1. Cellular Records Review and Analysis Part 4: T-Mobile

2. PATCtech
Glenn K Bard, Chief Technology Officer Jim Alsup, Director – PATCtech Scott Lucas, Instructor and Examiner Brian Sprinkle, Case Manager and Software consultant Steve Dempsey, Instructor Kathy Enriquez, Instructor Stefani Lucas, Marketing Director Stacey Papa, Of Counsel Mark Tomallo, Network Architect

3. Glenn K. Bard Public Agency Training Council tech Chief Technical Officer
PA State Trooper – Retired
NCMEC – Project ALERT
CISSP, EnCE, CFCE, CHFI, A+, Network+,
Security+, ACE, AME

4. For Starters
What can we get from T-Mobile?

5. Cell phone technology
What can T-Mobile provide with appropriate legal process?
Call detail logs
Cell Sites accessed
Cell site sector Azimuth
Direction of call (incoming or outgoing)
Answered status
Service Code
Calling number
Dialed number
Call Time and duration
Location of cell tower 5

6. Cell phone technology Subscriber information (Name, address, etc)
SMS Dates and Times
IMEI, IMSI of target phone.
Phone Model
Tower dump
Definitions page (Key Codes)
Reports of Lost / stolen phone
If prepaid, where purchased?
Other phones on the same account
Cell sites at the time of the incident (Not current)
PCMD (Per Call Measurement Data) 6

7. Some important definitions
IMEI – International Mobile Equipment Identifier
IMSI – International Mobile Subscriber Identifier
MSISDN - Mobile Station International Subscriber Directory Number (It means your phone number)

8. Some important definitions
LAC / CID – This is the switch (LAC – Location Area Code) and tower along with side (CID – Cell ID) accessed
LTE Site ID – If the call was handled via LTE
Azimuth – The median of the sector accessed
MCC – Mobile Country Code
MNC – Mobile Network Code

9. Some important tips
Dates and times are in UTC – Universal Time Coordinated.
The records will come in Excel spreadsheets. But they can look a little different.
SMS information is supplied in the CDR’s. MMS information is NOT supplied.
SMS generally shows a duration of 60 seconds.
Pay special attention to in the Dialed Number column– That is voic .

10. Some important tips
T-Mobile has recently changed their records. For a long time they could not supply SMS locations, and in many instances were not able to supply sector information for calls. In the last few months the records have changed drastically.
Due to this make sure and pay special attention to their definitions page.
Dates and Times are in UTC

11. Some important tips
ALWAYS make sure you get Mediation records, especially if you got the records the night of the incident. Get a second set a week or two later. T-Mobile continues to receive information from switches days later, and not until the records are mediated are they complete.

12. Some new changes
If the call is over LTE, the EnodeBid column will be populated. The LAC / CID columns will be empty.
If the call did not go over LTE, the EnodeBid column will be empty. The LAC / CID columns will be populated.

13. T-Mobile
Contact information
Contact Name:
Gavin Pinchback, Director, Law Enforcement Relations Group
Online Service:
T-Mobile
Online Service Address:  
4 Sylvan Way Parsippany, New Jersey  07054 USA
Phone Number:
Address:
Note(s):
Metro PCS and T-Mobile are now one company. All subpoenas and preservation requests are routed to one location. Submit subpoena to: Requesting information about a subpoena or attempting to get an update on a subpoena Routine toll and subscriber requests can be requested from T-Mobile by using their address. They require a scanned or digital copy of a company letterhead fax cover sheet with the requested numbers, the type of response you are looking for (toll/subs) and the scanned court order / subpoena.

14. Warrant language For the T-Mobile records:
Address as T – Mobile, AKA T-Mobile America
Subscriber information for the number _____________ including name, date of birth, mailing address, alternate phone number, and other numbers on the same account.
All communication for the wireless number _______________ for the time period of _______________ to include cellular calls and SMS messages along with tower locations (LAC / CID or LTE Site ID) to include Switch / MSC / BSC / Cell Name and azimuth, as well as Azimuths for the sectors accessed during the communication. Also, identify the existence of any T Mobile cloud services associated with the wireless number of ____________________________ and provide any data held within the cloud to include SMS, MMS, and s communications. Additionally, supply PCMD (Per Call Measurement Data) aka “historical GPS Locations”, “Historical Handset Location data”, and “Handset triangulation data”. Also provide any IP (Internet Protocol Addresses) assigned to the device for the time period of _____________________. Lastly, provide a detailed definitions page which identifies all information in the records.
Please provide this information to Detective ________________ in digital format on a compact disc in Excel, PDF or TXT format.
Fax to:

15. Retention periods
Subscriber information: 5 years Call History: 2 years Tower Locations: 1 year SMS Content: NA Tower Dumps: 90 days PCMD: 14 days

16. Two Notes
TracFone sells phones that use the T-Mobile network, so the records must come from T-Mobile.
MetroPCS is now part of T-Mobile US.

17. Now let’s see some examples of what you can get: