1. I assume that they can be tracked like any cell phone - but they can be paid for by cash - thus technically untraceable to the owner correct?
2. Using a faraday bag - is it used to stop incoming radio signals to the phone? and if you wanted to preserve a phone and didn't have a bag handy (say in the field not expecting to find one) could you just turn it off and then turn it on in the bag???
2. If you leave it on in the bag be advised that the phone will ramp up to full power to try and hit a cell site. This will kill the battery very quickly. Some phones, even if turned off will still communicate with the network.
1. When they are bought theyt can be bought with cash, but usually (correct me if I am wrong) to refill the cards you need a credit card.
Eric
If there turned off, vene if the phone attempts to connect to the network, the phone isn't reachable correct by another customer?
I believe to refill, you can buy a minutes card (with cash) and then add the minutes to your account via the phone too. Some phones allow you to add minutes via the phone itself. Others require a website account login to add.
It all depends on the phone and service.
HTH
-=Art=-
moodhairboy
There is discussion in this thread if you haven't seen it yet
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&p=6530997
On a separate note. It maybe helpful to note that with a GSM/WCDMA phone, if the handset is switched OFF or the battery has drained or been removed then the handset should (according to the standards) have gone through the power down / 'soft' power down procedures. If the (U)SIM is removed with battery still insitu and powered ON, then if we ignore any other technical side issues, in both the former and the latter points they impact on Mobility Management (MM) and inturn put the subscriber account into IMSI-detach mode registered in the network. Then the mobile will no longer be registered in the network for outgoing or incoming calls.
However, the above has no application to (U)SIM-less CDMA or other mobile telephone systems.
moodhairboy
There is discussion in this thread if you haven't seen it yet
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&p=6530997
Trewmte,
Thanks for the link to the discussion and your response. It was very helpful.
Barry
When you buy pre pay phones most shops as far as I'm aware of ask you for your details like postcode, house number/name and name. But then again you could buy one off eBay or the bank of a van /
if the handset is switched OFF or the battery has drained or been removed then the handset should (according to the standards) have gone through the power down / 'soft' power down procedures.
my bold
Nit picking but if you just yank the battery out there is no juice for the phone to go through any power down procedure - its just off. A bit like pulling the power lead out of a computer as opposed to powering it down properly.
Nit picking but if you just yank the battery out there is no juice for the phone to go through any power down procedure - its just off.
No you are not nit picking. To corroborate your statement you would need to have reviewed each and every mobile phone model and its relevant schematic.
Trickle-feed capacitor.
A bit like pulling the power lead out of a computer as opposed to powering it down properly.
Not exactly like computers, and nothing like computer forensics come to that.
Sandy771 we haven't heard from you on FF for a considerably long time. How are things going for you?
Update I am revising a part of my response to sandy771. When I responded I was aware of several handsets in the past that had small power cells on the PCB used to freeze data at power failure ready for the next re-boot. However I cannot find the details I had from 2001 that I had on the subject and therefore, in essence, I cannot prove it if asked today (although I do the know the information did exist). Equally as time has moved on I have not found another make/model with the facility but did find differing Patents which suggested battery change whilst a Call was in progress might be possible.
I thought it would be unfair to allow a technical issue to be raised and suggest sandy771 start searching for it when I cannot demonstrate the same myself.
Complied off line and now Edited to add that I have just seen trews update - dont have time to rewrite my post so - here it is unedited….
Not heard from me because things are a bit manic here - which is both good and bad, lots of work and little RnR.
Are you aware of a phone that uses a trickle charge capacitor in order to affect a controlled shutdown? I am not but I admit I have not seen every model phone - far from it. However, until we have seen this technology in use or we have some other indication that it might be in use then it is just scare mongering. This was common in the early days of computer forensics (circa early mid '90s) I remember once talking to a very influential policeman (in the CF world - but now long retired) about inter sector gaps on hard disks (in the days when I was developing a solution to reading over written data). The next thing I knew he was teaching about how data could be hidden in the gaps between sectors…. A mobile phone is just a computer mated to a radio. There are specific issues and different skill sets required to examine them but the basic skills are the same. Again in the early days there was a lot of hocus pocus from certain parties who wanted to make it all seem much more difficult than it actually is (not saying that there are not some very complex technical issues).
Not every job (or very many) hinge on a particular byte on a SIM card or even a particular byte on a phone, but most are "the phone contained this text/image" and the reports are generated automatically by x hardware/software. In the same way that you may have different people at a force who deal with imaging and different ones that deal with analysis (thinking the CRFP's three job titles here - not that I particularly agreed with them) so the same could be applied to mobile phone forensics. The trick is to have enough knowledge to know when to realise there may be another explanation or you might be missing something and to refer it on or do the research to answer the question yourself.
While this is a new and complex branch of forensics, and I would go as far as to say computer forensics, with some additional and some new skills sets. There are a lot of computer forensics ‘investigators’ who cannot reverse engineer a new file format, do not understand SQL servers or have never looked at a Skype installation, who, as said above – when faced with something outwith their skillset seek advice or learn. Phones are just a different flavour of a computer and, especially with smart phones, becoming more computer like every day.
Effort needs to be made to simplify phone based evidence not to make it more difficult and elitist.