Mobile Phone Examin...
 
Notifications
Clear all

Mobile Phone Examination - timing techniques

4 Posts
3 Users
0 Reactions
482 Views
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
Topic starter  

Obviously it is quicker to look at your watch provided it is set and keeps accurate time (rarely), but the requirement to know the accuracy or inaccuracy of a handset's clock is important when conducting examination.

Dialling the atomic clock may cost for the price of a call, unless you have access to a free atomic clock counter, but there is an internet version of telling the time that maybe of interest to mobile phone examiners

http//www.yugop.com/ver3/stuff/03/Fla.HTML

The forensic amongst you should immediately question by what assessment and qualification is this website clock considered accurate? Good question!


   
Quote
PaulSanderson
(@paulsanderson)
Honorable Member
Joined: 19 years ago
Posts: 651
 

Is this a spoof question?

This has been around for a long while and it takes its time from your computer clock - so is as accurate or inaccurate as your PC's own clock.


   
ReplyQuote
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
Topic starter  

You are right Sandy771 it is intended as a question to check how people respond to it. I am drawing attention to this issue following recent discussions about tool validation and how easy it is to assume or perceive how a process is performed.

It is not clear from mobile phone tools that are in use as to exactly the actual commands issued to the handsets and the responses received. The tool's log files I have seen for some tools merely express the software coder's declaration of a 'successful event', thus prevents examiners from being able use the log file for traceability purposes to prove during an examination the examiner did not change data or alter the status of a file or if such events had occurred to know what impact that may on ( a ) the data, ( b ) its evidential worthiness and ( c ) how the Courts may comprehend that matter in relation to "behaviour" (s129 CJA 2003).

The point of the first post is to highlight if it is possible to determine the answer you gave 'PC Clock', why is it not possible with mobile phone tools to know what took place when acquiring data or to properly determine what went on during a tool's interaction with a handset?

Thanks for your reply.


   
ReplyQuote
(@pwakely)
Eminent Member
Joined: 16 years ago
Posts: 37
 

Hi,

There seem to be two primary questions/issues in your initial post (querying methods to perform handset clock accuracy measurements; querying measurement of web-based clock accuracy), and I'm not sure which one you are wanting to draw attention to/discuss (maybe both)?

Breaking the original post as I read it, you are
(a) stating your requirement to be to measure the accuracy of the "handset clock"
(b) implying that in order to perform (a) you would consider sources other than an atomic clock counter, specifically including internet sources as an option
© providing a website which when viewed provides a display of date and time
(d) querying how to determine what qualification/assessment would be performed in order to consider the clock to be 'accurate' (or reading your question another way you may be querying whether or not such an assessment has been performed).

To provide a serious answer your question(s), I would want further clarification on
several points.

1. When you refer to the "handset clock", this could refer to several aspects on the handset, including one or more of the literal primary clock signals on the handset, the displayed handset real-time clock (which can be implemented/updated by a variety of methods, whether local-only, network based/derived, how sleep timers may/not affect issues, accuracy of low-power clocking etc); the 'clock' used for timestamps included within any logs, file-times on any internal storage or the sim, etc. Depending on the clock under consideration, the source information on which it is based could include local high/low accuracy sources, remote high/low accuracy sources (network, internet, GPS etc).

2. Under what conditions do you want the accuracy defining, e.g. over what period (whether aging effects are to be included for example), under what operating conditions (constantly powered fully active vs sleep etc), temperatures etc.

3. regarding (d), the determination of a method to consider the clock 'accurate' would require definition of 'accurate' in the context of that sentence (i.e. the answer depends on what you consider 'accurate' to be for this purpose).

To determine the accuracy of any clock, the standard method would of course be to use a high accuracy clock source over as long a period as possible (depending on the measurement accuracy required or of relevance).

The suggestion to use a website as a clock reference would raise the question of the source data used by the website and the method of display which includes the query of timing accuracy of display for use by the viewer. In the specific example website you provide, the display appears to be generated by the user loading a .swf file; Without decompiling the program (and with limited knowledge of flash, so I don't know if this places sufficient limitation to answer the following) I do not know whether this is simply accessing the time via an API on the processor on which the flash file is run, or obtaining it via another source, e.g. by socket/html access to another site which provides time from another source; I suspect the former of course, but would need to verify; if so then this means that the accuracy of the displayed clock would be the same as the accuracy of the value of clock as provided by the API supplied to the flash player, which would
typically be the same as the accuracy of the CPU real-time clock (whether in a mobile device, pc or whatever, which then depends on all the usual factors including sleep, network updates etc as before).

(btw, I've kept away from specific topics within 'accuracy' regarding the whole combination of factors such as latency, jitter, drift, correction discontinuities etc since I don't think you're trying to head down that route with regard to clock accuracy definition?)

I'll stop there for now, since this is getting long and wait and see which issue was the primary one you were considering 😉

Phil.


   
ReplyQuote
Share: