Popular in Mobile Digital Forensics I
Popular in Information technology
This 5 page Class Notes was uploaded by James Cha on Sunday January 18, 2015. The Class Notes belongs to TINFO444 at University of Washington taught by John Bair in Winter2015. Since its upload, it has received 143 views. For similar materials see Mobile Digital Forensics I in Information technology at University of Washington.
Reviews for TINFO444Week2.pdf
Report this Material
What is Karma?
Karma is the currency of StudySoup.
You can buy or earn more Karma at anytime and redeem it for class notes, study guides, flashcards, and more!
Date Created: 01/18/15
T INFO 444 2mI Week CHAPTER 2 TYPES OF SEARCHES Exigent circumstances Child abduction cases will usually allow this and it will usually be argued later primarily based on the timing Suggestion is to get what is needed to locate child A more involved timeconsuming physical search should include a search warrant or consent Warrant The PREFERRED method in most cases We are generally going away from searching a phone incident to an arrest Consent to search Most forensic exams will not be conducted in front of the party but instead in a lab It provides a mechanism to allow revocation MOBILE NETWORK OPERATORS MNOI MNO s generally refers to a wireless carrier that maintains their own infrastructure needed for radio connectivity This means they own their own cellular towers and related equipment In North America the major MNO s are ATampT Sprint TMobile US Cellular and Verizon MNO s have the ability to charge customers for connection and also maintain and grow their towers as needed MOBILE VIRTUAL NETWORK OPERATORS MVNO MVNO s are wireless carriers that do not have their own radio infrastructures towers and must have agreements with MNO s They are set up to sell particular model devices then allocate to device onto a MNO network for a set price Some MVNO devices may not be allowed spectrum because they compete with what the MNO is selling Example of MNO and MVNO relationship MVNO Relationship Diagram I PrepaidReviewscom e Elia quot 39 quotil sinnzl Major Mreless Carries Regional Wirelss Carriers Run on Major or Regional Networks CALL DETAIL RECORDS CDR The records stored at the carrier level This includes calls to and from the device voice mail texting multimediamessaging web history and tower locations etc This will include the originating and terminating It will be produced in length of call coding of type of call and the physical location of the tower request Unlike the subscriber information its accurate and provides significant details ie Pay asyougo Records are retained by the provider If the network is a MVNO usually a minimum of two warrants One for the servicing of the call or data request and one for subscriber details As of 2011 645 MVNO s are known Common ones include Tracfone Virgin Mobile StraightTalk and MetroPCS MNO and MVNO VALIDATION Virtual network targets will usually require 2 warrants 0 One warrant to the network carrier servicing the transmission type CDMA or TDMA GSM 0 Another warrant to the virtual network service center ie Tracfone Virgin Alltel etc 0 Although a payasyougo usually does not show who the phone is registered to it can show distribution information SEARCH WARRANT LANGUAGE Where could I obtain language for the handset feature for my search warrant Phonescoop Manufacturer s web site Wireless carriers Other your witness training and forensic background IT KEEPS CHANGING This is the most dynamic Officers and investigators should be aware the defendant could have stored information here that was NOT ASKED FOR IN THE WARRANT Example of Warrant Language Device Any and all stored data to include but not limited to assigned handset number call details images sound files text and multimedia messages voice and sound files music files web and internet history sim and MicroSD content proprietary and secondary memory data to include deleted data Subscriber 1 Account and subscriber information to include account holder account comments associated phone numbers to include but not limited to the below listed cellular numbers billing preferences numbers called numbers received numbers forwarded voice mail content password and or reset passwords for voice mail on line backup data Wireless Backup web accounts AIM related accounts or any other instant messages emails stored photos video and any and all credit information that was necessary to open the account with Cellco Partnership dba Verizon phone number 2534424678 from January 213 through January 23rd 2014 Call Detail Records CDR The cellular towers antenna or any other connectivity data or information including Call OriginationTermination Location Switch location MDN Called CPN SZR and the Physical Address of Cellular Site to include the sector of the cell site example 12and 3 Any and all GPS or any other precise location information propriety software or other equipment that stores processes or facilitates with such tower requests to include but not limited to the side of tower and location of the target phome at the time of such request that is aneilable related txATampT service roamingconnecting on cellular phone 253 209 7281 sold by Tracfone from the Eeriodg of 5 1 11 through 5 3 11 Example of NonDisclosure Language Complaint Language Due to this being an active investigation with suspects still outstanding your affiant is requesting the court to order SprintNextel not to disclose the request for said iitems to the account holder or those parties with access to Esaid accounts Evidence Language Due to this being an active investigation with suspects still outstanding the court orders SprintNextel not to disclose the request for said items to the account holder or those parties with access to said accounts Date Range Suggested is days Other Fax and Return Language iAnd then and there diligently search for said evidence and gany other and if the same or evidence material to the Tinvestigation or prosecution of said felonies or any part 3thereof be found on such search bring the same forthwith before me to be disposed of according to law A copy of fthis warrant shall be served via fax to the listed service providers A copy of the warrant and inventory shall be rleft in a conspicuous place within the premises or faxed rand a copy of the warrant and inventory shall be returned ito the undersigned judge or hisher agent promptly after execution l w w w 1 Example of SEARCH WARRANT RETURNS A Request if MrPlu anllriu Query System Windows Internet Explorer provided by Truforiu erullss Inc 9 quot39 IEhttpsIisecuroalrcashcomi39tracfonei39ciuervjetasp i lli39 l a lil Rh a in ii i In I 1i 4quot lgn39m 39 Dim 99quot 5mg Toss Util l39er 44 Call Center Edition Connected DB CLFYTOPPworId Account Nla Flle iquot H Counter AirlimEard2 Statue NBP Verify Phone Functions Real Time 8ubrnit Dthar v 39 39 ESN 51139555115555 Eat Service info Quiet Pending IA lerchant IA Tr nsIE limeT emit Verfiy Eurrai39il Ezruiua I EEN Status ACTIVE Aislivalinn Data 8J1 292558 84222 AM MIN 3853481878 Deactivation Dates Expire Date 2152515 DealeilDi 2454 DealeiNama FHED MEYEH STUHESJNC Frequency Bug I g 1555 Pant49 TFV15NPJ1 TcghIJESM VI E 5 N 5 lViEE I39I iatniy I ISeivice ID IStatus ESN IMIN IActivation Date IDeactivation DatelEHDirs Date 1353555552 Active 511355551155551 3553451525 5122555 54222 AM 19152515 gt llll I Internal 393 39CIjl39lf39iquotFLquot391 39E Iritl39l39ilt quot I llquot 39CZir39lj Fl2I2I T55IJliI3939eiquotl l 7quotquot TIri39iFI Example of SMS Delivered and Explanation Form WITEl wireless Historical SMS Text Message Detail Report Explanation Form LAW ENFORCEMENT RESOURCE TEAM 180 Washington Valley Rd Bedn inster NJ 07921 Phone 8004515242 1 Fax 8886670026 BBS6570028 NETELEMNM MDN MSGSNDDTTM MSGDLVRDTTM MSGCMPLNSTAT ORlGADDR DESTADDR MSGDIRNIND This is the switch This is the Dateamp This is the Date 8 Time A i A This is your Message completion This is the message This is the reCipient This is the direction of that processed the Target me that the text when the 9 message status indicator sender of the message the text message text message message was sent was delivered O1delivered 1lncoming 2Outgoing 3lncoming 40utgoing
Are you sure you want to buy this material for
You're already Subscribed!
Looks like you've already subscribed to StudySoup, you won't need to purchase another subscription to get this material. To access this material simply click 'View Full Document'