You are now a computer forensics analyst and you are required to present your ca

Question

You are now a computer forensics analyst and you are required to present your case in court. Prepare a Forensics Report containing your analysis of the attached files obtained from Sebastian and Nau’s SIMcards and phones. Write a short report summarizing the data you examined and stating any conclusions you draw from the data about the case. Your report should be comprehensive and self-explanatory and should minimally include the following:

1) Definitions of IMSI, PLMN selector, HPLMN search period, CBMI and any items of interest.

2) Determine what “SIM Phase:phase 2-profile download required” means.

3) In the report for Nau’s phone, you should notice “Originating Address (TP-OA):264813358948”. What does the first two numbers 264 and 81 mean?

4) What do the following originating addresses mean?

Originating Address (TP-OA):123

Originating Address (TP-OA):131

5) A timeline for all the SMS messages.

Explanation / Answer

The International Mobile Subscriber Identity or IMSI/mzi/is utilized to distinguish the client of a cell arrange and is a one of a kind ID related with every single cell organize. It is put away as a 64 bit field and is sent by the telephone to the system. It is likewise utilized for gaining different subtle elements of the versatile in the home area enroll (HLR) or as privately duplicated in the guest area enlist. To counteract spies distinguishing and following the endorser on the radio interface, the IMSI is sent as once in a while as could be expected under the circumstances and a haphazardly created TMSI is sent.

The IMSI is utilized as a part of any portable system that interconnects with different systems. For GSM, UMTS and LTE arrange, this number is provisioned in the SIM card and for CDMA2000 in the telephone specifically or in the R-UIM card (the CDMA2000 simple to a SIM card for GSM).

An IMSI is generally introduced as a 15 digit number, however can be shorter (not longer). For instance, MTN South Africa's old IMSIs that are as yet being utilized as a part of the market are appeared as 14 digits. The initial 3 digits are the portable nation code (MCC), which are trailed by the versatile system code (MNC), either 2 digits (European standard) or 3 digits (North American standard). The length of the MNC relies upon the estimation of the MCC, and it is prescribed that the length is uniform inside a MCC area.[1] The rest of the digits are the versatile membership recognizable proof number (MSIN) inside the system's client base (for the most part 10 or 9 digits relying upon the MNC length).

The IMSI fits in with the ITU E.212 numbering standard.

An open land versatile system (PLMN) is any remote interchanges framework planned for use by earthbound endorsers in vehicles or by walking. Such a framework can remain solitary, yet regularly it is interconnected with a settled framework, for example, people in general exchanged phone arrange (PSTN). The most natural case of a PLMN end client is a man with a mobile phone. In any case, versatile and compact Internet utilize is additionally getting to be plainly normal.

EFPhase (Phase ID) - 3F00/7F20/6FAE

This EF contains data concerning the period of the SIM.

EFPHASE STRUCTURE

SIM Phase Coding:

'00': stage 1

'02': stage 2

'03': stage 2 and PROFILE DOWNLOAD required.

Every other coding are held for detail by ETSI TC SMG. Codings '04' to '0F' show that the SIM underpins, as a base, the compulsory prerequisites characterized in this detail.

This stage recognizable proof does not block a SIM to help a few highlights of a stage later than the one demonstrated in EFPhase. For instance : if EFPhase is coded '00', it might be accepted by the ME that some Phase 2 or Phase 2+ highlights are upheld by this SIM; if EFPhase is coded '02' or '03', it might be expected by the ME that some Phase 2+ highlights are bolstered by this SIM.

In any case, the administrations n°3 (FDN) as well as n°5 (AoC) should just be designated and enacted in SIMs of stage 2 or later with EFPhase being coded '02' or more noteworthy. Essentially, benefit n°31 (BDN) might just be allotted and initiated in SIMs with EFPhase being coded '03' or more noteworthy.

On the off chance that EFPhase is coded '03' or more prominent, a ME supporting SIM Application Toolkit should play out the PROFIL

Related Questions

Navigate

• Browse (All)
• Browse Y
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.