Join Us!

XRY log missing 999...
 
Notifications
Clear all

XRY log missing 999 call ,reason used is phone was locked  

  RSS
crumdub
(@crumdub)
New Member

Was wondering if anyone has experience of this situation.

I was checking a log generated by XRY , It consisted of voicecalls only.

There was a 999 Call made in the timeline, but was missing from the provided log.

I was told, if the phone was locked while the 999 call was made, it bypassed the memory and would not be in the log generated.

Is this true? The phone is a SAMSUNG mobile phone, I received no further technical information.

Quote
Posted : 13/05/2019 5:31 pm
TobiasJ
(@tobiasj)
New Member

Hi Crumdub,

If you could send the extraction log to [email protected] we may be able to say more about this issue. We have however seen that there are some devices out there which do not save the emergency numbers in the call list but in these cases the call would not be present on the device either. If it's not seen on the device it's of course unlikely to be extracted by XRY.

Could you clarify if these calls were present on the phone but not extracted by XRY or if the calls were not seen on the device either?

ReplyQuote
Posted : 14/05/2019 7:12 am
crumdub
(@crumdub)
New Member

Thanks for the prompt reply TobiasJ

I do not have access to the image , I have only been presented with the report.

The issue arose when a 999 call was made, but did not appear on the log … but other 999 calls were present

Reason given was that SAMSUNG phone was probably locked, and call was made, bypassing the phones memory , directly to emergency services.

I was just wondering if this is a normal function? Is this plausible? have you seen this?

Maybe another possibility is the 999 call was made from another phone, unlikely, but possible.

ReplyQuote
Posted : 14/05/2019 9:59 am
trewmte
(@trewmte)
Community Legend

The issue arose when a 999 call was made, but did not appear on the log … but other 999 calls were present
Reason given was that SAMSUNG phone was probably locked, and call was made, bypassing the phones memory , directly to emergency services.

Maybe test this out for yourself (lock phone (not exhibit), dial 999, see what happens, see what is in logs) so if you are giving evidence you have first-hand knowledge and not hearsay.

ReplyQuote
Posted : 14/05/2019 11:16 am
TobiasJ
(@tobiasj)
New Member

Do you have any more information on what device this was and what Android version it was running? It is very possible it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar) but without knowing the exact model and Android verison it's difficult to say.

ReplyQuote
Posted : 14/05/2019 12:34 pm
crumdub
(@crumdub)
New Member

Thanks for the reply Trewmte,

I do not have access to the phone to test, and if I used our version of MSAB forensic this may add confusion, as I have no access to the version of MSAB was used during testing.

I was just fielding the issue of

Is it possible for a 999 call to be made from a mobile phone that would not be picked up by the software?

The are 999 calls registered on the log from the phone in question. When I asked about this anomaly, was told its an issue that when phone locked , it can bypass phone memory, hence 999 call missing from log

Phone SAMSUNG GTS 5830

OS Android 2.3.6 GingerBread

ReplyQuote
Posted : 14/05/2019 5:49 pm
crumdub
(@crumdub)
New Member

Do you have any more information on what device this was and what Android version it was running? It is very possible it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar) but without knowing the exact model and Android verison it's difficult to say.

Thanks for the reply TobiasJ,

The phone details I have are below, my apologies for not having more, I know it would be helpful.

Phone SAMSUNG GTS 5830

OS Android 2.3.6 GingerBread

Its good to know that the scenario highlighted is possible, is this normal working behavior or a problem that will be addressed @ a later date?

ReplyQuote
Posted : 14/05/2019 5:53 pm
TobiasJ
(@tobiasj)
New Member

In hindsight without actual access to the device it's difficult to give an exact response as to what could've caused this behaviour but it is possible that there are scenarios when this would not populate the call list. We have seen devices where emergancy numbers would not but then again if others have been that does not seem to be the case on this model.

I just fetched our Samsung GT-S5830 Galaxy Ace to check how it appears to behave and on the version it did not seem possible to dial any calls unless the device was unlocked? As this was an Android 2 device the only options on the lock screen were Unlock and to turn the sound on/off, not open the dial pad. Is it possible these calls were manually deleted by the user prior to it being investigated?

ReplyQuote
Posted : 16/05/2019 8:08 am
trewmte
(@trewmte)
Community Legend

In hindsight without actual access to the device it's difficult to give an exact response as to what could've caused this behaviour but it is possible that there are scenarios when this would not populate the call list. We have seen devices where emergancy numbers would not but then again if others have been that does not seem to be the case on this model.

I just fetched our Samsung GT-S5830 Galaxy Ace to check how it appears to behave and on the version it did not seem possible to dial any calls unless the device was unlocked? As this was an Android 2 device the only options on the lock screen were Unlock and to turn the sound on/off, not open the dial pad. Is it possible these calls were manually deleted by the user prior to it being investigated?

