Transcription
10/19/2017Cell Phone Location Evidence for Legal ProfessionalsLarry DanielDFCP, EnCE, ACE, AME, BCE, CTNS, CTA, CWALocating Cell Phones Least Precise to Most Call Detail Records (Drive Testing) Google Location Services E‐911 Records Phone Based Location Find my iPhone2 of 68Call Detail Records“The Evidence”3 of 681
10/19/2017Call Detail Records (CDRs) What are they? Legal proof of a service provided A technical road map of a call A financial transaction record4 of 68Call Detail Records (CDRs) How to get them Account holder can request with notarized letter Via subpoena Via discovery Always get copies of the original files Contact us for specific subpoena language It is free.5 of 68Call Detail Records (CDRs) How are they used? Associate a phone call with a cell tower Show connections between phone numbers Show frequency of connections Show “user” activity6 of 682
10/19/2017Call Detail Records (CDRs) What can they contain? Voice call activity Call forwarding information Text message transaction Data transactions7 of 68Call Detail Records (CDRs) How are they used? Most common type of evidence in “Cell Phone Location Maps” IMPORTANT You have the location of the cell tower, NOT the phone A tenuous relationship to the phone’s location NOT triangulation @#& (@!!!8 of 68Call Detail Records (Retention)CarrierSubscriberCall History OnlyCall History with TowersSMS Content"Precision Location"Verizon7‐10 Years7 YearsRolling 12 months3 to 10 days8 DaysAT&T/Cricket 7 Years7 Years7 YearsN/A8 DaysSprint10 Years18 Months18 MonthsN/A180 DaysT‐Mobile/Metro PCS3 to 5 years23 Months23 MonthsN/A23 MonthsUS Cellular7 YearsRolling 12 MonthsRolling 12 months3 to 5 DaysN/A9 of 683
10/19/2017Call Detail Records (AT&T)10 of 68Call Detail Records (Sprint)11 of 68Call Detail Records (Sprint atitudeLongitudeBTS ManufacturerSectorAzimuth1904322960 Metzerott RoadCollege ParkPrince George SMD20783 39.00546‐76.95705LUCENT11101904322960 Metzerott RoadCollege ParkPrince George SMD20783 1904322960 Metzerott RoadCollege ParkPrince George SMD20783 39.0054629043213801 Georgia Ave.Silver SpringMontgomeryMD20906 39.0877797‐77.0708293LUCENT129043213801 Georgia Ave.Silver SpringMontgomeryMD20906 39.0877797‐77.0708293LUCENT213529043213801 Georgia Ave.Silver SpringMontgomeryMD20906 39.0877797‐77.0708293LUCENT325539043211235 Oak Leaf Dr.Silver SpringMontgomeryMD20901 39.0411097‐76.9938997LUCENT1151539043211235 Oak Leaf Dr.Silver SpringMontgomeryMD20901 39.0411097‐76.9938997LUCENT213539043211235 Oak Leaf Dr.Silver SpringMontgomeryMD20901 39.0411097‐76.9938997LUCENT325549043249 Randolph Rd.Silver SpringMontgomeryMD20904 39.0761093‐77.00333LUCENT11549043249 Randolph Rd.Silver SpringMontgomeryMD20904 39.0761093‐77.00333LUCENT213549043249 Randolph Rd.Silver SpringMontgomeryMD20904 39.0761093‐77.00333LUCENT325559043215430 Old Columbia PikeBurtonsvilleMontgomeryMD20866 39.10889‐76.9366697LUCENT11559043215430 Old Columbia PikeBurtonsvilleMontgomeryMD20866 39.10889‐76.9366697LUCENT213559043215430 Old Columbia PikeBurtonsvilleMontgomeryMD20866 39.10889‐76.9366697LUCENT325512 of 684
10/19/2017What About Burner Phones?13 of 68Burner Phone F.A.Qs What are they? Pre‐Paid Phones No verification of identity needed No valid “Subscriber” information How to you get the records? Seller may reveal the phone company14 of 68Burner Phone F.A.Qs Getting the records Finding the carrier for the phone number www.fonefinder.net Who owns the number No Porting Information All burner phones have a phone company T‐Mobile Metro PCS Verizon Etc.15 of 685
10/19/2017Burner Phone F.A.Qs Getting the records Subpoena the carrier Pre‐paid phone records may be a shorterretention period than a post‐paid phone. 90 to 180 days in many cases16 of 68Cell Phones17 of 68The Flip Phone(Invented by Star Trek writers) Simplest form – Just a 2 way radio Newer form Calls Texts Some small apps18 of 686
