Friday, November 28, 2008

Radio Tactics New Offices

Radio Tactics New Offices
.
I received an invitation recently from Radio Tactics inviting me to attend on the 21st November 2008 in Southamption for the opening of their new offices. The Rt Hon. John Denham MP Secretary of State for Innovations, Universities and Skills was invited to formally open the offices at Millbrook Technology Campus and there was an impressive list of speakers to talk about how technology and crime detection can work hand-in-hand, which is always useful to hear the experiences of the guest speakers.
.
What struck my eye as well, and which I thought was a nice touch, as many of my family on my Mother's and Father's side were in the Military and RAF, was the promotion of Help for Heroes, http://www.helpforheroes.org.uk/ given by Col DCN Giles and Brigadier (Ret'd) Ian Fulton, both of RMP. What a wonderful cause this really is and how amazingly and tirelessly they work to help rehabilitate the severely injured brave men and women of our armed forces, who do so much to protect our country. Do visit the Help For Heroes website and read what they are doing, who knows, you may get involved as so many others have done and new supporters are doing so.

It was good to meet up again and see familiar faces from some of the Police mobile phone specialist units and to learn more about Radio Tactics vision of the future. DCI Susan Southern West Midlands Police gave a very good presentation how they are effectively using RTL's IMEI detectors to seek out stolen handsets.

Andy Gill greeting John Denham (above) and (below) John Denham opens the offices whilst RTL's Neil Maitland ably assists


In chatting with John he spoke about how small businesses are the backbone of the UK and how they can apply for grants that are within the gift of this Government and learned more about the focus of his Ministry, Innovation, Universities and Skills. I remember John, as Chairman of the House of Commons Committee dealing the Terrorism of Detention Powers, and talking with him again I remembered what a thoroughly personable man he is particularly when he remembers the names of those who he has spoken to in the past, which is a good quality when you think he must meet so many people in his work. I was lucky enough to snatch a photo opportunity with John and Dr James Hart, Ex. Commissioner of City of London Police.

(L to R) Dr James Hart, Chairman of RTL, Rt Hon John Denham MP and Greg Smith.


Mobile Phones and Fringe Coverage

Mobile Phones and Fringe Coverage

.
I have this habit with mobile phones and cell coverage that when I see something that interests me, even if I am holiday, I have to see what I can find out about it there and then. Whilst on holiday in Cornwall I noticed the area I was staying had fringe coverage. I thought this was strange as I would have expected to find the Cornish village of Mousehole to have at least a microcell, given the popularity of this tourist attraction to see the Mousehole Lights at Christmas. I decided to conduct an experiment to see how various mobile phones would react under fringe coverage radio conditions. I used no special equipment, nor did I switch ON an network engineering software. The mobile phones were as any ordinary user would have them and the radio conditions with which they would be faced. Yes, I know I know, I can be a bit of an anorak at times.


1. The place I was staying was Duck Street, Mousehole, Cornwall. Accessed at one end by a no through road for cars to use a car park and Duck Street narrows to an alley for pedestrians and no access for cars.
2. The place in Duck Street where I conducted tests is in a car park that has been marked with a black cross (X) in the photo above. The close proximity of clutter (housing and a warehouse) falls within the clutter range of 10m to 30m in line with propagation models for dense to urban areas (ITU-R P.1546-2)

3. The above image displays how far Mousehole extends and the terrain clutter, along with natural phenomenon.

4. This last image provides an approximate indication of how far the main town of Penzance is from Mousehole and the general area where the Masts were located.
.
Okay, so I have now laid out the background to the tests. For the tests I used three mobile phones, all with built-in antennas, which were a Motorola Pebble U6 (which I nicked off my wife, much to her annoyance), Alcatel BH4 735 and a Nokia 3210. I ran tests at different times of the day (morning, afternoon and evening) and with three battery charge levels (charge in battery nearly empty, charge in battery half full and fully charged battery). The GSM networks were Orange, T-Mobile, O2 and Vodafone. The test area as has been shown is at para 2, above.
.

