Forensic Focus - Computer Forensics, Computer Forensic Training, Digital Forensics
LoginRegisterForumsColumnistsPapersEducationGraduatesReviewsInterviewsNewsletterJobsEventsBlogAdvertise
Search Forensic Focus
Custom Search

Find us on Facebook
Follow Forensic Focus on Twitter
Columnists
"I erred." "I was mistaken."
Craig Ball
Single Sign On
Simon Biles
Copyright and games console modification
Dan Gaskell
To GUI or not to GUI?
Chris Hargreaves
'Web 2.0' as evidence
Sean McLinden
Sometimes it’s all about timing
Sam Raincock
Avoiding common job application errors
David Sullivan
Scalability: A Big Headache
Dominik Weber
Graduate Recruitment

computer forensics graduate jobs

Main Menu
MY ACCOUNT
COMMUNITY
EMPLOYMENT
EDUCATION
RESOURCES
MISC
Follow Forensic Focus

Join newsletter

Join LinkedIn group

Follow on Twitter

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Members' blogs

External feeds

Bookmark & share: Bookmark and Share

Computer Forensics Newsletter
Newsletter

You must be a
registered user
to receive our newsletter

Register Now!

call history
Go to page 1, 2  Next
Post new topic   Reply to topic   Printer Friendly Page     Forum Index -> Mobile Phone Forensics
View previous topic :: View next topic  
Author Message
bigjon
Member


Joined: Jan 08, 2009
Posts: 97
Location: england

PostPosted: Mon Mar 15, 2010 12:36 pm    Post subject: call history Reply with quote

I have had a sony ericsson k330 mobile to examine and found the sim to be p.i.n. locked,I have explained that I could still get access to the handset but would lose call history but was asked to go ahead as the phone contained only a photograph that the client wanted.
I created a "new" S.I.M. WITH 20 "1's and 15 "1's"for ICCID AND IMSI.
Entered the phone to get access to content, retreived the photo but noticed the call history was still there???? has anybody any idea why this has not been erased
Back to top
View user's profile Send e-mail MSN Messenger
Coligulus
Newbie


Joined: Apr 22, 2009
Posts: 49
Location: West Midlands

PostPosted: Tue Mar 16, 2010 2:50 am    Post subject: Re: call history Reply with quote

This is not a common occurrence I have noticed but it is something which I have seen before. Not specifically on a K330 though.

It would appear that not all handsets abide by the GSM standards and as such some don't clear the call logs when a new SIM is inserted.

It is not uncommon for handsets to not completely abide by the standards.

For example (and somebody may correct me if I'm wrong here) I believe one of the standards suggests that you should not be able to remove the SIM card without removing the battery from the device. Skype phones and iPhones are examples to name a few where this is not adhered to.
Back to top
View user's profile
trewmte
Senior Member


Joined: Jan 25, 2007
Posts: 748
Location: UK

PostPosted: Tue Mar 16, 2010 4:15 am    Post subject: Re: call history Reply with quote

Coligulus
There are GSM requirements for "soft" power down for termination of call, detachment, storing required data in SIM and emergency calls, plus polling between ME & SIM and of course SIM swaping in an active call etc..

I would agree that the user should not be offered the invitation of an accidental chance to remove SIM whilst ME is battery powered and ON and in a call.

I have been through the standards to refresh my mind and maybe I missed it but I didn't note an explicit statement that SIM is required to be released only after the battery has been removed. I fully accept I could have forgotten due to the passage of time about this requirement or not even picked up on it in any detail.

Would you mind refreshing my memory as to which 'Standard' you read the comments about removing the battery before releasing the SIM? I do appreciate you did say 'suggested'.

_________________
Mobile Telephone Evidence & Forensics
trewmte.blogspot.com
Cell Site Analysis
cellsiteanalysis.blogspot.com
Back to top
View user's profile Visit poster's website
Coligulus
Newbie


Joined: Apr 22, 2009
Posts: 49
Location: West Midlands

PostPosted: Wed Mar 17, 2010 4:11 am    Post subject: Re: call history Reply with quote

trewmte wrote:
Coligulus
There are GSM requirements for "soft" power down for termination of call, detachment, storing required data in SIM and emergency calls, plus polling between ME & SIM and of course SIM swaping in an active call etc..

