Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

Mobile Phone Forensics: Messages, Missed Calls, and no signal

$
0
0
armresl wrote: The messages should show the time they were actually sent from the other user, not the time you were able to ping the newest tower. Right or Wrong? Depending on which operating system (OS) is in use on the handset it could be the date/time can be determined from the handset clock and appended to the message (SQLdatabase) as seen on the handset GUI and not the network date/time stamp. It is not possible at this stage to confirm this as in the above discussion it isn't stated which handsets/OSs are relevant(?). Moreover, the home network wouldn't usually allocate a new timestamp to the SMS date/time when traversing its own network merely because the intended receiving party's handset is out of contact (c.f. OP scenario with the handset being switched off for 45 mins). Moreover, the sending party's message may be subject to a 'validity period'. See some pointers here: France Car Shootings and Mobile Evidence http://trewmte.blogspot.co.uk/2012/09/france-car-shootings-and-mobile-evidence.html UICC Coding Schemes 46 = "SM Validity Period Expired" http://sim2usim.blogspot.co.uk/2013/04/uicc-coding-schemes.html How would 'validity period' effectively operate in practice if every proxy/server/network added a new date and time stamp to the: SMS wrapper (encrypted message, PDU, SMS header)? SMS date/time stamp may/might change with possible causes, generally speaking, when crossing international mobile operator networks, network roaming (local/international) and/or tromboning.

Viewing all articles
Browse latest Browse all 20107

Trending Articles