Cellular Forensics (1).pptx

Cellular Forensics
Engr. Asif Iqbal Bangash
IT Instructor
Police School of Investigation
Peshawar

Contents
• Basics of Mobile Technologies
▫ IMEI, IMSI, MSISDN
• Investigation using Mobile
▫ Mobile found on a crime scene
▫ Investigating using mobile number
▫ Using IMEI & IMSI in investigation
• Location Tracing
▫ Interceptors
▫ Cell ID
▫ LAC ID
▫ Triangulation (Theoretical)

AIM of the Course
To equip the investigation officers on modern
techniques for approaching from crime scene to
the criminal, by using scientific ways

Basics of Mobile Technologies
• IMEI
▫ Stands for International Mobile Equipment
Identity
▫ IMEI can be simply defined as the Chassis number
of a Mobile Set.
▫ It is unique to every Mobile set.
 For mobile sets with dual SIM support there are two
IMEI.
▫ To find IMEI number you have to dial *#06# from
the respective mobile set, or just see it from the
label below battery of mobile set.

• IMEI
▫ IMEI is of 15 digits
▫ Last digit is known is check digit or network digit.
▫ We usually ignore last digit in investigation
because it is not fixed. Every network read it
differently.

• IMSI
▫ Stands for International Mobile Subscriber
Identity
▫ IMSI can be simply defined as the Chassis number
of a SIM card.
▫ It is unique to every SIM Card.
▫ It is written on back side of SIM.
▫ Replacing a SIM for same mobile number will
change IMSI.
▫ IMSI of Pakistani SIMs has a prefix of 410

• MSISDN
▫ Stands for Mobile Systems International
Subscriber Identity Number.
▫ MSISDN is the mobile number in full format.
▫ If your mobile number is 03001234567 then
MSISDN of your number would be
+923001234567.
(+92 or 0092 is the International dialing code for
Pakistan)

Investigation using Mobile
• In some cases you might find a mobile set on a crime
scene. Being investigation officer you have to
consider mobile phone as a normal evidence as well.
You have to look for fingerprints and blood strains
on mobile sets first. After normal investigation then
you will come to technical investigation.
• Once you are done with fingerprints & blood strains
related investigation on mobile then you will look if
the mobile is in working condition, if its in working
condition switch on mobile phone.

• First thing to check after switching on mobile
phone is to check Missed Call details from
mobile phone. Because you will not find missed
call information in CDR or any other source
once lost from mobile phone call register.
• Missed call information are very helpful in
investigating things because criminals use
missed calls as preset indication of some activity.
• Also note down contact details from phonebook.

• Pictures & Videos can also help in investigation
so go through gallery of the mobile set as well.
• If mobile set found on crime scene is not in
working condition so don’t worry you still can
use it in investigation in many ways. Find IMEI
on the back of the mobile set.

CDR
• CDR stands for Call data record
• On second stage call detail record of the suspect
number is obtained .
• Call detail record reveals location of the calls,
timing, IMEI number . Contacts, duration etc.
• All above mentioned details reveals a sketch of
the nature of the suspect like professional or
none professional, new gang or old gang.
• This helps in interrogation process as well.

CDR
• CDR can also be obtained by sending IMEI of the mobile
set.
• CDR by Mobile number or IMEI or IMSI can be obtained
from concerned mobile companies of intelligence
agencies. Khyber Pakhtunkhwa Police’s CTD department
is now authorized to request mobile companies for
issuance of CDR to them.
• You have to sent a letter to CTD or CKC for the issuance
of the CDR along with FIR number as case reference.
• CKC would further send an email to Mobile company
and they would sent back printed CDR to you.

DIFFERENT FORMAT OF CDR
• There is a log with every Call or SMS.
• Every mobile SIM(IMSI) number is different from
others and recognizable by its network system.
• When a person connects to another SIM through its
network, it makes log in the system, and when we
interpret that logs it gives us CDR.
• CDR of different companies are different in shape but
information it gives are almost the same.

TELENOR CDR FORMAT
MSISDN
CALL_DIALED
_NUM IMSI IMEI
CALL_START_
DT_TM
CALL_END_D
T_TM
INBOUND_O
UTBOUND_I
ND SEC: Cell_Lac_Id Cell_Site_Id CALL_TYPE Location
92346504073
0
92315259965
5
41006051454
7323
35742205358
011
2014-05-
2604:29:07 OUTGOING 0 471 4872 SMS
Village Shawa
Muhallah Ahmed
KhelTehsil & District
Swabi SWABI
92346504073
0
92315259965
5
41006051454
7323
35742205358
011
2014-05-
2604:29:43
2014-05-
2604:29:43 INCOMING 0 471 4872 SMS
Village Shawa
Muhallah Ahmed
Swabi SWABI
92346504073
0
92315259965
5
41006051454
7323
35742205358
011
2014-05-
2604:29:47 OUTGOING 0 471 4872 SMS
Village Shawa
Muhallah Ahmed
Swabi SWABI
92346504073
0
92315259965
5
41006051454
7323
35742205358
011
2014-05-
2604:30:09
2014-05-
2604:30:09 INCOMING 0 471 4872 SMS
Village Shawa
Muhallah Ahmed
Swabi SWABI

MOBILINK CDR FORMAT
Sr # Call Type A-Party B-Party Date & Time Duration Cell ID IMEI IMSI Site
1 Outgoing 923059748406 789 1-2-2014 15:58:28 113 CB10C082 353393043825590 410018728264770 AliSherKalay_new, Samar bagh distt lower dir
34.95306/71.6758
2 Outgoing 923059748406 789 1-2-2014 16:06:57 113 CB10A4B7 353393043825590 410018728264770 Rahemabad_BC, open plot of land total
measuring 60’ x 60’, situated at village
Raheemabad, P.O samarbagh, Tehsil
Samarbagh, District Dir (L).
34.95091/71.69273
3 Incoming SMS 923059748406 4D4 1-2-2014 16:09:03 0 CB10A4B7 353393043825590 410018728264770 Rahemabad_BC, open plot of land total
measuring 60’ x 60’, situated at village
Raheemabad, P.O samarbagh, Tehsil
Samarbagh, District Dir (L).
34.95091/71.69273
4 InComing 923059748406 3440905442 1-2-2014 18:48:15 220 CB10DF03 357876048705470 410018728264770 Kambut, plot measuring 10 marlas, bearing
khetoni no. 1, file book no. 1 situated at
village Likor Kambat, tehsil and samer bagh
abd District Dir Lower 34.9757/71.66876

ZONG CDR FORMAT
CALL_TYPE MSISDN_ID STRT_TM BNUMBER
MIN
S
SEC
S
LAC_I
D
CELL_I
D IMEI SITE_ADDRESS LNG LAT
Incoming Call 3153964393 24-02-14 8:20 3159148678 1 30 057E E5D4 357743046542860 Village Kaoga,Chamlha Tehsil Dagar Distt Bunar 72.51333 34.3904
Outgoing Call 3153964393 24-02-14 8:31 3159148678 0 12 057E E5D4 357743046542860 Village Kaoga,Chamlha Tehsil Dagar Distt Bunar 72.51333 34.3904
Incoming Call 3153964393 24-02-14 8:34 3159148678 1 42 057E E5D1 357743046542860 Village Kaoga,Chamlha Tehsil Dagar Distt Bunar 72.51333 34.3904

UFONE CDR FORMAT
IMSI IMEI A Number B Number Call Start Time Call End Time
Call
Duration
Call Type Cell ID - A Location - A
410035113936027 357285054871680 923359856881 923335960858 12-02-14 12:23 12-02-14 12:24 59 OUTGOING 5222118569 Inayat Khel - SWABI
410035113936027 357285054871680 923359856881 923469804360 13-02-14 12:14 13-02-14 12:16 85 INCOMING 5222118569 Inayat Khel - SWABI

WARID CDR FORMAT
Subno Name Cnic B Sub no Transdate Transtime Duration Cell Id 1) Imei NumberCall Type Cellid Description
3205078243 Fawad Afzal Khan 1610181116969 3025965990 01-May-13 11:44:03 28 27493
35420105482280
0 Incoming 0
3205078243 Fawad Afzal Khan 1610181116969 WARID 02-May-13 14:52:49 1 0 0 Outgoing 0
35420105482280
0 Incoming 0
3205078243 Fawad Afzal Khan 1610181116969 WARID 03-May-13 15:21:02 1 0 0 Outgoing 0
35420105482280
0 Incoming
eidgah syedah , Eessa zia Bara
road Sarband Tehsil Zilah
Peshawar
3205078243 Fawad Afzal Khan 1610181116969 3463105052 04-May-13 20:42:15 60 0 0 Incoming 0
35420105482280
0 Incoming 0
35420105482280
0 Incoming 0

Click on the required target number in
the MSISDN column A and copy by Ctrl
+ C

Now select both B and C column by clicking on the
column Header

Now open the find & replace dialog by
ctrl + H

Paste the copied number in the “find
what” textbox

Click replace tab and input “none” in
the replace with textbox

Now click on replace all button

Select column B and select Paste Special and select the checkbox of
“Skip Blanks” and ok
Now delete column C, now u r format is ready for analysis.

Click on the Insert Tab and click on the
PivotTable

On the next screen click on “ok”
without changing any field

Drag MSISDN and Call_dailed_number
to row labels box

Drag inbound_outbound to column
labels while call type to values

Click on column C and then under Data
menu click on Sort ‘Descending’ (Z-A)

Click on Column D and Right-Click,
Select Insert

Select Column C and then under Data
menu, click on “Text to Column”

Convert Text to Column wizard will
start, select Fixed width radio button
and click on Next

Slide the pointer “After 92” and
“Before the number”

Click Finish on the Next Step to
complete the process

If prompted to replace contents, click
OK

Now Select the formatted numbers in
column D, Right-Click and select Copy

Click on the top-most cell in column C,
Right-Click, and select Paste

Now click on Column D header, Right-
Click, and select Delete
The CDR is now ready for further processing.

Drag Party A and Party B to row labels
box

Drag CallType to column labels and
also to values

This is the CDR from Zong in raw
format as received from the company

Right Click on the column that you
want to format and Select “Format
Cells”

On the Number Tab under the Category
list, Select “Number” and set decimal
places to “0”

Now select the first two rows of MSISDN
and double-click on it to fill the whole
column with the desired MSISDN

And press ctrl + H to show replace box

Now input the MSISDN in the Find What
box and leave replace with box empty
or blank

Select Column D and Right Click,
Select Paste Special, check skip blanks
and click ok
Then delete column E and the CDR is ready for further processing.

Picturial view of GSM Interceptor and DF
GSM Interceptor
GSM Interceptor fitted in Vehicle
Handheld DF

Corresponds to a single
cellular tower and
normally identifies the
sector of coverage 120
degree of 360 degree
coverage tower.
Sector1
Sector2
Sector3

A grouping of Cell IDs to form a broader coverage area
(sometimes is one per city or village)

The orientation is
the relationship
between the
directions on the
map and the
corresponding
cell ID direction
in reality.

Orientation = 0
Beam width = 650
Covered
Area
Tower

Orientation = 30
Beam width = 650
Covered
Area
Tower
(Each tower, normally has three cell IDs)

A_Num B Number Call Start Date & Time Call_Duration Call_Type Service_Type CELL_ID
923339597744 923439289385 5/1/2013 6:55 65 Outgoing VOICE 5220722405
923339597744 923439289385 5/1/2013 6:59 20 Outgoing VOICE 5220713306
923339597744 923462988531 5/1/2013 7:02 22 Outgoing VOICE 5220732965
923339597744 923469600756 5/1/2013 9:12 26 Incoming VOICE 5222132965
923339597744 923018908403 5/1/2013 10:36 124 Outgoing VOICE 5222132965
923339597744 923018908403 5/1/2013 10:41 20 Outgoing VOICE 5222124734
923339597744 923009325369 5/1/2013 11:04 81 Outgoing VOICE 5222124734
923339597744 923018853007 5/1/2013 11:11 120 Outgoing VOICE 5222132965
923339597744 923369586576 5/1/2013 11:27 33 Outgoing VOICE 5222132965
923339597744 923439019488 5/1/2013 14:31 18 Outgoing VOICE 5222132965
923339597744 923439744273 5/1/2013 16:31 37 Outgoing VOICE 5222124734
923339597744 923439744273 5/1/2013 17:40 10 Incoming VOICE 5222124734
923339597744 923459279241 5/1/2013 17:44 62 Incoming VOICE 5222132965
923339597744 923322228889 5/1/2013 18:39 720 Outgoing VOICE 5222124734
923339597744 923322228889 5/1/2013 18:51 24 Incoming VOICE 5222124734
923339597744 923339272170 5/1/2013 20:19 21 Incoming VOICE 5222132965
923339597744 923339084580 5/2/2013 7:34 46 Outgoing VOICE 5222124734
923339597744 923139298992 5/2/2013 8:24 44 Incoming VOICE 5225022915
923339597744 923349140943 5/2/2013 9:12 50 Outgoing VOICE 5225022380
923339597744 923139625491 5/2/2013 9:52 22 Incoming VOICE 5225022380
923339597744 923018838183 5/2/2013 10:02 44 Outgoing VOICE 5225022380
923339597744 923018838183 5/2/2013 10:03 21 Outgoing VOICE 5225022380
923339597744 923028397207 5/2/2013 10:50 30 Outgoing VOICE 5225022380
923339597744 923341926830 5/2/2013 12:45 116 Outgoing VOICE 5225032917
923339597744 923018838183 5/2/2013 12:53 17 Incoming VOICE 5225032917
923339597744 923018953363 5/2/2013 14:16 88 Outgoing VOICE 5888838670
923339597744 923462988531 5/2/2013 17:54 37 Outgoing VOICE 5222132961
923339597744 923219885712 5/2/2013 18:48 78 Outgoing VOICE 5222132965

Cell ID Lac Longitude Latitude Beam Width Orientation
12405 52207 72.00069 34.00097 65 0
22405 52207 72.00069 34.00097 65 110
32405 52207 72.00069 34.00097 65 260
12406 58888 71.77872 34.00566 65 0
22406 58888 71.77872 34.00566 65 80
32406 58888 71.77872 34.00566 65 270
12407 52207 72.20537 33.96249 65 65
22407 52207 72.20537 33.96249 65 310
32407 52207 72.20537 33.96249 65 150
12408 52207 71.8932 34.00866 65 90
22408 52207 71.8932 34.00866 65 180
32408 52207 71.8932 34.00866 65 270
12409 58888 71.69804 34.01769 65 95
22409 58888 71.69804 34.01769 65 190
32409 58888 71.69804 34.01769 65 270
12463 52233 71.47879 34.09963 65 110
22463 52233 71.47879 34.09963 65 150
32463 52233 71.47879 34.09963 65 330
12467 52253 71.49716 33.69012 65 350
22467 52253 71.49716 33.69012 65 60
32467 52253 71.49716 33.69012 65 110
12468 52253 71.52358 33.68446 65 340
22468 52253 71.52358 33.68446 65 100
32468 52253 71.52358 33.68446 65 280

12405 52207 71.00069 33.00097 65 0
22405 52207 71.00069 33.00097 65 150
32405 52207 71.00069 33.00097 65 260
12406 58888 71.77872 34.00566 65 0
22406 58888 71.77872 34.00566 65 80
32406 58888 71.77872 34.00566 65 270
12407 52207 72.20537 33.96249 65 65
22407 52207 72.20537 33.96249 65 310
32407 52207 72.20537 33.96249 65 150
12408 52207 71.8932 34.00866 65 90
22408 52207 71.8932 34.00866 65 180
32408 52207 71.8932 34.00866 65 270
12409 58888 71.69804 34.01769 65 95
22409 58888 71.69804 34.01769 65 190
32409 58888 71.69804 34.01769 65 270
12463 52233 71.47879 34.09963 65 110
22463 52233 71.47879 34.09963 65 150
32463 52233 71.47879 34.09963 65 330
12467 52253 71.49716 33.69012 65 350
22467 52253 71.49716 33.69012 65 60
32467 52253 71.49716 33.69012 65 110
12468 52253 71.52358 33.68446 65 340
22468 52253 71.52358 33.68446 65 100
32468 52253 71.52358 33.68446 65 280
22405

13306 52207 71.52358 33.68446 65 340
23306 52207 71.52358 33.68446 65 100
33306 52207 71.52358 33.68446 65 280
22406 58888 71.77872 34.00566 65 80
32406 58888 71.77872 34.00566 65 270
12407 52207 72.20537 33.96249 65 65
22407 52207 72.20537 33.96249 65 310
32407 52207 72.20537 33.96249 65 150
12408 52207 71.8932 34.00866 65 90
22408 52207 71.8932 34.00866 65 180
32408 52207 71.8932 34.00866 65 270
12409 58888 71.69804 34.01769 65 95
22409 58888 71.69804 34.01769 65 190
32409 58888 71.69804 34.01769 65 270
12463 52233 71.47879 34.09963 65 110
22463 52233 71.47879 34.09963 65 150
32463 52233 71.47879 34.09963 65 330
12467 52253 71.49716 33.69012 65 350
22467 52253 71.49716 33.69012 65 60
32467 52253 71.49716 33.69012 65 110
12468 52253 71.52358 33.68446 65 340
22468 52253 71.52358 33.68446 65 100
32468 52253 71.52358 33.68446 65 280
33306

12965 52207 71.69804 33.01769 65 95
22965 52207 71.69804 33.01769 65 190
32965 52207 71.69804 33.01769 65 350
22406 58888 71.77872 34.00566 65 260
12406 58888 71.77872 34.00566 65 0
22406 58888 71.77872 34.00566 65 80
32406 58888 71.77872 34.00566 65 270
12407 52207 72.20537 33.96249 65 65
22407 52207 72.20537 33.96249 65 310
32407 52207 72.20537 33.96249 65 150
12408 52207 71.8932 34.00866 65 90
22408 52207 71.8932 34.00866 65 180
32408 52207 71.8932 34.00866 65 270
12409 58888 71.69804 34.01769 65 95
22409 58888 71.69804 34.01769 65 190
32409 58888 71.69804 34.01769 65 270
12463 52233 71.47879 34.09963 65 110
22463 52233 71.47879 34.09963 65 150
32463 52233 71.47879 34.09963 65 330
12467 52253 71.49716 33.69012 65 350
22467 52253 71.49716 33.69012 65 60
32467 52253 71.49716 33.69012 65 110
12468 52253 71.52358 33.68446 65 340
22468 52253 71.52358 33.68446 65 100
32468 52253 71.52358 33.68446 65 280
32965

Each Tower in range
makes a contact with cell
phone
The Tower having
greatest signal
strength is selected
for communication

Sector
1
Sector 2
Sector
3
22405
71.00069 33.00097

Sector
1
Sector 2
Sector
3
33306
71.52358 33.68446

Sector
1
Sector 2
Sector
3
32965
71.69804 33.01769

Cellular Forensics (1).pptx

Recommandé

Recommandé

Contenu connexe

Similaire à Cellular Forensics (1).pptx

Similaire à Cellular Forensics (1).pptx (20)

Dernier

Dernier (20)

Cellular Forensics (1).pptx