I would agree that the user should not be offered the invitation of an accidental chance to remove SIM whilst ME is battery powered and ON and in a call.

I have been through the standards to refresh my mind and maybe I missed it but I didn't note an explicit statement that SIM is required to be released only after the battery has been removed. I fully accept I could have forgotten due to the passage of time about this requirement or not even picked up on it in any detail.

Would you mind refreshing my memory as to which 'Standard' you read the comments about removing the battery before releasing the SIM? I do appreciate you did say 'suggested'.

Greg,

If I remember correctly this was something which I was told and not something which I read. Unfortunately I can't remember who told me and thus I'm finding it hard to confirm as I never asked for more information or looked it up at the time. That's why I used the term suggested as you noted and offered the floor to anyone to correct me.

I have had a look at a number of the standards myself to try and establish if there is in fact a 'standard' as such and it would appear that either I am also missing it or more likely there is no such standard.

I also read the 'soft' power down requirements from 02.07 which I'll agree do talk about the SIM being present during powering off, however it is not explicit that it must be present and obviously we all know that a device can be powered down without a SIM present. I suppose depending on how you read it it could imply that it 'wants' it to be there during powering down but obviously if there is no standard stating that the SIM shouldn't be able to be removed after the device is powered on then the SIM could just as easily be reinserted prior to powering down allowing any required data to be written to it as necessary.

Would you agree though with the point I was trying to make that there are instances and occasions where handsets which do not completely comply with all of the standards?
Back to top
View user's profile
trewmte
Senior Member


Joined: Jan 25, 2007
Posts: 748
Location: UK

PostPosted: Wed Mar 17, 2010 7:23 am    Post subject: Re: call history Reply with quote

Coligulus wrote:
I also read the 'soft' power down requirements from 02.07 which I'll agree do talk about the SIM being present during powering off, however it is not explicit that it must be present and obviously we all know that a device can be powered down without a SIM present. I suppose depending on how you read it it could imply that it 'wants' it to be there during powering down but obviously if there is no standard stating that the SIM shouldn't be able to be removed after the device is powered on then the SIM could just as easily be reinserted prior to powering down allowing any required data to be written to it as necessary.

I can see where you are coming from, but the standards do not support the proposition in the same context as your observations. GSM11.10 test suite provides for scenarios such as the example identifiers below

31.6.2.1 Removal of SIM during an active call
31.6.2.2 Interruption of power supply during an active call

In both instances above, the call should be terminated.

If, of course, you are saying you have evidence of a SIM being used during an active call, the SIM is then removed and later to be returned to the SIM guide for re-establishment of connection and communications to the ME and then for re-establishment of communications with the radio network and the same call remains active that originated before the SIM was removed, then I would most certainly be interested in seeing that evidence.


Coligulus wrote:
Would you agree though with the point I was trying to make that there are instances and occasions where handsets which do not completely comply with all of the standards?

I would agree if it is clearly demonstrated that any non-compliance is specifically measured against the GSM standards. By that I mean the non-compliance would not fit into the criteria set out under GSM specs and reports:

Technical:+++++++++++++++: Technical
Implementation:+++++++++++: Outcome

Mandatory.....................................Mandatory
Mandatory.....................................Optional
Optional........................................Mandatory
Optional........................................Optional

_________________
Mobile Telephone Evidence & Forensics
trewmte.blogspot.com
Cell Site Analysis
cellsiteanalysis.blogspot.com
Back to top
View user's profile Visit poster's website
Coligulus
Newbie


Joined: Apr 22, 2009
Posts: 49
Location: West Midlands

PostPosted: Wed Mar 17, 2010 9:27 am    Post subject: Re: call history Reply with quote

trewmte wrote:
In both instances above, the call should be terminated.

