Gregory Smith 2011.

Apple sued over iPad and iPhone app 'data leaks'

Apple sued over iPad and iPhone app 'data leaks'

The BBC article doesn't mention it, but it would be helpful to know what personal data is being captured by web-based companies etc. In the wrong hands captured personal data for MSISDN could be used, by pinging from the internet, to cache polled MSISDNs for their IMSIs etc.  The equipment is out there to do it and has been for many years.

With credit card details being included within suggested secure apps for UICC cards, it is not difficult to imagine a rogue poll and de-tanking event occuring that goes unnoticed because it appears like the modern unobtrusive location updating procedure or another procedure and the user may only know about it after the data is missing.

Should that event happen it is what is termed as a "Mobile Cybercrime". The relevance being, making use of the singular term cybercrime as a title is highly misleading because you need a science and an operable technology in which the event needs to activate and commission. Mobile communications is a science and a technology (a damned fine science and technology they are, too).     

http://www.bbc.co.uk/news/technology-12089225