I have recently been asked why I do not make a "test" call tio a handset to verify its number as the person in question said that it was the norm with other examiners he's dealt with.
I explained that if one can get evidence from a device without altering it then this is the path to take,( ie you have iccid and imsi so a network request can be done) have I missed something and do others out there examine this way??
BigJon
I would refrain from doing a test call. Personally.
IMHO not good practice
BUT …Case dependent… if there is a question about the function of the actual phone then yes… but document it.
Regards
When I started my training courses for the police back in 1999/2000, during training the discussion turned to dealing with a seized mobile telephone being examined very late at night where a mobile phone number couldn't be obtained as the liaison person/s at the operator/s didn't provide a night service for subscriber information.
A scenario was considered how an examiner might respond to this in a child kidnap case. The discussion concluded that solely for very urgent cases where timing was critical that a 'policy' should be written setting out for urgent type cases to place the seized SIM into an unlocked test lab handset and dial a known direct landline number in the lab in order to obtain the CLI for the MSISDN to see if it could provide a lead for the Detectives. The written policy should be clearly stated that when using this method that the ringing landline should not be answered to avoid any charges occuring on the account relating to the paired IMSI/MSISDN.
Back in 2000 bigjon majority of SIMs in use did not store the Last Number Dialled (LND) when the number was dialled from the handset, thus there would be no changes to the EFLND. However, we knew we couldn't prevent changes to EFLOCI and EFBCCH and we also had to be prepared that a incoming text might occur etc - it was a risk in the procedure but a reasonable one in the circumstances for urgent cases only. However, for every adverse matter perceived that might occur it was a fundamental principle and understanding the examiner MUST examine the SIM first to have best evidence and then conduct a a ringing-only call.
A some time later (2002/2003) some handsets on the market were found to be writing LND to the SIM EFLND and therefore this validated further that examining the SIM first was paramount.
Unfortunately, for all the good quality work with safety checks that was prepared back then, over the years (it has been largely the period from 2004 onwards) adopting and adapting flawed mobile phone examination techniques and the use of unsafe principles to conduct examinations appear to lead to the skewed version of examination technique you have recorded for this thread.
I still include in my courses the above as one of the principles and look at adverse issues to consider for safety checks, but I do not advocate the procedure that you have mentioned bigjon.
Mitch, Trew
thanks for the replies, in emergencies I suppose as with anything desperate times call for….
most cards yield their numbers anyway (voda still not doing!!!!) but the network way is what I thought was the way
bigjon, when you said "if one can get evidence from a device without altering it then this is the path to take,( ie you have iccid and imsi so a network request can be done)" I think everyone supports your comments as the practice rule and the exception to the rule is in urgent cases where a number is needed but corroboration cannot be obtained for an IMSI/ICCID search to the operator due to out of hours.