Agreed.

Would you be able to let me know please which version of 11.10 you are referring to? I don't protest to be anywhere near an expert on any of the standards and as such I am struggling to find details on the example identifiers you have made above.

trewmte wrote:
If, of course, you are saying you have evidence of a SIM being used during an active call, the SIM is then removed and later to be returned to the SIM guide for re-establishment of connection and communications to the ME and then for re-establishment of communications with the radio network and the same call remains active that originated before the SIM was removed, then I would most certainly be interested in seeing that evidence.

I have absolutely no evidence to support this, nor have I suggested this is the case so I'm not sure where that came from?

My previous post talked about the SIM being able to be removed and either being or not being re-inserted prior to powering down. I made/make no suggestion that it is possible to maintain a network connection after the SIM has been removed.

I'm not sure if I'm reading it wrong but,

02.07 B.1.17 which I was referring to and as I'm sure you are aware refers to the optional presence of an on/off switch and the relevant functions to be completed during a 'soft' power off. One of which being the storing of required data on the SIM. Again, correct me if I'm wrong but from what I can see it is not in any way talking about using a network connection, merely switching the device off.
Back to top
View user's profile
trewmte
Senior Member


Joined: Jan 25, 2007
Posts: 748
Location: UK

PostPosted: Wed Mar 17, 2010 11:41 am    Post subject: Re: call history Reply with quote

Coligulus wrote:
Agreed.
Would you be able to let me know please which version of 11.10 you are referring to? I don't protest to be anywhere near an expert on any of the standards and as such I am struggling to find details on the example identifiers you have made above.

Of course I am happy to reveal. ETS 300 607-1 (GSM 11.10-1 version 4.28.1): August 2000, but you may wish to verify by checking out other GSM11.10 versions. I should warn you though the requirements I have illustrated appear in various forms in different standards and in mandatory requirements that go back to 1995 (15 years ago).

Coligulus wrote:
My previous post talked about the SIM being able to be removed and either being or not being re-inserted prior to powering down. I made/make no suggestion that it is possible to maintain a network connection after the SIM has been removed.

This is true and of course it was me that initially introduced the notion:

trewmte wrote:
I would agree that the user should not be offered the invitation of an accidental chance to remove SIM whilst ME is battery powered and ON and in a call.

I was endeavouring to understand the fullest extent of your comments about removing the SIM whilst the battery remained in place. Also, to refresh, I was working on the open premise that I may have forgotten something or may not have even noted detail about SIM removal with battery in situ recorded in the standards.

Coligulus wrote:
I'm not sure if I'm reading it wrong but,

02.07 B.1.17 which I was referring to and as I'm sure you are aware refers to the optional presence of an on/off switch and the relevant functions to be completed during a 'soft' power off. One of which being the storing of required data on the SIM. Again, correct me if I'm wrong but from what I can see it is not in any way talking about using a network connection, merely switching the device off.

You are correct save-to-say that GSM 02.07 doesn't solely mention those points and it is not the only standard or test requirement you need to be aware, have read and not applied in isolation to other appropriate standards.

Finally, if you are to call me by my first name perhaps you are equally as willing to share your real name to bring balance to the matter.

_________________
Mobile Telephone Evidence & Forensics
trewmte.blogspot.com
Cell Site Analysis
cellsiteanalysis.blogspot.com
Back to top
View user's profile Visit poster's website
Coligulus
Newbie


Joined: Apr 22, 2009
Posts: 49
Location: West Midlands

PostPosted: Thu Mar 18, 2010 3:31 am    Post subject: Re: call history Reply with quote

trewmte wrote:
Of course I am happy to reveal. ETS 300 607-1 (GSM 11.10-1 version 4.28.1): August 2000, but you may wish to verify by checking out other GSM11.10 versions. I should warn you though the requirements I have illustrated appear in various forms in different standards and in mandatory requirements that go back to 1995 (15 years ago).

Thank you for that, I will have a look.

To be honest the volume of standards that there are and without such an extensive history in GSM as yourself it is hard to catch up. Of course its not made easier by the point you've made about there being different requirements appearing in different forms in different standards.

trewmte wrote:
Finally, if you are to call me by my first name perhaps you are equally as willing to share your real name to bring balance to the matter.

I'm sorry I thought you knew my name as we have spoken previously on the phone following other threads I have posted in on this forum and would have been more than happy for you to use it. For the benefit of the group and to bring balance to the matter as you have requested my name is Colin Mortimer.

bigjon, apologies for your post getting hijacked a little here. Long story short, in my experience I have seen handsets which do not lose the call logs after a new SIM is inserted.
Back to top
View user's profile
trewmte
Senior Member


Joined: Jan 25, 2007
Posts: 748
Location: UK

PostPosted: Thu Mar 18, 2010 4:17 am    Post subject: Re: call history Reply with quote

Colin to my shame and ignorance you did tell me your name previously (Lyca SIM Cards matter) but sadly I forgot. Sorry.

Would it be worth having a one-day seminar to go through the Standards. I don't fancy publishing a document merely for the fact that Standards can change 2-3 times a year and I would be far happier presenting the information to get across important facts.

I wont charge for the work it will take to prepare the presentation and present the findings, but in return:

1) We need someone/a company to sponsor (to pay) for the Seminar room/hall
2) The location must be near to a central train station (not requiring loads of train changes)
3) We will need a sponsor (to pay) for the teas/coffee and sandwiches or whatever
4) A sponsor to pay for my travel (train ticket/cab if needed)
5) If exhibitors want to be at the Seminar (they must pay in order to raise funds for the MTEB)

Also we need some volunteers for co-ordinating the Seminar and Administration.

_________________
Mobile Telephone Evidence & Forensics
trewmte.blogspot.com
Cell Site Analysis
cellsiteanalysis.blogspot.com
Back to top
View user's profile Visit poster's website
Coligulus
Newbie


Joined: Apr 22, 2009
Posts: 49
Location: West Midlands

PostPosted: Fri Mar 19, 2010 2:37 am    Post subject: Re: call history Reply with quote

trewmte wrote:
Would it be worth having a one-day seminar to go through the Standards. I don't fancy publishing a document merely for the fact that Standards can change 2-3 times a year and I would be far happier presenting the information to get across important facts.

I wont charge for the work it will take to prepare the presentation and present the findings, but in return:

1) We need someone/a company to sponsor (to pay) for the Seminar room/hall
2) The location must be near to a central train station (not requiring loads of train changes)
3) We will need a sponsor (to pay) for the teas/coffee and sandwiches or whatever
4) A sponsor to pay for my travel (train ticket/cab if needed)
5) If exhibitors want to be at the Seminar (they must pay in order to raise funds for the MTEB)

Also we need some volunteers for co-ordinating the Seminar and Administration.

I think there is definitely a need for this kind of training within the line of work that we do. It would be nice to see something like this happening on a frequent basis formed in with some kind of 'training credits' type system.

The world around us is changing so rapidly and the mobile phone market is just one example of that. New technologies along with new standards to run those technologies is inevitable and is something which we all must embrace.

Could this be something which is delivered at the MTEB conference or do you think that it is something which demands a place of it's own? I'm thinking probably the latter.

I think perhaps if it is to be the latter then we should start a poll to gauge the level of interest from other parties before making a decision on how to proceed.

Personally I would be happy to get involved and help where appropriate.
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic   Printer Friendly Page     Forum Index -> Mobile Phone Forensics All times are GMT - 6 Hours
Go to page 1, 2  Next
Page 1 of 2


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Use of this website signifies your agreement to the Terms of Use/Privacy Policy available here.

All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2010 Forensic Focus


Interactive software released under GNU GPL, Code Credits, Privacy Policy
.: fisubsilver shadow phpbb2 style by Daz :: CPG-Nuke port by norseman :: ported to CPG-Dragonfly by jamin :.