Tobias the OP stated this info..

Phone SAMSUNG GTS 5830
OS Android 2.3.6 GingerBread

So I did a quick search to see type of feed back about GT-S5830 including checking MSAB and Cellebrite listing..

GT-S5830m Galaxy Ace
Chinese phones GT-S5830
GT-S5830 Galaxy Cooper, GT-S5830i Galaxy Ace
GT-S5830 Ace (Android), GT-S5830 Cooper (Android), GT-S5830i Galaxy Ace (Android)
Samsung GT-S5830 Ace (Android 2.2.1 Froyo)
GT-S5830_UM_EU_Gingerbread_Eng_Rev.1.1_130221_Screen

I noticed quite a few posts out there (via Google) ranging from locked screen "emergency calls only", to removing "emergency call button". Working on the basis if the screen is locked but allowed a 999 call to be made then this may not register in the handset last number D/R/M "Recent" list.

I noted your comments about unlocking screen first. Which put me on to another line of thought.

Most mobiles (provided coverage is available in an area as mentioned in the GT-S5830 manual) can make a 999 call where no coverage is detected by subscriber's own MNO. Could you run a test on your GT-S5830 (in airplane mode) and dial 999 and see if that registers in the phone's "Recent" list?

ReplyQuote
Posted : 16/05/2019 2:10 pm
TobiasJ
(@tobiasj)
New Member

Sure thing! I went ahead and rang 999 both with the Samsung GT-S5830 Galaxy Ace (Android 2.2.1 but was unable to update it further) device in airplane mode and not (for obvious reasons had to cancel the call before it went through), both of these showed up in the call list on the device as well as in XRY when extracted with a Logical extraction.

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call! I also rang a call from the lock screen (which I found now) and this also populated both XRY and the devices call lists with the 999 call. The only way I was able to remove it was by manually removing it from the call list on the device itself.

ReplyQuote
Posted : 16/05/2019 3:02 pm
trewmte
(@trewmte)
Community Legend

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call!

TobiasJ I was wondering whether the 999 call would go thru without removing airplane mode and not updating call list.

Thanks for trying that test.

Is there a cyclic auto delete approach to stored call list on this model e.g. last in list first out when new number enters listing, do you know?

it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar)….

Forgot to include the following comments arising from your excellent observation above, TobiasJ, and I guess this is something for crumdub. On my searches I did come across this

Important Emergency calling is available only for Voice for G Suite accounts managed by your work or school.

https://support.google.com/voice/answer/3379129?co=GENIE.Platform%3DAndroid&hl=en

Does your report show a list of Apps found on the exhibit GT-S5830? (e.g. Google Voice)

trewmte.

ReplyQuote
Posted : 16/05/2019 5:48 pm
crumdub
(@crumdub)
New Member

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call!

TobiasJ I was wondering whether the 999 call would go thru without removing airplane mode and not updating call list.

Thanks for trying that test.

Is there a cyclic auto delete approach to stored call list on this model e.g. last in list first out when new number enters listing, do you know?

it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar)….

Forgot to include the following comments arising from your excellent observation above, TobiasJ, and I guess this is something for crumdub. On my searches I did come across this

Important Emergency calling is available only for Voice for G Suite accounts managed by your work or school.

https://support.google.com/voice/answer/3379129?co=GENIE.Platform%3DAndroid&hl=en

Does your report show a list of Apps found on the exhibit GT-S5830? (e.g. Google Voice)

trewmte.

Thank you for your excellent responses Trewmte, It is appreciated.

Disappointingly, the only information presented in the report was a phone call log to the mobile device. On the 999 calls, there were calls to 999 before and after the specific call that is missing , hence the query.

ReplyQuote
Posted : 16/05/2019 11:17 pm
crumdub
(@crumdub)
New Member

TobiasJ,

Thank you very much for all your help on this issue, It is greatly appreciated.

The tests seem to point that 999 calls would be logged by logical extraction, and you cannot make calls when phone is locked.

There are 999 calls on the device, before and after the specific 999 call. I doubt if the call was manually deleted, there maybe an option of a second phone being used.

Again , Thank you, this has cleared up a lot of confusion

Sure thing! I went ahead and rang 999 both with the Samsung GT-S5830 Galaxy Ace (Android 2.2.1 but was unable to update it further) device in airplane mode and not (for obvious reasons had to cancel the call before it went through), both of these showed up in the call list on the device as well as in XRY when extracted with a Logical extraction.

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call! I also rang a call from the lock screen (which I found now) and this also populated both XRY and the devices call lists with the 999 call. The only way I was able to remove it was by manually removing it from the call list on the device itself.

ReplyQuote
Posted : 16/05/2019 11:26 pm
Share: