Week 1

Question 1

Global System for Mobile Telecommunications (GSM)

Answer 1

A cellular network standard used by the overwhelming majority of mobile devices around the world.

Question 2

Uniquely identify GSM

Answer 2

Devices that follow the standard are identified by their serial number or IMEI number.

Question 3

International Mobile Equipment Identifier (IMEI)

Answer 3

A unique number given to every single
mobile phone. The length is typically 15
digits:

• TAC
• Serial Number
• Checksum

Question 4

Type Allocation Code (TAC)

Answer 4

An eight-digit decimal code that identifies the vendor and model of the mobile device.

Question 5

Serial Number

Answer 5

A six-digit number that uniquely identifies a specific unit manufactured by the vendor.

Question 6

Checksum

Answer 6

An optional algorithm computed against the TAC and serial number for authentication and to verify the integrity of the lMEl.

Question 7

Uniquely identify CDMA

Answer 7

Devices that follow the standard are identified by their ESN and MEID

Question 8

Electronic Serial Number (ESN)

Answer 8

An 11-digit decimal code or eight-character hexadecimal number used to uniquely identify the mobile device and equipment vendor (obsolete and is no longer issued to new mobile devices).

Question 9

Mobile Equipment Identifier (MEID)

Answer 9

A 15 digit hexadecimal number that uniquely identifies the mobile device (created to replace issuance of ESN).

Question 10

Subscriber Identification

Answer 10

In devices that follow the GSM/UMTS network standard , this data is located on the SIM card.

Question 11

Subscriber Identity Module (SIM)

Answer 11

A smart card that holds very important network data needed to make a successful connection to the cellular network provider.

3 files that can be analysed for identification:

• ICCID,
• IMSI,
• MSISDN;

Question 12

Integrated Circuit Card Identifier (ICCID)

Answer 12

A 19 or 20 digit serial number for the SIM card that uniquely identifies that particular SIM card.
Typically structured as:

• Major Industry Identifier (MII)
• Mobile Country Code (MCC)
• Issuer ID
• Individual Account lD
• Parity check bit (Checksum)

Question 13

International Mobile Subscriber Identifier (IMSI)

Answer 13

a 14 or 15 digit number that uniquely identifies a subscriber’s account with the cellular network provider.
Typically structured as:

• Mobile Country Code (MCC)
• Mobile Network Code (MNC)
• Mobile Subscriber Identification Number (MSIN)

Question 14

Mobile Station International Subscriber Directory Number (MSISDN)

Answer 14

An 11-digit number used to reach
the mobile device. This is the full phone number of a subscriber.
Typically structured as:

• Country Code (CC)
• Number Planning Area (NPA)
• Subscriber Number (SN)

Question 15

Code Division Multiple Access (CDMA)

Answer 15

Technology that uniquely identifies subscribers using the
Mobile Identification Number (MIN).

Usually, the MIN is the same value as the MSISDN, however, they may be different if the device is ported to a new network.

Question 16

2G Networks

Answer 16

Early generation, were 100% digital and allowed for encrypted conversations and transmission of data, enabling users to send and receive SMS text messages to each other for the first time.

Not very fast and typically could only transfer data at a maximum rate of approximately 56 kbit/second to residential subscribers.

*GSM 850, 900, 1800, 1900

Question 17

2G CDMA

Answer 17

Qualcomm initially developed this network in 1993. Typically only seen in the USA:

800, 1700, 1900, 2100

Question 18

3G UMTS Networks

Answer 18

Created to accommodate the boom in smartphone sales:

850, 900, 1900, 2100

Question 19

4G Networks

Answer 19

Introduced in 2006 with WiMAX and LTE in 2009.

Though not widely available, advertised data transfer rates of 2 ~ 20 Mbps are still being tested and verified.

Question 20

Base Stations

Answer 20

Cellular networks rely on these located in an area to provide the best coverage to mobile devices.

A cell is an area that is covered by three base stations and the subscriber can move within that cell and receive a network connection.

There may, however, be dead spots where no coverage exists depending on provider resources and the health of the base stations.

Each base station has a unique ID and has latitude/longitude coordinates that can be used to track connected mobile devices.

Question 21

WiFi

Answer 21

IEEE 802.11 specification defines this service for mobile devices and personal computers.

Specifications indicate that data
transfer can occur at speeds of up to 600 Mbit/s.

Question 22

802.16 (WiMax)

Answer 22

Wireless network standard capable of data transfer rates up to 1Gbit/s.

Typically utilized as a portable backup access point.

Question 23

Bluetooth

Answer 23

Wireless network standard designed to provide secure connectivity between devices to provide additional functionality.

• Keyboards
• Computer mice
• Headphones
• Connecting with other mobile devices

Question 24

Near-Field Communication (NFC)

Answer 24

Wireless standard used to share information securely between two compatible devices that are actually
touching or within very close proximity.

Popular with contactless payment.

Question 25

GPS

Answer 25

Wireless standard that provides global positioning coordinates from a satellite navigation system to compatible devices.

Question 26

Phases of Forensic Process

Answer 26

• Identification,
• Acquisition and Imaging of Storage Media,
• Analysis,
• Reporting

Question 27

Identification

Answer 27

The primary stage where a first responder arrives to a scene and identifies and collects evidence relevant to a digital investigation.

Question 28

Acquisition and Imaging of Storage Media

Answer 28

Digital evidence collected from a mobile device is acquired, either by obtaining a forensic copy or a logical extraction of data stored on a device (like a handset or a SIM card in a GSM phone).

Question 29

Analysis

Answer 29

Includes the processes and
procedures performed on the forensic evidence to examine, locate, and extract information related to the incident.

Question 30

Reporting

Answer 30

The process of documenting and presenting the findings of the analysis performed on the forensic evidence. This usually details the elements of the crime in a chronological, concise manner.

Question 31

Data Acquisition

Answer 31

To acquire data from mobile devices, forensic examiners use a variety of techniques, such as logical, file system, and physical extractions. A variety of commercial software tools are available. Examiners also work with cellular service providers to obtain call detail records.

Question 32

Data Analysis

Answer 32

Forensic examiners must then analyse the data acquired from a mobile device.

Analysis techniques include:

• Using background information provided by the first responders, detectives requesting assistance, or the complainant.
• Using commercially available research tools to conduct analysis of location-based data

Question 33

Reporting Findings

Answer 33

Examiners compile a forensic report detailing the entire investigation and forensics process.
Typically, a good report:

• Establishes background
• Documents the evidentiary chain of custody
• Identifies in detail, the seized media
• Documents the steps taken to preserve evidence
• Describes processes used to acquire and analyse
• Details findings