±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35755
New Yesterday: 1 Visitors: 128

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

XRY log missing 999 call ,reason used is phone was locked

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

crumdub
Newbie
 

XRY log missing 999 call ,reason used is phone was locked

Post Posted: May 13, 19 16:31

Was wondering if anyone has experience of this situation.

I was checking a log generated by XRY , It consisted of voicecalls only.

There was a 999 Call made in the timeline, but was missing from the provided log.

I was told, if the phone was locked while the 999 call was made, it bypassed the memory and would not be in the log generated.

Is this true? The phone is a SAMSUNG mobile phone, I received no further technical information.  
 
  

TobiasJ
Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 14, 19 06:12

Hi Crumdub,

If you could send the extraction log to support @ msab.com we may be able to say more about this issue. We have however seen that there are some devices out there which do not save the emergency numbers in the call list but in these cases the call would not be present on the device either. If it's not seen on the device it's of course unlikely to be extracted by XRY.

Could you clarify if these calls were present on the phone but not extracted by XRY or if the calls were not seen on the device either?
_________________
Technical Support, MSAB
support @ msab.com 
 
  

crumdub
Newbie
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 14, 19 08:59

Thanks for the prompt reply TobiasJ


I do not have access to the image , I have only been presented with the report.

The issue arose when a 999 call was made, but did not appear on the log ... but other 999 calls were present

Reason given was that SAMSUNG phone was probably locked, and call was made, bypassing the phones memory , directly to emergency services.

I was just wondering if this is a normal function? Is this plausible? have you seen this?

Maybe another possibility is the 999 call was made from another phone, unlikely, but possible.  
 
  

trewmte
Senior Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 14, 19 10:16

- crumdub
The issue arose when a 999 call was made, but did not appear on the log ... but other 999 calls were present
Reason given was that SAMSUNG phone was probably locked, and call was made, bypassing the phones memory , directly to emergency services.


Maybe test this out for yourself (lock phone (not exhibit), dial 999, see what happens, see what is in logs) so if you are giving evidence you have first-hand knowledge and not hearsay.
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

TobiasJ
Member
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 14, 19 11:34

Do you have any more information on what device this was and what Android version it was running? It is very possible it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar) but without knowing the exact model and Android verison it's difficult to say.  
 
  

crumdub
Newbie
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 14, 19 16:49

Thanks for the reply Trewmte,


I do not have access to the phone to test, and if I used our version of MSAB forensic this may add confusion, as I have no access to the version of MSAB was used during testing.

I was just fielding the issue of :

Is it possible for a 999 call to be made from a mobile phone that would not be picked up by the software?

The are 999 calls registered on the log from the phone in question. When I asked about this anomaly, was told its an issue that when phone locked , it can bypass phone memory, hence 999 call missing from log


Phone: SAMSUNG GTS 5830

OS: Android 2.3.6 GingerBread  
 
  

crumdub
Newbie
 

Re: XRY log missing 999 call ,reason used is phone was locke

Post Posted: May 14, 19 16:53

- TobiasJ
Do you have any more information on what device this was and what Android version it was running? It is very possible it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar) but without knowing the exact model and Android verison it's difficult to say.




Thanks for the reply TobiasJ,

The phone details I have are below, my apologies for not having more, I know it would be helpful.

Phone: SAMSUNG GTS 5830

OS: Android 2.3.6 GingerBread


Its good to know that the scenario highlighted is possible, is this normal working behavior or a problem that will be addressed @ a later date?  
 

Page 1 of 2
Page 1, 2  Next