±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36115
New Yesterday: 0 Visitors: 105

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

XRY log missing 999 call ,reason used is phone was locked

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

TobiasJ
Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 16, 19 07:08

In hindsight without actual access to the device it's difficult to give an exact response as to what could've caused this behaviour but it is possible that there are scenarios when this would not populate the call list. We have seen devices where emergancy numbers would not but then again if others have been that does not seem to be the case on this model.

I just fetched our Samsung GT-S5830 Galaxy Ace to check how it appears to behave and on the version it did not seem possible to dial any calls unless the device was unlocked? As this was an Android 2 device the only options on the lock screen were Unlock and to turn the sound on/off, not open the dial pad. Is it possible these calls were manually deleted by the user prior to it being investigated?
_________________
Technical Support, MSAB
support @ msab.com 
 
  

trewmte
Senior Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 16, 19 13:10

- TobiasJ
In hindsight without actual access to the device it's difficult to give an exact response as to what could've caused this behaviour but it is possible that there are scenarios when this would not populate the call list. We have seen devices where emergancy numbers would not but then again if others have been that does not seem to be the case on this model.

I just fetched our Samsung GT-S5830 Galaxy Ace to check how it appears to behave and on the version it did not seem possible to dial any calls unless the device was unlocked? As this was an Android 2 device the only options on the lock screen were Unlock and to turn the sound on/off, not open the dial pad. Is it possible these calls were manually deleted by the user prior to it being investigated?


Tobias the OP stated this info..

- crumdub


Phone: SAMSUNG GTS 5830
OS: Android 2.3.6 GingerBread



So I did a quick search to see type of feed back about GT-S5830 including checking MSAB and Cellebrite listing..

GT-S5830m Galaxy Ace
Chinese phones GT-S5830
GT-S5830 Galaxy Cooper, GT-S5830i Galaxy Ace
GT-S5830 Ace (Android), GT-S5830 Cooper (Android), GT-S5830i Galaxy Ace (Android)
Samsung GT-S5830 Ace (Android 2.2.1 Froyo)
GT-S5830_UM_EU_Gingerbread_Eng_Rev.1.1_130221_Screen

I noticed quite a few posts out there (via Google) ranging from locked screen "emergency calls only", to removing "emergency call button". Working on the basis if the screen is locked but allowed a 999 call to be made then this may not register in the handset last number D/R/M "Recent" list.

I noted your comments about unlocking screen first. Which put me on to another line of thought.

Most mobiles (provided coverage is available in an area as mentioned in the GT-S5830 manual) can make a 999 call where no coverage is detected by subscriber's own MNO. Could you run a test on your GT-S5830 (in airplane mode) and dial 999 and see if that registers in the phone's "Recent" list?
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

TobiasJ
Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 16, 19 14:02

Sure thing! I went ahead and rang 999 both with the Samsung GT-S5830 Galaxy Ace (Android 2.2.1 but was unable to update it further) device in airplane mode and not (for obvious reasons had to cancel the call before it went through), both of these showed up in the call list on the device as well as in XRY when extracted with a Logical extraction.

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call! I also rang a call from the lock screen (which I found now) and this also populated both XRY and the devices call lists with the 999 call. The only way I was able to remove it was by manually removing it from the call list on the device itself.
_________________
Technical Support, MSAB
support @ msab.com 
 
  

trewmte
Senior Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 16, 19 16:48

- TobiasJ
When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call!


TobiasJ I was wondering whether the 999 call would go thru without removing airplane mode and not updating call list.

Thanks for trying that test.

Is there a cyclic auto delete approach to stored call list on this model e.g. last in list first out when new number enters listing, do you know?

- TobiasJ
it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar)....


Forgot to include the following comments arising from your excellent observation above, TobiasJ, and I guess this is something for crumdub. On my searches I did come across this:

- support.google.com/voice
Important: Emergency calling is available only for Voice for G Suite accounts managed by your work or school.


support.google.com/voi...&hl=en

Does your report show a list of Apps found on the exhibit GT-S5830? (e.g. Google Voice)

trewmte.
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

crumdub
Newbie
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 16, 19 22:17

- trewmte
- TobiasJ
When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call!


TobiasJ I was wondering whether the 999 call would go thru without removing airplane mode and not updating call list.

Thanks for trying that test.

Is there a cyclic auto delete approach to stored call list on this model e.g. last in list first out when new number enters listing, do you know?

- TobiasJ
it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar)....


Forgot to include the following comments arising from your excellent observation above, TobiasJ, and I guess this is something for crumdub. On my searches I did come across this:

- support.google.com/voice
Important: Emergency calling is available only for Voice for G Suite accounts managed by your work or school.


support.google.com/voi...&hl=en

Does your report show a list of Apps found on the exhibit GT-S5830? (e.g. Google Voice)

trewmte.



Thank you for your excellent responses Trewmte, It is appreciated.

Disappointingly, the only information presented in the report was a phone call log to the mobile device. On the 999 calls, there were calls to 999 before and after the specific call that is missing , hence the query.  
 
  

crumdub
Newbie
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 16, 19 22:26

TobiasJ,

Thank you very much for all your help on this issue, It is greatly appreciated.

The tests seem to point that 999 calls would be logged by logical extraction, and you cannot make calls when phone is locked.

There are 999 calls on the device, before and after the specific 999 call. I doubt if the call was manually deleted, there maybe an option of a second phone being used.


Again , Thank you, this has cleared up a lot of confusion



- TobiasJ
Sure thing! I went ahead and rang 999 both with the Samsung GT-S5830 Galaxy Ace (Android 2.2.1 but was unable to update it further) device in airplane mode and not (for obvious reasons had to cancel the call before it went through), both of these showed up in the call list on the device as well as in XRY when extracted with a Logical extraction.

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call! I also rang a call from the lock screen (which I found now) and this also populated both XRY and the devices call lists with the 999 call. The only way I was able to remove it was by manually removing it from the call list on the device itself.
 
 

Page 2 of 2
Page Previous  1, 2