±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 34081
New Yesterday: 1 Visitors: 106

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Mountain Lost Person - CellSiteAnalysis

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4, 5  Next 

Mountain Lost Person - CellSiteAnalysis

Post Posted: Tue Mar 28, 2017 4:49 pm

For our forensic lab we constantly try to improve our skills of Cell Site Analysis (CSA). For this we defined a new project called Mountain Lost Person (MLP). The case of MLP consists of a lost person on a unknown mountain area with not short-range cell towers nearby. But as the Probable Finding Area (PFA) is assumed on a elevated height there are many cell towers who send their Reference Signals (RS) to the mobile the person has on-body. This case is part of our Last Living Location (LLL) research.

Its obvious that the mobile receives e.g. Reference Signal Receiver Power (RSRP) radio frequency signals from far away cell towers, but the mobile is under-powered to send back the long distance.
So a asymmetric situation occurs. The mobile knows the cell towers, but the cell towers don't know the mobile. Further case details will be revealed.

How can under this circumstances the MLP being found by CSA?

What do you propose to do to find the MLP?  

Senior Member

Re: Mountain Lost Person - CellSiteAnalysis

Post Posted: Tue Mar 28, 2017 6:32 pm

Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 

Senior Member

Re: Mountain Lost Person - CellSiteAnalysis

Post Posted: Tue Mar 28, 2017 7:00 pm

armresl - your feedback is appreciated.

Out of collaboration with Swiss Alpine Club we discussed the installation of Offline Cell Towers (OCT) (no backhaul) which only log mobiles in reach last seen with vector and approximative location. In case of emergency these OCT can be reached (One Time Connection OTC) by centralized motorized directional antenna towers which can connect to the OCT to connect through to a MLP.

What do you think about this today theoretical approach to save lives?

If you are a genius you present here a better idea. Take your chance Smile  

Senior Member

Re: Mountain Lost Person - CellSiteAnalysis

Post Posted: Wed Mar 29, 2017 1:03 am

I have been out of the cellular field for 20 years (so could be wrong). But the proposal doesn't make sense to me.

The mobile device monitors all the local base stations and then selects the most suitable base station to connect to, then you get updates to the HLR/VLR (location databases in the network). The base stations that aren't selected never know about the mobile, even if the mobile is physically nearby.

So having a non-functioning basestation to detect mobile devices isn't going to work.  

Senior Member

Re: Mountain Lost Person - CellSiteAnalysis

Post Posted: Wed Mar 29, 2017 2:58 am

You are absolutely right based on your view.

I have to add that the OCTs only work as logger in offline modus. Their function is only to 'watch and log'. This is for privacy reasons and to overcome the unknown MNO/MVNO of users. So these OCTs if questioned (one-time-connected in emergency mode) can report 'I saw the MLP the last time/probable location'.

So you ask: How knows anybody of the MLP's raw position? The ordinary Mobile Broadband Network has this information until the user is crossing the areas. Lets say Offline Area (OA) and Logged Area (LA). So the user is crossing from OA to LA maybe once, often or frequently.

What do you think now?  

Senior Member

Re: Mountain Lost Person - CellSiteAnalysis

Post Posted: Wed Mar 29, 2017 9:18 am

Rolf, interesting concept, but I suspect you have seen something that we haven't and so I can only suggest what I know, which may or may not answer your question. So perhaps you can help and indicate where you are in the framework below?

From my experience of cellular radio (analogue and digital):

- Emergency calls are not always operator specific, but best coverage.

- Location coverage can be planned based on installs of BTS and Repeats; knowing the installation base is one of the first priorities to take into consideration when on the hunt for lost persons.

- Where Peak to Peak mast installs are involved, more so for analogue than digital, atmospherics need to be considered such as: 'tropospheric ducting'

[Tropospheric propagation occurs when signals are reflected scattered or refracted in the troposphere. "Ducting" effects occur primarily because of temperature inversions at a height of between 500m and 1500m, and occasionally up to 3000m.]

- Where vast distances are involved operators also consider signalling round-trip so can use extended Timing Advance ((e)TA).

- Where subscriber/prepaid uses another network for emergency call the IMSI/IMEI is collected and forwarded to the network being used so that the pair are used in the track and trace process (signal strength, triangulation, trilateration etc.).

As a starting pointing can I invite you to look to the latest 3GPP TS.24.008 (3GPP TS 24.008 V14.3.0 (2017-03)) Service category
The purpose of the Service category information element is to provide the network with information about services invoked by the user equipment.

The Service category information element is coded as shown in figure 10.5.118d/3GPP TS 24.008 and table 10.5.135d/3GPP TS 24.008

The Service category is a type 4 information element with a minimum length of 3 octets.

Table 10.5.135d/3GPP TS 24.008: Service Category information element

Emergency Service Category Value (octet 3)
The meaning of the Emergency Category Value is derived from the following settings (see 3GPP TS 22.101 [8] clause 10):

Bit 1 Police
Bit 2 Ambulance
Bit 3 Fire Brigade
Bit 4 Marine Guard
Bit 5 Mountain Rescue
Bit 6 manually initiated eCall
Bit 7 automatically initiated eCall
Bit 8 is spare and set to "0"

Mobile station may set one or more bits to "1"
If more than one bit is set to "1", routing to a combined Emergency centre (e.g. ambulance and fire brigade in Japan) is required. If the MSC can not match the received service category to any of the emergency centres, it shall route the call to an operator defined default emergency centre.

If no bit is set to "1", the MSC shall route the Emergency call to an operator defined default emergency centre.
A mobile station initiating an eCall shall set either bit 6 or bit 7 to “1”. The network may use the information indicated in bit 6 and bit 7 to route the manually or automatically initiated eCall to an operator defined emergency call centre.
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 

Senior Member

Re: Mountain Lost Person - CellSiteAnalysis

Post Posted: Wed Mar 29, 2017 6:18 pm

trewmte, your knowledge is brilliant! Thank you!

Your excellent technical details are valuable for the Online Area (OA) part in Emergency State (see below). Its my fault that I wrongly wrote Offline Area (OA) but has to be Online Area (OA).

Lets define two states of the geographical installation: Idle State (IS, no emergency) and Emergency State (ES). Also assumptions have to be defined: The later MLP has a mobile powered-on and low battery (closer to worst case). The person is moving from a MNO covered area out to an uncovered area (simplex connection).

As the person moves inside Tracking/Location Areas (tech. TAC, LAC) the respective operator takes notice. At a certain geographical point the person is crossing from Online Area (OA) to a Logged Area (LA). LA defines an area with Offline Cell Towers (OCT). OCTs are in IS offline, no backhaul but their directional radio frequency receiver is open for reception (listening mode). As the person is moving inside the LA the OCT is the only system knowing that the person is in reach. If the person is crossing back to the OA the process restarts.

In ES (alerted by an external source like relatives, police) a highly elevated cell tower fully functional equipped with an extremely high-precision motorized directional high-gain antenna for long-distance like 20-30km (Master Cell Tower (MCT) starts pointing to the several OCTs in a logic order. By connecting to the OCTs the MCT 'asks' the OCTs one-by-one: Did IMEI=x greet you? If so the OCT responds with timestamp and radio propagation parameters to the MCT. The MCT is located in a kind of star network constellation.

A key element in this concept is that there is no public surveillance. Instead it is Public Logging for Emergency (PLE).

Only in ES the MCT connects to the OCTs to ask if the MLP 'was seen'.

Important: The OCTs do not enable Push To Talk (PTT) services. They are 'silent observers' just for PLE.

Do not hesitate to ask more questions. But please hang-in to think if this all makes sense. Thank you!  

Senior Member

Page 1 of 5
Go to page 1, 2, 3, 4, 5  Next