call detail records “the evidence” phone loca… · the cellular system: cell site •a cell...

10/19/2017

1

CellPhoneLocationEvidenceforLegalProfessionalsLarryDaniel

DFCP,EnCE,ACE,AME,BCE,CTNS,CTA,CWA

2 of68

LocatingCellPhones

• LeastPrecisetoMost• CallDetailRecords• (DriveTesting)• GoogleLocationServices• E‐911Records• PhoneBasedLocation• FindmyiPhone

3 of68

CallDetailRecords“TheEvidence”

10/19/2017

2

4 of68

CallDetailRecords(CDRs)

•Whatarethey?• Legalproofofaserviceprovided• Atechnicalroadmapofacall• Afinancialtransactionrecord

5 of68


• Howtogetthem• Accountholdercanrequestwithnotarizedletter• Viasubpoena• Viadiscovery

• Alwaysgetcopiesoftheoriginalfiles• Contactusforspecificsubpoenalanguage…Itisfree.

6 of68


• Howaretheyused?• Associateaphonecallwithacelltower• Showconnectionsbetweenphonenumbers• Showfrequencyofconnections• Show“user”activity

10/19/2017

3

7 of68


•Whatcantheycontain?• Voicecallactivity• Callforwardinginformation• Textmessagetransaction• Datatransactions

8 of68


• Howaretheyused?• Mostcommontypeofevidencein“CellPhoneLocationMaps”

• IMPORTANT• Youhavethelocationofthecelltower,NOT thephone• Atenuousrelationshiptothephone’slocation• NOTtriangulation@#&^(@!!!

9 of68

CallDetailRecords(Retention)

Carrier Subscriber Call History Only Call History with Towers SMS Content "Precision Location"

Verizon 7‐10 Years 7 Years Rolling 12 months 3 to 10 days 8 Days

AT&T/Cricket 7 Years 7 Years 7 Years N/A 8 Days

Sprint 10 Years 18 Months 18 Months N/A 180 Days

T‐Mobile/ Metro PCS 3 to 5 years 23 Months 23 Months N/A 23 Months

US Cellular 7 Years Rolling 12 Months Rolling 12 months 3 to 5 Days N/A

10/19/2017

4

10 of68

CallDetailRecords(AT&T)

11 of68

CallDetailRecords(Sprint)

12 of68

CallDetailRecords(SprintTowers)

Cell# NEID Repoll# Address1 City County State Zip Latitude Longitude BTS Manufacturer Sector Azimuth

1 90 432 2960 Metzerott Road College Park Prince George S MD 20783 39.00546 ‐76.95705 LUCENT 1 110



2 90 432 13801 Georgia Ave. Silver Spring Montgomery MD 20906 39.0877797 ‐77.0708293 LUCENT 1 15



3 90 432 11235 Oak Leaf Dr. Silver Spring Montgomery MD 20901 39.0411097 ‐76.9938997 LUCENT 1 15



4 90 432 49 Randolph Rd. Silver Spring Montgomery MD 20904 39.0761093 ‐77.00333 LUCENT 1 15



5 90 432 15430 Old Columbia Pike Burtonsville Montgomery MD 20866 39.10889 ‐76.9366697 LUCENT 1 15



10/19/2017

5

13 of68

WhatAboutBurnerPhones?

14 of68

BurnerPhoneF.A.Qs

•Whatarethey?• Pre‐PaidPhones

• Noverificationofidentityneeded• Novalid“Subscriber”information• Howtoyougettherecords?

• Sellermayrevealthephonecompany

15 of68

BurnerPhoneF.A.Qs

• Gettingtherecords• Findingthecarrierforthephonenumber

• www.fonefinder.net• Whoownsthenumber• NoPortingInformation

• Allburnerphoneshaveaphonecompany• T‐Mobile• MetroPCS• Verizon• Etc.

10/19/2017

6

16 of68

BurnerPhoneF.A.Qs

• Gettingtherecords• Subpoenathecarrier

• Pre‐paidphonerecordsmaybeashorterretentionperiodthanapost‐paidphone.

• 90to180daysinmanycases

17 of68

CellPhones

18 of68

TheFlipPhone

(InventedbyStarTrekwriters)• Simplestform–

• Justa2wayradio

• Newerform• Calls• Texts• Somesmallapps

10/19/2017

7

19 of68

TheSmartPhone

Powerfulhandheldcomputer• Stilla2wayradio• Plus

• Camera• Texts• MillionsofApps

20 of68

Howdoesacellphonework?

21 of68

Communications

•Walkie‐TalkieWhat’s the story,

Roger!

