XRY log missing 999...
 
Notifications
Clear all

XRY log missing 999 call ,reason used is phone was locked

13 Posts
3 Users
0 Likes
1,383 Views
(@crumdub)
Posts: 9
Active Member
Topic starter
 

Was wondering if anyone has experience of this situation.

I was checking a log generated by XRY , It consisted of voicecalls only.

There was a 999 Call made in the timeline, but was missing from the provided log.

I was told, if the phone was locked while the 999 call was made, it bypassed the memory and would not be in the log generated.

Is this true? The phone is a SAMSUNG mobile phone, I received no further technical information.

 
Posted : 13/05/2019 4:31 pm
(@tobiasj)
Posts: 22
Eminent Member
 

Hi Crumdub,

If you could send the extraction log to support@msab.com we may be able to say more about this issue. We have however seen that there are some devices out there which do not save the emergency numbers in the call list but in these cases the call would not be present on the device either. If it's not seen on the device it's of course unlikely to be extracted by XRY.

Could you clarify if these calls were present on the phone but not extracted by XRY or if the calls were not seen on the device either?

 
Posted : 14/05/2019 6:12 am
(@crumdub)
Posts: 9
Active Member
Topic starter
 

Thanks for the prompt reply TobiasJ

I do not have access to the image , I have only been presented with the report.

The issue arose when a 999 call was made, but did not appear on the log … but other 999 calls were present

Reason given was that SAMSUNG phone was probably locked, and call was made, bypassing the phones memory , directly to emergency services.

I was just wondering if this is a normal function? Is this plausible? have you seen this?

Maybe another possibility is the 999 call was made from another phone, unlikely, but possible.

 
Posted : 14/05/2019 8:59 am
(@trewmte)
Posts: 1877
Noble Member
 

The issue arose when a 999 call was made, but did not appear on the log … but other 999 calls were present
Reason given was that SAMSUNG phone was probably locked, and call was made, bypassing the phones memory , directly to emergency services.

Maybe test this out for yourself (lock phone (not exhibit), dial 999, see what happens, see what is in logs) so if you are giving evidence you have first-hand knowledge and not hearsay.

 
Posted : 14/05/2019 10:16 am
(@tobiasj)
Posts: 22
Eminent Member
 

Do you have any more information on what device this was and what Android version it was running? It is very possible it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar) but without knowing the exact model and Android verison it's difficult to say.

 
Posted : 14/05/2019 11:34 am
(@crumdub)
Posts: 9
Active Member
Topic starter
 

Thanks for the reply Trewmte,

I do not have access to the phone to test, and if I used our version of MSAB forensic this may add confusion, as I have no access to the version of MSAB was used during testing.

I was just fielding the issue of

Is it possible for a 999 call to be made from a mobile phone that would not be picked up by the software?

The are 999 calls registered on the log from the phone in question. When I asked about this anomaly, was told its an issue that when phone locked , it can bypass phone memory, hence 999 call missing from log

Phone SAMSUNG GTS 5830

OS Android 2.3.6 GingerBread

 
Posted : 14/05/2019 4:49 pm
(@crumdub)
Posts: 9
Active Member
Topic starter
 

Do you have any more information on what device this was and what Android version it was running? It is very possible it was skipped because it wasn't specifically dialled from the phone app (perhaps from the lock screen or through Bixby or similar) but without knowing the exact model and Android verison it's difficult to say.

Thanks for the reply TobiasJ,

The phone details I have are below, my apologies for not having more, I know it would be helpful.

Phone SAMSUNG GTS 5830

OS Android 2.3.6 GingerBread

Its good to know that the scenario highlighted is possible, is this normal working behavior or a problem that will be addressed @ a later date?

 
Posted : 14/05/2019 4:53 pm
(@tobiasj)
Posts: 22
Eminent Member
 

In hindsight without actual access to the device it's difficult to give an exact response as to what could've caused this behaviour but it is possible that there are scenarios when this would not populate the call list. We have seen devices where emergancy numbers would not but then again if others have been that does not seem to be the case on this model.

I just fetched our Samsung GT-S5830 Galaxy Ace to check how it appears to behave and on the version it did not seem possible to dial any calls unless the device was unlocked? As this was an Android 2 device the only options on the lock screen were Unlock and to turn the sound on/off, not open the dial pad. Is it possible these calls were manually deleted by the user prior to it being investigated?

 
Posted : 16/05/2019 7:08 am
(@trewmte)
Posts: 1877
Noble Member
 

In hindsight without actual access to the device it's difficult to give an exact response as to what could've caused this behaviour but it is possible that there are scenarios when this would not populate the call list. We have seen devices where emergancy numbers would not but then again if others have been that does not seem to be the case on this model.

I just fetched our Samsung GT-S5830 Galaxy Ace to check how it appears to behave and on the version it did not seem possible to dial any calls unless the device was unlocked? As this was an Android 2 device the only options on the lock screen were Unlock and to turn the sound on/off, not open the dial pad. Is it possible these calls were manually deleted by the user prior to it being investigated?

Tobias the OP stated this info..

Phone SAMSUNG GTS 5830
OS Android 2.3.6 GingerBread

So I did a quick search to see type of feed back about GT-S5830 including checking MSAB and Cellebrite listing..

GT-S5830m Galaxy Ace
Chinese phones GT-S5830
GT-S5830 Galaxy Cooper, GT-S5830i Galaxy Ace
GT-S5830 Ace (Android), GT-S5830 Cooper (Android), GT-S5830i Galaxy Ace (Android)
Samsung GT-S5830 Ace (Android 2.2.1 Froyo)
GT-S5830_UM_EU_Gingerbread_Eng_Rev.1.1_130221_Screen

I noticed quite a few posts out there (via Google) ranging from locked screen "emergency calls only", to removing "emergency call button". Working on the basis if the screen is locked but allowed a 999 call to be made then this may not register in the handset last number D/R/M "Recent" list.

I noted your comments about unlocking screen first. Which put me on to another line of thought.

Most mobiles (provided coverage is available in an area as mentioned in the GT-S5830 manual) can make a 999 call where no coverage is detected by subscriber's own MNO. Could you run a test on your GT-S5830 (in airplane mode) and dial 999 and see if that registers in the phone's "Recent" list?

 
Posted : 16/05/2019 1:10 pm
(@tobiasj)
Posts: 22
Eminent Member
 

Sure thing! I went ahead and rang 999 both with the Samsung GT-S5830 Galaxy Ace (Android 2.2.1 but was unable to update it further) device in airplane mode and not (for obvious reasons had to cancel the call before it went through), both of these showed up in the call list on the device as well as in XRY when extracted with a Logical extraction.

When dialing with the device in airplane mode I was actually surprised because the device actually disable the airplane mode automatically and proceeded with the call! I also rang a call from the lock screen (which I found now) and this also populated both XRY and the devices call lists with the 999 call. The only way I was able to remove it was by manually removing it from the call list on the device itself.

 
Posted : 16/05/2019 2:02 pm
Page 1 / 2
Share: