last activated cell...
 
Notifications
Clear all

last activated cell/area SIM card

14 Posts
4 Users
0 Likes
900 Views
bigjon
(@bigjon)
Posts: 159
Estimable Member
Topic starter
 

Good afternoon forum
Is the stored data from an examined SIM card the last event or simply updated and stored as the users travels?
If a person were to use their phone in Leeds city centre, then travel to Manchester without using their phone again, what location data would be on the SIM if it were to be seized from the user in Manchester?
I cannot find the definitive answer anywhere, thank you

 
Posted : 04/05/2016 8:06 pm
(@trewmte)
Posts: 1877
Noble Member
 

Good afternoon forum
Is the stored data from an examined SIM card the last event or simply updated and stored as the users travels?
If a person were to use their phone in Leeds city centre, then travel to Manchester without using their phone again, what location data would be on the SIM if it were to be seized from the user in Manchester?
I cannot find the definitive answer anywhere, thank you

Hello bigjon,

You need to confirm if your discussion is about SIM Card or USIM Card.

Three states you need to identify when discussing data in EFLOCI file when put in context with Leeds City Centre and Manchester

1) was the mobile station switched off in Leeds?
or
2) was the mobile MS station put into Flight Mode in Leeds?
or
3) was the mobile station left switched on in Leeds for the duration of the trip to Manchester?

If 1/2) at power down/Flight Mode in Leeds the data found stored in EFLOCI file should be the last location update.

If 3) the data found stored in EFLOCI file should have been updated either when crossing location boundaries (location areas) for the journey or when periodic location updates are triggered e.g. duration as per EFHPLMN file - whichever comes first.

Can you provide more information?

 
Posted : 04/05/2016 10:24 pm
bigjon
(@bigjon)
Posts: 159
Estimable Member
Topic starter
 

Good afternoon trew, yes it's a USIM
The scenario (imaginary) is, phone used then left switched on but sends and receives no data, person then travels to Manchester, all the while the data on the USIM is updating.
The importance is the examination of a SIM/USIM being vitally important.
A male and female from Leeds for eg she texts and generally uses her phone whilst in Leeds,
They then travel to Manchester where she is murdered, her belongings are searched, phoned gets switched off and the body and belongings are transported back to Leeds and dumped.
On examination of the handset details (without examining SIM/USIM first) could give us lots of data, going to a SPOC for CDR data they would get information from the CSP but the investigator would not know of the time in Manchester as they only provide the OIC with events.
It was a SPOC trainer who asked me to clarify the above, this he said is information on a phone even he could not give you, hence the importance of SIM first even if it means removing battery etc. To get to it

 
Posted : 05/05/2016 8:34 pm
hcso1510
(@hcso1510)
Posts: 303
Reputable Member
 

Bigjon,
I have very little knowledge of how the technology works on your side of the pond, but if the MS was an Android and it was tied to a Gmail account you might be able to obtain some location data from them that can either re-enforce existing evidence or enhance things where it could be lacking. Just a thought.

Respectfully,

 
Posted : 06/05/2016 5:40 am
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

@bigjon You may look into 3GPP Technical Standard TS 31.102 for flyover if you like to learn

3gpp.org TS 31.102

 
Posted : 06/05/2016 11:15 am
(@trewmte)
Posts: 1877
Noble Member
 

A male and female from Leeds for eg she texts and generally uses her phone whilst in Leeds,
They then travel to Manchester where she is murdered, her belongings are searched, phoned gets switched off and the body and belongings are transported back to Leeds and dumped.

but the investigator would not know of the time in Manchester as they only provide the OIC with events.

hello bigjon

The investigator and SPOC need to consider CS and PS states to confirm any auto-updated (or fixed network timers, etc.) of USIM/SIM EFs. As you confirm there is no user-generated traffic and no traffic received by the user then start with these EFs

USIM & SIM modules
==============
EFHPLMN (Home PLMN - check for update timer)
EFLOCI (Location Information)
EFBCCH (Broadcast Control Channel)
EFKc (GSM Ciphering key Kc)
EFKcGPRS (GPRS Ciphering key KcGPRS)
Check DF ProSe
EFCPBCCH (CPBCCH Information)
EFPSLOCI (Packet Switched location information)
EFNETPAR (Network Parameters)
EFOPLMNwACT (Operator controlled PLMN selector with Access Technology)

 
Posted : 06/05/2016 9:00 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

#trewmte - you are a top of class expert!

Tiny delayed bit to learn for the case creator, see here SIM and USIM main differencies

Gemalto

 
Posted : 07/05/2016 12:14 pm
bigjon
(@bigjon)
Posts: 159
Estimable Member
Topic starter
 

Trew,hsco,rolf ,thank you for the input.
I had spoken to SPOC' s when the issue of the use of a Faraday shield was mentioned, this is what lead to the SIM information being discussed and the fact this information could be lost and their investigation through CSP would not bring this as they only recover events

 
Posted : 07/05/2016 12:50 pm
bigjon
(@bigjon)
Posts: 159
Estimable Member
Topic starter
 

Trew,hsco,rolf ,thank you for the input.
I had spoken to SPOC' s when the issue of the use of a Faraday shield was mentioned, this is what lead to the SIM information being discussed and the fact this information could be lost and their investigation through CSP would not bring this as they only recover events

 
Posted : 07/05/2016 12:51 pm
(@trewmte)
Posts: 1877
Noble Member
 

#trewmte - you are a top of class expert!

Tiny delayed bit to learn for the case creator, see here SIM and USIM main differencies

Gemalto

Thanks Rolf, kind of you to say so.

I visited the webpage and noted the statement "Although it’s possible to access it with a simple SIM card…" Gemalto is referring to GSM SIM in terms of accessing a UMTS mobile network. I do not know whether the author of that statement had the following in mind when writing it but it is quite possible that point was addressed way back in 2001. The relevant but last standard for UMTS 1 3G TS 22. 100 is Release '99 v3.7.0 (2001-10). Regarding 'Service aspect (Stage 1)' states at


"10 USIM


2) The UMTS mobile terminal shall support phase 2 and phase 2+ GSM SIMs as access modules to UMTS networks. The services that can be provided in this case may be limited to GSM like services provided by that UMTS network. UMTS mobile terminals shall not support 5V SIMs. It shall be up to the UMTS network operator to accept or reject the use of GSM SIM as access modules in its network."

I remember this from past cases where 2G SIM Cards were being used in 3G handsets. From an examination and cell site analysis angle, the mobile station would be examined first. The examiner's report would identify a GSM SIM Card. The cell site analysis would refer to the use of one or two 3G UMTS NodeB having handled calls in addition to GSM BTS following analysis of the call data. Diametrically opposing views arose where one party would say GSM SIM Card impossible to access 3G UMTS and another party would say the user did access 3G UMTS services but didn't know how.

I am not sure the above opposing views (GSM/UMTS) happens these days in evidential terms although I have seen some about GSM/UMTS/LTE. There are occasions where customers complain about / enquire to know why they cannot get certain services via their handsets.

Consideration of a handset should not be limited to its memory storage but also analysis of the handset's RF-Mem and UMTS radio module as well.

 
Posted : 07/05/2016 1:29 pm
Page 1 / 2
Share: