±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36212
New Yesterday: 0 Visitors: 223

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

last activated cell/area SIM card

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

bigjon
Senior Member
 

last activated cell/area SIM card

Post Posted: May 04, 16 20:06

Good afternoon forum
Is the stored data from an examined SIM card the last event or simply updated and stored as the users travels?
If a person were to use their phone in Leeds city centre, then travel to Manchester without using their phone again, what location data would be on the SIM if it were to be seized from the user in Manchester?
I cannot find the definitive answer anywhere, thank you  
 
  

trewmte
Senior Member
 

Re: last activated cell/area SIM card

Post Posted: May 04, 16 22:24

- bigjon
Good afternoon forum
Is the stored data from an examined SIM card the last event or simply updated and stored as the users travels?
If a person were to use their phone in Leeds city centre, then travel to Manchester without using their phone again, what location data would be on the SIM if it were to be seized from the user in Manchester?
I cannot find the definitive answer anywhere, thank you


Hello bigjon,

You need to confirm if your discussion is about SIM Card or USIM Card.

Three states you need to identify when discussing data in EFLOCI file when put in context with Leeds City Centre and Manchester:

1) was the mobile station switched off in Leeds?
or
2) was the mobile MS station put into Flight Mode in Leeds?
or
3) was the mobile station left switched on in Leeds for the duration of the trip to Manchester?


If 1/2) at power down/Flight Mode in Leeds the data found stored in EFLOCI file should be the last location update.

If 3) the data found stored in EFLOCI file should have been updated either when crossing location boundaries (location areas) for the journey or when periodic location updates are triggered e.g. duration as per EFHPLMN file - whichever comes first.

Can you provide more information?
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

bigjon
Senior Member
 

Re: last activated cell/area SIM card

Post Posted: May 05, 16 20:34

Good afternoon trew, yes it's a USIM
The scenario (imaginary) is, phone used then left switched on but sends and receives no data, person then travels to Manchester, all the while the data on the USIM is updating.
The importance is the examination of a SIM/USIM being vitally important.
A male and female from Leeds for eg: she texts and generally uses her phone whilst in Leeds,
They then travel to Manchester where she is murdered, her belongings are searched, phoned gets switched off and the body and belongings are transported back to Leeds and dumped.
On examination of the handset details (without examining SIM/USIM first) could give us lots of data, going to a SPOC for CDR data they would get information from the CSP but the investigator would not know of the time in Manchester as they only provide the OIC with events.
It was a SPOC trainer who asked me to clarify the above, this he said is information on a phone even he could not give you, hence the importance of SIM first even if it means removing battery etc. To get to it  
 
  

hcso1510
Senior Member
 

Re: last activated cell/area SIM card

Post Posted: May 06, 16 05:40

Bigjon,
I have very little knowledge of how the technology works on your side of the pond, but if the MS was an Android and it was tied to a Gmail account you might be able to obtain some location data from them that can either re-enforce existing evidence or enhance things where it could be lacking. Just a thought.


Respectfully,
_________________
Ed

I'm not a cellular technology expert, but I did stay at a Holiday Inn Express last night. 
 
  

RolfGutmann
Senior Member
 

Re: last activated cell/area SIM card

Post Posted: May 06, 16 11:15

@bigjon: You may look into 3GPP Technical Standard TS 31.102 for flyover if you like to learn

3gpp.org TS 31.102  
 
  

trewmte
Senior Member
 

Re: last activated cell/area SIM card

Post Posted: May 06, 16 21:00

- bigjon

A male and female from Leeds for eg: she texts and generally uses her phone whilst in Leeds,
They then travel to Manchester where she is murdered, her belongings are searched, phoned gets switched off and the body and belongings are transported back to Leeds and dumped.



- bigjon
but the investigator would not know of the time in Manchester as they only provide the OIC with events.


hello bigjon

The investigator and SPOC need to consider CS and PS states to confirm any auto-updated (or fixed network timers, etc.) of USIM/SIM EFs. As you confirm there is no user-generated traffic and no traffic received by the user then start with these EFs:

USIM & SIM modules
==============
EFHPLMN (Home PLMN - check for update timer)
EFLOCI (Location Information)
EFBCCH (Broadcast Control Channel)
EFKc (GSM Ciphering key Kc)
EFKcGPRS (GPRS Ciphering key KcGPRS)
Check DF ProSe
EFCPBCCH (CPBCCH Information)
EFPSLOCI (Packet Switched location information)
EFNETPAR (Network Parameters)
EFOPLMNwACT (Operator controlled PLMN selector with Access Technology)
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

RolfGutmann
Senior Member
 

Re: last activated cell/area SIM card

Post Posted: May 07, 16 12:14

#trewmte - you are a top of class expert!

Tiny delayed bit to learn for the case creator, see here SIM and USIM main differencies

Gemalto  
 

Page 1 of 2
Page 1, 2  Next