INDEX NO: VOL 4-MTE03- 2006 supp: 001 For law enforcement and security specialists professional examiners

involved with mobile telephone evidence

Mobile Telephone Evidence

Mobile Telephones, SIM Cards and Cell Site Analysis Forensic Investigation and Evidential Analysis

SMS Text Messages

GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.

Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states: GSM 11.11 cl 11.5.2 "Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area." Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not? Reported by Greg Smith

Mobile Telephone Evidence (MTE) Newsletter is published by Trew & Co, who also publish Mobile Telephone Surveillance (MTS) Newsletter. Views or comments in the articles do not necessarily express the opinion of Greg Smith, Trew & Co, Trew MTE or the MTEB. The information published is derived from research for Trew MTE mobile telephone training courses and published in this free of charge Newsletter. Contact Details: Email: trewCO@compuserve.com

INDEX NO: VOL 4-MTE04- 2006

Mobile Telephone Evidence

END PAGE
ABOUT THE EDITOR
Greg Smith has been involved with forensics and technology evidence for 18 years, of which 17 years with wireless evidence, and of which 13 years dealing with Global System for Mobile (GSM) communications evidence. The extent to which he has dealt with wireless evidence relates to the original analogue mobile telephone system in the UK called TACS (Total Access Communications System) launched 1985. This wireless system was phased out of use in the 1990s, although the last TACS wireless licence expired in 2005. The predominant evidence for TACS related to investigating stolen and cloning mobile telephone integrated mobile telephone number (MTN) and electronic serial number (ESN). It required examination of the handset and transmitted identity to the network; the examination of the printed circuit board for modification components or circuitry used to hijack the use of a genuine user's identity; to reprogram stolen identity into a stolen mobile and jettison original identity. To examine usage of stolen TACS mobile 'phones in relation to Phonebook and mobile calls. To conduct cell site analysis based on the use of Masts by the stolen mobile 'phones and Masts radio coverage area. The last bulk of TACS mobile 'phone cases ended between 1997/98. This was largely due to the introduction of GSM in 1992 and the four fully operational GSM networks by 1994. His work with GSM assisted in the introduction into evidence of the first GSM radio footprint maps, called digital cell footprint maps identified as Best Server Plots and Single Cell Prediction Maps. His work with GSM began in 1993 with mobile telephone and SIM card examination, and GSM cell site analysis. In 1999 Greg created the first GSM accredited mobile telephone courses in the UK delivered in 2001 and in 2003 set about creating the first 3G USIM courses in the UK, which began in November 2005. Greg's main skillsets is that he not only conducts research and development but also presents evidence in criminal courts of law, thus combining both R&D & evidential experience skillsets necessary when dealing with criminal proceedings. It is not possible to have a grasp of mobile telephone evidence simply from R&D, one needs to present it as evidence as well in order to comprehend how the law of evidence will accept it. More info on Trew MTE courses: trewCO@compuserve.com

List of law enforcement (Police) agencies that have attended the Trew MTE courses.
British Transport Police City of London Police Cambridgeshire Police Dorset Police Dyfed Powys Police Gloucester Constabulary Guernsey Police Hampshire Hertfordshire Police H M Customs & Excise Humberside Kent Constabulary Lancashire Eastern Div HQ Lancashire Constabulary Leicestershire Constabulary Leyton Police Lincolnshire Police Lothian and Borders Police Metropolitan Police Ministry of Defence Police Ministry of Justice Belgium Nottingham Constabulary Norfolk Constabulary Northampton Police Northern Constabulary Northumbria Police Royal Canadian Mounted Police Royal Military Police RMP Provost Scottish Drug Enforcement Agency South Wales Police South Yorkshire Police Authority Staffordshire Police Sussex Police Tayside Police Thames Valley Police Waltham Forest Borough Police West Mercia Police Authority West Midlands Police
Not included in the list are the specialist security depts/organisations who have also received training

Mobile Telephone Surveillance (MTE) Newsletter, for law enforcement and security specialists. MTS Newsletter was the first publication for law enforcement dealing with market issues relating to mobile 'phones, SIM cards, network data and cell site analysis. MTS Newsletter provides delegates who had been on TREW MTE training courses to receive additional support in the field. If you want to know about MTE Newsletters or other publications send an email to Greg Smith: trewCO@compuserve.com