An interesting factor I noted was that all network coverage there was fringe all day, so that was the first matter. The second, and of far more interest, was how the mobile phones reacted to the radio conditions profiling the phones when switched ON.
.
Motorola Pebble U6:
Displayed 'No Service Available'. No calls or texts could be sent or received.
.
Nokia 3210:
Displayed 'Emergency Calls Only'. No calls or texts could be sent or received.
.
Alcatel BH4 735:
Displayed 'One bar of coverage and, intermittently, no coverage'. Attempted made and received calls either rang and when answered no voice communication and/or call dropping. However, surprise, surprise I could send and receive text messages.
.
Now, bearing in mind all the tests were being conducted in the same area, yet varying results obtained indicated alot about the various sensitivity of the antennas for these mobile phones. Technically, the BER of 2% for the measurement where the received signal strength is at a standard -100dBm and that a c-value would not be obtained, theoretically, below the reference BTS1 (-105dBm). I hear, though, that because of the loose wording in the standard -112dBm has been noted in some cases. Surprising, yes, but not in the realms of fantasy as GSM defines a mask lower level received signal strength, during testing, of -120dBm.
.

These very basic practical tests I conducted opens the door, though, to considering what could be extrapolated from the results when dealing with mobile telephone call records and Mast usage. For instance, if I were to conduct radio testing at this location where a person said they were for a particular call or text and I used a Motorola test handset, I may not get a positive result and may report back that not even a text could be sent from that location. Where then might the mobile phone be suggested to be located? What if a mobile phone is put nearer to the scene of a crime than it really was? What might be an inference drawn from that?
.
What may seem an ugly, awkward problem being raised here, is indeed not as bad as it seems. It really requires taking pragmatic steps before going to site to find out what mobile phone the person was using at the material time and then formulate from there how the tests should be conducted. There are other considerations, of course, to be taken into account, as well.
.
Acknowledgement: the screen images were obtained using Google Maps:
http://maps.google.co.uk/maps?hl=en&tab=wl

CSA: From Ockham's (Occam's) Razor to Checking Masts

CSA: From Ockham's (Occam's) Razor to Checking Masts

Creating a 'de facto' standard is always going to be a hard job and none more so than when dealing with 'Cell Site Analysis', abbreviated to the acronym 'CSA'. The objective of the analysis is, as best possible; to determine a likely or approximate location of a particular mobile station (MS) at the material date and time of a call. There are a large and varied number of issues to be considered when entering into cell site analysis. Cell site analysis, or CSA, is not a precise science and this has largely lead many people to misconstrue how cell site analysis can be conducted and for those who require to make an interpretation about the interpretation being given by an expert, giving evidence, leads to mistrust about cell site analysis. So it all becomes rather a vicious circle of events, with few conceding their comprehension about the fragility and instability of the stance they have adopted.

CSA is a highly intelligent science, and an evolving forensics science at that, also. CSA has many elements in its foundation that are based on scientifically proven facts. For instance, the scientifically proven fact that 0-dBm (deciBel milliwatt) always equals 1-mW (milliWatt) of power (energy) is but one good example. Furthermore, such a scientific fact allows experts to make the declaration that each result in the measurements obtained are 'absolute' and can be demonstrated as 'relative' when compared alongside other 'absolute' results.

Given that CSA extends beyond obtaining measurements and extends also into the arena of the radio spectrum, radio protocols, beamforming etc and the infrastructure required to propagate and provide a service, this, too, is an area where many scientifically proven facts and mandatory requirements exists. This again leads to forming conclusions without the need of the expert to make assumptions.

The area where CSA needs assistance is to rely upon human intervention and that requires having deep knowledge of the subject matter and solid skillsets. Again, this does not require the person to make assumptions, but to demonstrate the possibilities and potential conclusions that may help inform a Court in order that the Court can arrive at its own conclusions.

There are indeed some useful scientific philosophy dictums that can aid and support a CSA practitioner that can be adopted when striving for the aim of being 'objective', in addition to ‘independent’ and ‘impartial’, and one of the most important of these is Ockham's (Occam's) Razor attributed to the distinguished 14th century medieval logician and philosopher William of Ockham (c1285-1349). 'Leff, Gordon'; in his 1958 work 'Medieval Thoughts: St Augustine to Ockham' enunicated the so-called Ockham's Razor as 'entities ought not to be multiplied except of necessity'. However, the use of the term 'Razor' in reference to a rather superficially simple phenomenon having a complex mechanism behind it, did not appear until after Ockham's death and, although he didn't invent it, it is the frequency, apparently, with which he used the phenomenon 'should make as few assumptions as possible' in his writings that associates Ockham to this dictum. This can be clearly seen from the dictum commonly associated with the Ockham (Occam's) Razor 'Numquam ponenda est pluralitas sine necessitate', translated, means, 'Plurality ought never be posited without necessity'. How incredible, within six words, he encapsulates in that sentence that a simple explanation would be simplistic if it failed to capture all the essential and relevant parts. It is essential to understand that language and meaning were still developing in the 14th Century and care in translation in relation to subject matter statements makes Ockham's statement even more incredible, for his comments crossed boundaries unlimited to specific subject matter. Ockham probably drew inspiration from earlier philosophers such as Aristotle (384–322 BC), Alhazen (965-1039), Maimonides (1138-1204), Thomas Aquinas (c. 1225–1274) and John Duns Scotus (1265–1308), the latter who Ockham, it has been suggested, studied under him at Oxford.

Essential to Ockham's philosophy, who later, it is suggested, influenced philosophers such as Francis Bacon, is an interpretation given to his work that, when arriving at a conclusion, it is on the basis that 'facts' have already been considered before a conclusion is drawn. It is that philosophy that relates to CSA practitioners, for invariably it is not the conclusion the expert arrives at but what is required to be known is how s/he got to a particular conclusion in the first place that will be tested. By way of illustration, my report in a recent case asked the question that prior to testing what enquiries were made to the mobile network operator as to what alterations had occurred at the Masts prior to conducting radio test measurements, and can the defence please have copies of the operator's written responses?

The question went to the heart of the matter regarding accuracy of test results that underpin the opinion. Significantly, it is the prosecution that deserves praise for their benchmark standard they set in the Soham Murder case of Jessica and Holly and the subsequent conviction of Mr Huntley. I was not in that case, but as I understand it for the prosecution to show how Mr Huntley had used his mobile phone required the resurrection (I believe) of a decommissioned Mast and all the other Masts with a coverage footprint illuminating towards Mr Huntley's property to have been aligned so as to be the same as it was at the material time of mobile calls. This was required, as I understand it, in order to show the mobile telephone evidence had 'weight' and 'substance' and to avoid it being kicked out of evidence were it the case that Masts were generating coverage that would be incompatible with cell coverage at the material time. I have to say I am pro-prosecution on that landmark work and it is important to give praise where it is due. It does also mean, though, that the prosecution has established a precedent for standard of workmanship for a murder case, albeit in a high profile case, and set a marker that they will work to, and would not retract from, that standard for murder cases, at least. So it is clear why I would naturally request in a murder case what checks had been made to the mobile network operator regarding changes they had made to their Masts before the prosecution expert went on to conduct tests?

No names, no pack drill, just suffice to say the defence were told operators had 'no obligation' to keep records and, if they did keep records, were found on occasions to be inaccurate so they didn't ask, was the general thrust of the response. Really! What, no requirements under the Public Mobile Operators Licence (PMOL) to retain records about a Mast up to six months after it had been decommissioned? So how on earth could OFCOM ever check matters of interference to emergency frequencies bands from an unstable Mast if operators simply ditched their records or kept unreliable records? More importantly, what does this say about historical matters?

So does the approach in that recent murder case affect the previous prosecution benchmark approach? In my opinion, No it doesn't, and I have considerably more faith in the prosecution than that. The mobile network operator's witness provided to the court evidence of logs they regularly and continuously retain about changes to their base stations. Interestingly, on and prior to the dates of radio tests being conducted in that murder case the operator had in fact been making changes at some of the Masts targeted for their cell footprint.

Now, if I am picking that up in just one case, what is happening in other cases that have or are being rammed through the Court system to hit targets and what checks have or are being made regarding accuracy?

Of equal importance, the positive aspects coming out of cases like this means we can start to build a ‘de facto’ standard as we know the things that are required to be done.

Wednesday, November 26, 2008

Mobile Phone that fires bullets

Mobile Phone that fires bullets
For those that read today's Daily Mail 26th November 2008 or went online to Mail Online, will probably have noticed the article titled "Dial M for murder: The Mafia gun disguised as a mobile phone" By Nick Pisa. The weblink to the article is below:

http://www.dailymail.co.uk/news/article-1089355/Dial-M-murder-The-Mafia-gun-disguised-mobile-phone.html

This mobile phone gun has been news for quite sometime, although there have been few incidences where there have been published newspaper reports and therefore the Daily Mail and Mail Online article make useful historical reference material.

Indeed, there has been a video in circulation on the Internet about a mobile phone gun for quite sometime and a copy of the video is below.

video

It is for that reason why this mobile phone weapon is discussed in the section on safety first when handling mobile phone weapons in the TrewMTE Mobile Telephone Seizure Procedure guidelines and observations for examiners who may come across such a weapon. The guidelines will soon be finished but there have been some new developments in mobile phone seizure and handling procedures that require to be addressed before publication.

Acknowledgements:
Video first linked to here: http://images.google.co.uk/images?hl=en&q=cellphonegun&gbv=2
Image first linked to here: http://images.google.co.uk/images?hl=en&q=cellphonegun&gbv=2

Tuesday, November 18, 2008

Ultra-thin membrane changes (U)SIM card usage

Ultra-thin membrane changes SIM card usage

Examiners may come across an ultra-thin (0.3mm) membrane that lays over the contacts of a SIM card. Called the V200 SIM Dialer, the membrane is "Prefix base programmable (For routing prefix and bypass prefix setting)". What does that mean? Well, it allows mobile phones installed with SIM Tool Kit menu (most up to date phones have them) and define access to the network. The point being, if you are looking for least-cost routing for calls or want to use a calling card, rather than have mobile network call charges, then this device makes that happen, apparently.

How does it do it? "Dial the desired number directly each time you call, SIM dialer V200 will automatically dial IP access in front of the dialed number".
As the manufacturer promotes, using their device will not change your dialling habits and there is "No cutting, No pounching your SIM".

As the device has been programmed, and looking at the on-board chip, there should be a reader for it or one could be constructed. This throws me back to the old days of ponyprog and PIC basics. Of course, of equal importance is how does this device impact when examining the handset and SIM card? Will manual examination be the only course for examination or do the current handset and SIM readers detect changes this device makes to them? What evidence is there for call history or data usage? These are just a few of the questions to get examiners started.


It seems this programmable ultra-thin membrane is not limited to just SIM calls, but there is a USIM version (U-SIM V33G) that can be used to unlock iPhones. There is a video that is useful to watch so that examiners can at least comprehend how ultra-thin the membrane is and how it is installed:-
http://tw.youtube.com/watch?v=JQSNJxis7Ds



Please note, this is not a promotion or advert for these products, the information provided is to assist examiners with observations about these devices that may form part of their evidence.

Ultra-thin membrane changes (U)SIM card usage

Ultra-thin membrane changes SIM card usage

Examiners may come across an ultra-thin (0.3mm) membrane that lays over the contacts of a SIM card. Called the V200 SIM Dialer, the membrane is "Prefix base programmable (For routing prefix and bypass prefix setting)". What does that mean? Well, it allows mobile phones installed with SIM Tool Kit menu (most up to date phones have them) and define access to the network. The point being, if you are looking for least-cost routing for calls or want to use a calling card, rather than have mobile network call charges, then this device makes that happen, apparently.

How does it do it? "Dial the desired number directly each time you call, SIM dialer V200 will automatically dial IP access in front of the dialed number".
As the manufacturer promotes, using their device will not change your dialling habits and there is "No cutting, No pounching your SIM".

As the device has been programmed, and looking at the on-board chip, there should be a reader for it or one could be constructed. This throws me back to the old days of ponyprog and PIC basics. Of course, of equal importance is how does this device impact when examining the handset and SIM card? Will manual examination be the only course for examination or do the current handset and SIM readers detect changes this device makes to them? What evidence is there for call history or data usage? These are just a few of the questions to get examiners started.


It seems this programmable ultra-thin membrane is not limited to just SIM calls, but there is a USIM version (U-SIM V33G) that can be used to unlock iPhones. There is a video that is useful to watch so that examiners can at least comprehend how ultra-thin the membrane is and how it is installed:-
http://tw.youtube.com/watch?v=JQSNJxis7Ds



Please note, this is not a promotion or advert for these products, the information provided is to assist examiners with observations about these devices that may form part of their evidence.

Monday, November 03, 2008

Counterfeit Mobile Phones

Counterfeit Mobile Phones

Many thanks to my good friend Vinny Parmar for this contribution he has made exclusively to http://trewmte.blogspot.com.


Vinny has prepared a report for the webblog about "Dummy" mobile phones that are counterfeit Nokia N95, which are currently in circulation. His expert report is well illustrated and Vinny imparts good advice inkeeping with his long term expertise and experience when dealing with mobile telephone examinations.

Vinny's report can be downloaded from the following link:

http://www.filebucket.net/files/7173_hzc7c/Counterfeit%20N95%20Report.pdf

Sunday, November 02, 2008

.DT1 Files

.DT1 Files

Why is this electronic file extension (.DT1) and significantly the data it contains important to the law of evidence and its relevance to generated original material obtained in criminal cases, but equally for civil cases, too? I will tell you more about that soon, its introduction into evidence and the technical and evidential arguments raised to get into evidence.

For now, what you can know is it is important to cell site analysis and here is a clue about the device that generated it.


Saturday, November 01, 2008

Cloning Test SIM Cards

Cloning Test SIM Cards
.
Cloning test SIM cards can present problems if their use is not carefully monitored and can lead to loss of data from a device under test (DUT). There appears many different instances under which the loss of data can occur when using a cloning test SIM card. Some examples are:
.
- The inadequate level of notice and advice within the applications that create the clone test SIM card to precisely define that a particular Make/Model of handset has been tested using the cloning application before using with a partricular Make/Model or where the guide generally infers the application is usable with a particular Make.

.
- Whether the cloned test SIM card has been correctly recorded or not, before inserting it into the device under examination (DUT).

.
- The 'trial and error' approach being applied to evidential mobile phones leading to loss of data, where the written advice in the guide, when given, doesn't deal with the examination problem at hand.

.
Taking one example of a mobile phone examination problem relating to the Samsung D880.
.

.
This mobile phone is capable of having two SIM cards inserted, at the same time, in order to allow for two different subscriber accounts to be used separately by a user. To understand the difference compare the position when dealing with the traditional way of having to manually swop a SIM card with another in a device that is a single-inserted SIM card operating mobile phone.
.

Once the user has selected to use one of the two SIM Cards inserted, the option to switch to a particular SIM in normal user mode is via the 'SIM selection key' with visual Icons displayed on the device's screen confirming which SIM and subscription account is in use.

Problematical for the examiner using cloned test SIM cards is what is the safest method for examining a dual SIM card mobile phone. Looking at some options, what problems can arise for the examiner:


1) Take out one of the user SIM cards and produce a cloned test SIM card, whilst leaving the other user SIM card in place? Then insert the new clone test SIM card and then examine the phone? It is unlikely this could work well because an original user SIM card is still in place, thus the mobile phone could still register to the network etc. That is so, because the examiner doesn't know which SIM and subscription account was last used by the mobile phone. The notion of switching the mobile phone 'ON' prior to using a cloned Test SIM card to find out begs the question why is the examiner using cloned test SIM cards in the first place?


2) Take out both user SIM cards and produce two cloned test SIM cards, but insert only one test card and examine on that basis? This might work, provided of course the examiner has selected for access the right SIM slot and subscription account, which is a bit 'trial and error', 'hit and miss'? Moreover, assuming the above method had worked and the examiner safely selected the correct SIM slot/account - for example by taking the pragmatic step of recording which user SIM came out of which slot and replacing the correct cloned test SIM card into the slot - what happens when the second cloned test SIM card needs to be inserted? Using the SIM selection key to switch to another SIM card may not assist because there isn't a cloned test SIM card in the second slot for the device to read any details. Moreover, bearing in mind the device memory has noted only one SIM inserted the first time around what impact might now happen if a second cloned test SIM card is inserted? Will it allow access to the subscriber account user data on the device? Furthermore, what happens when switching over to the other cloned test SIM card?



3) Inevitably, the line of reasoning in this discussion is intended to bring the reader's attention to the option of putting both cloned test SIM cards into the appropriate SIM slots and examining further from that standpoint. But what happens then if the device does not give up its riches and enables the examiner to gain access to the user data? Turning to the cloned test SIM cards guides, what if they provide no assistance at all? What if the cloning application may not record properly to the cloned test SIM card or the data that it does record are insufficient for a particular make and model of mobile phone to function in the way it is expected?
.
In each of the above cases where loss of data might occur, that is to say e.g. where no call history or text messages are accesible, it may not be because the user has deleted them or the user has gone to settings to set a calendar event to delete texts or clear call history on a date and time, but may be because the cloned test SIM card may have removed access to them and the examiner may not be aware of that until either using a device reading program or conducting manual examination.

.
The presumption suggested that the examination and the tools used to recover data from a device were functioning properly and without flaw at the time of the examination arising from the mobile phone data being served in evidence, inferring that it is safe to rely on, may not meet the maxim omnia praesumuntur rite esse acta, as expressed by Lord Griffiths in the case of R .v. Shepherd [1993] AC380. That can be so because it has never simply been solely about whether the original device (exhibit) was working properly at the material time, but of equal significance whether in the obtaining and the processes used to obtain data that the evidence is safe to rely on. The latter requirement did not disappear in the wake of the repeal of section 69 Police and Criminal Evidence Act 1984. Nor did it disappear by the introduction of the Criminal Procedures and Investigations Act 1996, The Police Act 1997, The Regulation of Investigatory Powers Act 2000 and so on.

.
The purpose of raising this discussion (for examiners and students) about mobile phone forensic examination and tools it that discussions on these types of topics are not simply about providing answers and solutions to problems, but identifying potential questions that need to be adddressed before using cloned test SIM cards.

.
Lastly, I have not described every event dealing with the examination of a dual SIM card mobile phone or how Samsung D880 manages the operation and functionality of both SIM cards. By not referring to these matters it has helped simplify and refine the discussion to keep the important points to the fore.

Cloning Test SIM Cards

Cloning Test SIM Cards
.
Cloning test SIM cards can present problems if their use is not carefully monitored and can lead to loss of data from a device under test (DUT). There appears many different instances under which the loss of data can occur when using a cloning test SIM card. Some examples are:
.
- The inadequate level of notice and advice within the applications that create the clone test SIM card to precisely define that a particular Make/Model of handset has been tested using the cloning application before using with a partricular Make/Model or where the guide generally infers the application is usable with a particular Make.

.
- Whether the cloned test SIM card has been correctly recorded or not, before inserting it into the device under examination (DUT).

.
- The 'trial and error' approach being applied to evidential mobile phones leading to loss of data, where the written advice in the guide, when given, doesn't deal with the examination problem at hand.

.
Taking one example of a mobile phone examination problem relating to the Samsung D880.
.

.
This mobile phone is capable of having two SIM cards inserted, at the same time, in order to allow for two different subscriber accounts to be used separately by a user. To understand the difference compare the position when dealing with the traditional way of having to manually swop a SIM card with another in a device that is a single-inserted SIM card operating mobile phone.
.

Once the user has selected to use one of the two SIM Cards inserted, the option to switch to a particular SIM in normal user mode is via the 'SIM selection key' with visual Icons displayed on the device's screen confirming which SIM and subscription account is in use.

Problematical for the examiner using cloned test SIM cards is what is the safest method for examining a dual SIM card mobile phone. Looking at some options, what problems can arise for the examiner:


1) Take out one of the user SIM cards and produce a cloned test SIM card, whilst leaving the other user SIM card in place? Then insert the new clone test SIM card and then examine the phone? It is unlikely this could work well because an original user SIM card is still in place, thus the mobile phone could still register to the network etc. That is so, because the examiner doesn't know which SIM and subscription account was last used by the mobile phone. The notion of switching the mobile phone 'ON' prior to using a cloned Test SIM card to find out begs the question why is the examiner using cloned test SIM cards in the first place?


2) Take out both user SIM cards and produce two cloned test SIM cards, but insert only one test card and examine on that basis? This might work, provided of course the examiner has selected for access the right SIM slot and subscription account, which is a bit 'trial and error', 'hit and miss'? Moreover, assuming the above method had worked and the examiner safely selected the correct SIM slot/account - for example by taking the pragmatic step of recording which user SIM came out of which slot and replacing the correct cloned test SIM card into the slot - what happens when the second cloned test SIM card needs to be inserted? Using the SIM selection key to switch to another SIM card may not assist because there isn't a cloned test SIM card in the second slot for the device to read any details. Moreover, bearing in mind the device memory has noted only one SIM inserted the first time around what impact might now happen if a second cloned test SIM card is inserted? Will it allow access to the subscriber account user data on the device? Furthermore, what happens when switching over to the other cloned test SIM card?



3) Inevitably, the line of reasoning in this discussion is intended to bring the reader's attention to the option of putting both cloned test SIM cards into the appropriate SIM slots and examining further from that standpoint. But what happens then if the device does not give up its riches and enables the examiner to gain access to the user data? Turning to the cloned test SIM cards guides, what if they provide no assistance at all? What if the cloning application may not record properly to the cloned test SIM card or the data that it does record are insufficient for a particular make and model of mobile phone to function in the way it is expected?
.
In each of the above cases where loss of data might occur, that is to say e.g. where no call history or text messages are accesible, it may not be because the user has deleted them or the user has gone to settings to set a calendar event to delete texts or clear call history on a date and time, but may be because the cloned test SIM card may have removed access to them and the examiner may not be aware of that until either using a device reading program or conducting manual examination.

.
The presumption suggested that the examination and the tools used to recover data from a device were functioning properly and without flaw at the time of the examination arising from the mobile phone data being served in evidence, inferring that it is safe to rely on, may not meet the maxim omnia praesumuntur rite esse acta, as expressed by Lord Griffiths in the case of R .v. Shepherd [1993] AC380. That can be so because it has never simply been solely about whether the original device (exhibit) was working properly at the material time, but of equal significance whether in the obtaining and the processes used to obtain data that the evidence is safe to rely on. The latter requirement did not disappear in the wake of the repeal of section 69 Police and Criminal Evidence Act 1984. Nor did it disappear by the introduction of the Criminal Procedures and Investigations Act 1996, The Police Act 1997, The Regulation of Investigatory Powers Act 2000 and so on.

.
The purpose of raising this discussion (for examiners and students) about mobile phone forensic examination and tools it that discussions on these types of topics are not simply about providing answers and solutions to problems, but identifying potential questions that need to be adddressed before using cloned test SIM cards.

.
Lastly, I have not described every event dealing with the examination of a dual SIM card mobile phone or how Samsung D880 manages the operation and functionality of both SIM cards. By not referring to these matters it has helped simplify and refine the discussion to keep the important points to the fore.