ANALYSIS OF CELL PHONES

OBJECTIVES: To provide enforcement officers with a basic understanding of how to analyse and retrieve evidence and intelligence from different types of cell phones. FOCUS: During this lesson you will be provided basic information on: What information and intelligence can be obtained from cell phones. How to extract basic information from cell phones. How to present this information for court purposes. EXPECTED RESULTS: By the end of this session the participants will have a more comprehensive understanding of how to analyse and retrieve evidence and intelligence from different types of cell phones.

CAUTION The accessing of information contained within cell phones including SMS history, call history, IMEI number, serial number, photographs, emails etc may require the provisions of a search warrant and/or telephone intercept warrant. Accessing the data may also affect the integrity of the evidence. Only access cell phone information if you have a legal right to do so and only if this access does not jeopardise the integrity of the evidence. If you are not sure, don’t do it.

Cell Phones Cell phones have become an integral part of our life. We not only make telephone calls on them we; Take photographs with them We send and receive email messages on them We organise our lives with them.

Importance for Investigators Cell phones can provide crucial evidence to a crime through evidence gathered from analysing the phone. They can place a suspect in the vicinity of a crime. They can show us who their associates are. They can tell us a lot about how the criminal lives.

‘Watch this video’

What did you see?

What he photographed with his phone

Derek Medina FACEBOOK KILLER

Accessing Information Treat the telephone like a CRIME SCENE. The preferred methods of examining a cell phone are; By your agencies forensic services section. An accredited external Forensic Services Agency. An officer who is trained and equipped to analyse cell phones.

Additional Evidence Emails Address Book SMS history Call History Social Media Notes Recordings Photographs Bank Account Details GPS data

Unique Information I.M.E.I. Number - Phone I.M.I.S. Number – Sim Card Cell Phone Number – Sim Card Serial Number – Phone Serial Number – ICCID Sim Card PUK Code – Sim Card Password – Phone. PIN number – Sim Card SKU number - Phone

I.M.E.I. Number International Mobile Station Equipment Identity number. Unique to each phone handset. Used to identify if a stolen phone is using the network. What SIM cards have been used in a handset.

How to find the IMEI Number Open the phone and it is usually printed inside the battery compartment. If you don’t want to open the phone, or can’t, dial *#06# Criminals will try and change the IMEI number – websites

Sim Cards Subscriber Identity Module. The phone number attached to the SIM card. The SIMs unique serial number – Integrated Circuit Card Identifier (ICCID). Two passwords. One for the user and one for the service provider (PUK code).

How to find the phone number? Sometimes a criminal will not tell you the number of their cell phone. Check their address book. Dial 1800 801 920 Do not ring from your own phone number.

RECORDING EVIDENCE We want to be able to show who had possession or who used the cell phone. We can do this by; Check on SIM card. Check on IMEI number. Address book. Contents of SMS messages. Calls made to and from the cell phone. From photographs/videos stored on the phone. From applications used/stored on the phone.

Criminals take photos with their phones

Forensic Analysis Tools

Forensic Analysis Example of Forensic Analysis to be inserted here.

Manual Analysis of a Cell Phone Things you will need: Camera - Still/Video Notepad Suitable background Photo board. Be aware of reflections off the phone. Remember to wear gloves.

STEP 1 PHOTO BOARD NAME: Person of Interest DATE EXAMINED: ???? OFFENCE: Murder/Drugs etc PHOTOGRAPHER: Rank Officers Name/Reg. O.I.C: Rank Officers Name/Reg. EXHIBIT REF: ???

Photoboard

Template Photograph number. Date photo taken. Time photo taken. Who took the photo. Description of what the photo shows.

Example 1

Sim Card

Pin Code and Screen Shot

Address Book

Contact Details Contact name of Boss. Phone number of +856204569631 +856 – Lao PDR Business name of XAYSAVANG TRADING COMPANY

SMS Message Logs What numbers have sent or received SMS messages from. Here we have a number +61406174795 sending a text message to the phone.

Message Details

Call Log We can see that our phone has made; 1 phone call to 0406174795 Sent 2 SMS to 0406174795 Received 2 SMS from 0406174795. Times call was made and messages sent.

Call Details A call to 0406174795 at 7.43am for 0 seconds. A call to 0406174795 at 6.24am 51 second duration. Text message sent to 0406174795 at 6.21am.

Applications Gallery. Calender. Emails. Internet. Google. Downloads.

Gallery

Messenger Applications This phone has WhatsApp. But could also include; Line Facebook Twitter TextMe

Reflections Gloves Remember to be aware of reflections from light sources and the camera flash. Remember to wear gloves.

Beware…..you may find some strange things when you analyse phones!!

Thank you! Questions? UNODC Regional Centre for East Asia and the Pacific United Nations Building 3rd floor, B Block Rajdamnern Nok Avenue Bangkok 10200 Thailand Tel: (+662) 288.1292 Fax: (+662) 288.2129 http://www.unodc.org/eastasiaandpacific