What’s the story, Roger!

10/19/2017

8

22 of68

Registration

• OnPowerup• Phonetunestoaknownfrequencyandbeginstolisten.

23 of68

TheHookUp:ChoosingaTower

• Howdoesthephonechooseatower? No pick me!

Pick me!

24 of68


•whenequidistant,nowaytoknow.

3miles 3miles

10/19/2017

9

25 of68


• Occlusions

26 of68


• Channelsmustbeavailable• LetitSnow!

3miles 3miles

27 of68

ChoosingaTower:MovingAround

• Handoffs• Norecordofintermediatehandoffs• Maygetstartingandendingcelltowers

10/19/2017

10

28 of68

HowtheCellularSystemWorks

www.guardiandf.com / 919‐868‐6291 / <#> of 51

30 of68

TheCellularSystem:CellSite

• ACellSite• Antennas

• Sendandreceivesignalstoandfromcellphones

• BaseStationTransceiver• Managesthetowerandcallsonthetower

• Talkstothephonevianetworkcables

10/19/2017

11

31 of68

CellTowerSectors

• SectorLayoutandAzimuth• Celltowerscanhavefrom0to6sectors• Mostcommonisthreesectors• Azimuthisthedirectiontheantennapoints

32 of68

CellTowerSectors

• SectorLayoutandAzimuth

33 of68

CellTowerSectors

10/19/2017

12

34 of68

CellTowerCoverage

35 of68

CellCoverage

• Areasizeisdeterminedbycustomerneeds

• Morepeople,moretowers• Morecows,lesstowers

36 of68

SubscriberDensity

• Assubscribersincrease:• Coveragesizepertowergetssmaller

• Eachcellsitemayhave200channels(100calls)

• Needmoretowerswithsmallerradiusversusonelargetower.

10/19/2017

13

38 of68

HowFar?

• Howfarcanacellphonebefromatowerandstillmakeorreceiveacall?

• Assumingaperfectlyflatearth,extremelytallcelltower,maximumlegalpoweroutput,andnoothercelltowersinthearea…

• GSM(AT&TorT‐Mobile)=22miles• CDMA(Sprint,Verizon,etc.)=35Miles

• Limitingfactors• Terrain,groundclutter,proximityofothertowers,signalstrength,cellphonebeingused,towerheight,radiofrequency…andthelistgoeson…

39 of68

RealWorldIssues

10/19/2017

14

40 of68

ATT Radio Frequency Engineering Map of Air Coverage – Example

41 of68

Example(SprintTowersDallas1)

42 of68

Example(SprintTowersDallas2)

10/19/2017

15

43 of68

Example(SprintTowersFtWorth)

44 of68

Example(SprintTowersAll)

45 of68

Example(SprintTowersAll)

10/19/2017

16

46 of68

Example(SprintTowersAtlanta)

47 of68

Examples

www.guardiandf.com / 919‐868‐6291

48 of68

ViewingKML/KMZfiles

•Whatarethey?• Workproductoutputfromsomepoliceandprivateexperts

• GoogleEarthFileformat• CanbeopenedusingGoogleEarthProfessional

• Nowafreeprogram

10/19/2017

17

49 of68

GoogleEarthProfessional

50 of68

ThePie‐Slice!

51 of68

ThePie‐Slice!

10/19/2017

18

52 of68

ThePie‐Slice!(1)

53 of68

ThePie‐Slice!(2)

54 of68

Thisis“expert”training?

10/19/2017

19

55 of68

ExpertAnalysisorFantasy?

56 of68

CallDetailRecords:InsuranceCase

57 of68

CallDetailRecords:Carjacking

10/19/2017

20

58 of68

CallDetailRecords:Robbery

59 of68

CallDetailRecords:Murder

60 of68

CaseExample:CDRandPhoneLocation

10/19/2017

21

61 of68

CaseExample:CDRandPhoneLocation

62 of68

Drivetesting

63 of68

E‐911Location

10/19/2017

22

64 of68

GoogleLocationServices

65 of68

Capabilities:Examples

• Googleiswatching• Locationactivity• Fullroute

66 of68

Capabilities:Examples

• Googleislistening• Locationactivity• Fullroute

10/19/2017

23

67 of68

FindmyiPhone– DeviceBased

68 of68

• www.guardiandf.com• 919‐868‐6291• [email protected]

Highlyqualifiedexpertsincomputer,cellphone,cellularlocation,GPS,andcyberriskforensics.

call detail records “the evidence” phone loca… · the cellular system: cell site •a cell...

Documents