10/19/2017The Smart PhonePowerful handheld computer Still a 2 way radio Plus Camera Texts Millions of Apps19 of 68How does a cell phone work?20 of 68Communications Walkie‐TalkieWhat’s the story,Roger!What’s the story,Roger!21 of 687
10/19/2017Registration On Power up Phone tunes to a known frequency andbegins to listen.22 of 68The Hook Up: Choosing a Tower How does thephone choosea tower?Pick me!No pick me!23 of 68The Hook Up: Choosing a Tower when equidistant, no way to know.3 miles3 miles24 of 688
10/19/2017The Hook Up: Choosing a Tower Occlusions25 of 68The Hook Up: Choosing a Tower Channels must be available Let it Snow!3 miles3 miles26 of 68Choosing a Tower: Moving Around Hand offs No record of intermediate hand offs May get starting and ending cell towers27 of 689
10/19/2017How the Cellular SystemWorks28 of 68www.guardiandf.com / 919‐868‐6291 / # of 51The Cellular System: Cell Site A Cell Site Antennas Send and receive signals to andfrom cell phones Base Station Transceiver Manages the tower and calls onthe tower Talks to the phone via networkcables30 of 6810
10/19/2017Cell Tower Sectors Sector Layout and Azimuth Cell towers can have from 0 to 6 sectors Most common is three sectors Azimuth is the direction the antenna points31 of 68Cell Tower Sectors Sector Layout and Azimuth32 of 68Cell Tower Sectors33 of 6811
10/19/2017Cell Tower Coverage34 of 68Cell Coverage Area size is determined by customerneeds More people, more towers More cows, less towers35 of 68Subscriber Density As subscribers increase: Coverage size per towergets smaller Each cell site may have 200channels (100 calls) Need more towers withsmaller radius versus onelarge tower.36 of 6812
10/19/2017How Far? How far can a cell phone be from a tower and stillmake or receive a call? Assuming a perfectly flat earth, extremely tall celltower, maximum legal power output, and no othercell towers in the area GSM (AT&T or T‐Mobile) 22 miles CDMA (Sprint, Verizon, etc.) 35 Miles Limiting factors Terrain, ground clutter, proximity of other towers,signal strength, cell phone being used, towerheight, radio frequency and the list goes on 38 of 68Real World Issues39 of 6813
10/19/2017ATT Radio Frequency Engineering Map of Air Coverage – Example40 of 68Example (Sprint Towers Dallas 1)41 of 68Example (Sprint Towers Dallas 2)42 of 6814
10/19/2017Example (Sprint Towers Ft Worth)43 of 68Example (Sprint Towers All )44 of 68Example (Sprint Towers All )45 of 6815
10/19/2017Example (Sprint Towers Atlanta)46 of 68Exampleswww.guardiandf.com / 919‐868‐629147 of 68Viewing KML / KMZ files What are they? Work product output from some policeand private experts Google Earth File format Can be opened using Google EarthProfessional Now a free program48 of 6816
10/19/2017Google Earth Professional49 of 68The Pie‐Slice!50 of 68The Pie‐Slice!51 of 6817
10/19/2017The Pie‐Slice! (1)52 of 68The Pie‐Slice! (2)53 of 68This is “expert” training?54 of 6818
10/19/2017Expert Analysis or Fantasy?55 of 68Call Detail Records: Insurance Case56 of 68Call Detail Records: Carjacking57 of 6819
10/19/2017Call Detail Records: Robbery58 of 68Call Detail Records: Murder59 of 68Case Example: CDR and Phone Location60 of 6820
10/19/2017Case Example: CDR and Phone Location61 of 68Drive testing62 of 68E‐911 Location63 of 6821
10/19/2017Google Location Services64 of 68Capabilities: Examples Google is watching Location activity Full route65 of 68Capabilities: Examples Google is listening Location activity Full route66 of 6822
10/19/2017Find my iPhone – Device Based67 of 68 www.guardiandf.com 919‐868‐6291 larry@guardiandf.comHighly qualified experts in computer, cell phone,cellular location, GPS, and cyber risk forensics.68 of 6823
Call Detail Records (Sprint) 12of 68 Call Detail Records (Sprint Towers) Cell# NEID Repoll# Address1 City County State Zip Latitude Longitude BTSManufacturer Sector Azimuth 1 90 432 2960 Metzerott Road CollegePa
