Cellular Records Review and Analysis Part 4: T-Mobile

Transcription

1 Cellular Records Review and Analysis Part 4: T-Mobile

2 PATCtech Glenn K Bard, Chief Technology Officer Jim Alsup, Director PATCtech Scott Lucas, Instructor and Examiner Brian Sprinkle, Case Manager and Software consultant Steve Dempsey, Instructor Kathy Enriquez, Instructor Stefani Lucas, Marketing Director Stacey Papa, Of Counsel Mark Tomallo, Network Architect

3 Glenn K. Bard Public Agency Training Council tech Chief Technical Officer PA State Trooper Retired NCMEC Project ALERT CISSP, EnCE, CFCE, CHFI, A+, Network+, Security+, ACE, AME

4 For Starters What can we get from T-Mobile?

5 Cell phone technology What can T-Mobile provide with appropriate legal process? Call detail logs Cell Sites accessed Cell site sector Azimuth Direction of call (incoming or outgoing) Answered status Service Code Calling number Dialed number Call Time and duration Location of cell tower

6 Cell phone technology Subscriber information (Name, address, etc) SMS Dates and Times IMEI, IMSI of target phone. Phone Model Tower dump Definitions page (Key Codes) Reports of Lost / stolen phone If prepaid, where purchased? Other phones on the same account Cell sites at the time of the incident (Not current) PCMD (Per Call Measurement Data)

7 Some important definitions IMEI International Mobile Equipment Identifier IMSI International Mobile Subscriber Identifier MSISDN - Mobile Station International Subscriber Directory Number (It means your phone number)

8 Some important definitions LAC / CID This is the switch (LAC Location Area Code) and tower along with side (CID Cell ID) accessed LTE Site ID If the call was handled via LTE Azimuth The median of the sector accessed MCC Mobile Country Code MNC Mobile Network Code

9 Some important tips Dates and times are in UTC Universal Time Coordinated. The records will come in Excel spreadsheets. But they can look a little different. SMS information is supplied in the CDR s. MMS information is NOT supplied. SMS generally shows a duration of 60 seconds. Pay special attention to in the Dialed Number column That is voic .

10 Some important tips T-Mobile has recently changed their records. For a long time they could not supply SMS locations, and in many instances were not able to supply sector information for calls. In the last few months the records have changed drastically. Due to this make sure and pay special attention to their definitions page. Dates and Times are in UTC

11 Some important tips ALWAYS make sure you get Mediation records, especially if you got the records the night of the incident. Get a second set a week or two later. T-Mobile continues to receive information from switches days later, and not until the records are mediated are they complete.

12 Some new changes If the call is over LTE, the EnodeBid column will be populated. The LAC / CID columns will be empty. If the call did not go over LTE, the EnodeBid column will be empty. The LAC / CID columns will be populated.

13 T-Mobile Contact information Contact Name: Gavin Pinchback, Director, Law Enforcement Relations Group Online Service: T-Mobile Online Service Address: 4 Sylvan Way Parsippany, New Jersey USA Phone Number: Address: LERINBOUND@T-Mobile.com Note(s): Metro PCS and T-Mobile are now one company. All subpoenas and preservation requests are routed to one location. Submit subpoena to: LERINBOUND@T-Mobile.com. Requesting information about a subpoena or attempting to get an update on a subpoena LER2@t-mobile.com. Routine toll and subscriber requests can be requested from T-Mobile by using their LER2@t-mobile.com address. They require a scanned or digital copy of a company letterhead fax cover sheet with the requested numbers, the type of response you are looking for (toll/subs) and the scanned court order / subpoena.

14 Warrant language For the T-Mobile records: Address as T Mobile, AKA T-Mobile America Subscriber information for the number including name, date of birth, mailing address, alternate phone number, and other numbers on the same account. All communication for the wireless number for the time period of to include cellular calls and SMS messages along with tower locations (LAC / CID or LTE Site ID) to include Switch / MSC / BSC / Cell Name and azimuth, as well as Azimuths for the sectors accessed during the communication. Also, identify the existence of any T Mobile cloud services associated with the wireless number of and provide any data held within the cloud to include SMS, MMS, and s communications. Additionally, supply PCMD (Per Call Measurement Data) aka historical GPS Locations, Historical Handset Location data, and Handset triangulation data. Also provide any IP (Internet Protocol Addresses) assigned to the device for the time period of. Lastly, provide a detailed definitions page which identifies all information in the records. Please provide this information to Detective in digital format on a compact disc in Excel, PDF or TXT format. LERINBOUND@T-Mobile.com Fax to:

15 Retention periods Subscriber information: 5 years Call History: 2 years Tower Locations: 1 year SMS Content: NA Tower Dumps: 90 days PCMD: 14 days

16 Two Notes TracFone sells phones that use the T-Mobile network, so the records must come from T- Mobile. MetroPCS is now part of T-Mobile US.

17 Now let s see some examples of what you can get: