±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 0 Visitors: 125

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

making test calls

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

bigjon
Senior Member
 

making test calls

Post Posted: Jul 02, 09 15:02

I have recently been asked why I do not make a "test" call tio a handset to verify its number as the person in question said that it was the norm with other examiners he's dealt with.
I explained that if one can get evidence from a device without altering it then this is the path to take,( ie you have iccid and imsi so a network request can be done) have I missed something and do others out there examine this way??  
 
  

mitch
Senior Member
 

Re: making test calls

Post Posted: Jul 02, 09 16:33

BigJon

I would refrain from doing a test call. Personally.

IMHO not good practice

BUT ...Case dependent... if there is a question about the function of the actual phone then yes... but document it.

Regards  
 
  

trewmte
Senior Member
 

Re: making test calls

Post Posted: Jul 02, 09 17:07

When I started my training courses for the police back in 1999/2000, during training the discussion turned to dealing with a seized mobile telephone being examined very late at night where a mobile phone number couldn't be obtained as the liaison person/s at the operator/s didn't provide a night service for subscriber information.

A scenario was considered how an examiner might respond to this in a child kidnap case. The discussion concluded that solely for very urgent cases where timing was critical that a 'policy' should be written setting out for urgent type cases to place the seized SIM into an unlocked test lab handset and dial a known direct landline number in the lab in order to obtain the CLI for the MSISDN to see if it could provide a lead for the Detectives. The written policy should be clearly stated that when using this method that the ringing landline should not be answered to avoid any charges occuring on the account relating to the paired IMSI/MSISDN.

Back in 2000 bigjon majority of SIMs in use did not store the Last Number Dialled (LND) when the number was dialled from the handset, thus there would be no changes to the EFLND. However, we knew we couldn't prevent changes to EFLOCI and EFBCCH and we also had to be prepared that a incoming text might occur etc - it was a risk in the procedure but a reasonable one in the circumstances for urgent cases only. However, for every adverse matter perceived that might occur it was a fundamental principle and understanding the examiner MUST examine the SIM first to have best evidence and then conduct a a ringing-only call.

A some time later (2002/2003) some handsets on the market were found to be writing LND to the SIM EFLND and therefore this validated further that examining the SIM first was paramount.

Unfortunately, for all the good quality work with safety checks that was prepared back then, over the years (it has been largely the period from 2004 onwards) adopting and adapting flawed mobile phone examination techniques and the use of unsafe principles to conduct examinations appear to lead to the skewed version of examination technique you have recorded for this thread.

I still include in my courses the above as one of the principles and look at adverse issues to consider for safety checks, but I do not advocate the procedure that you have mentioned bigjon.
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

bigjon
Senior Member
 

Re: making test calls

Post Posted: Jul 02, 09 22:51

Mitch, Trew
thanks for the replies, in emergencies I suppose as with anything desperate times call for....
most cards yield their numbers anyway (voda still not doing!!!!) but the network way is what I thought was the way  
 
  

trewmte
Senior Member
 

Re: making test calls

Post Posted: Jul 02, 09 23:35

bigjon, when you said "if one can get evidence from a device without altering it then this is the path to take,( ie you have iccid and imsi so a network request can be done)" I think everyone supports your comments as the practice rule and the exception to the rule is in urgent cases where a number is needed but corroboration cannot be obtained for an IMSI/ICCID search to the operator due to out of hours.
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 

Page 1 of 1