Chapter 10 - Mobile Network Investigations

Abstract

This chapter discusses mobile networks and how they can be useful in digital investigations. The chapter focuses on cellular and PCS technologies. Methods of obtaining location information from mobile networks are described. The content and analysis of usage logs and billing records are covered, and the usefulness of text and multimedia messaging are demonstrated. This chapter also focuses on techniques and tools for capturing and analyzing traffic on mobile networks, culminating with a discussion of the legal and operational implication of interception. Mobile network investigations are also commonly performed for “conventional crimes,” often focusing on location information, logs of telephone calls, printouts of SMS messages, and associated metadata. A mobile device is generally defined as any instrument that can connect to and operate on a mobile network, including cellular telephones, wireless modems, and pagers. Although a significant amount of useful digital evidence associated with mobile devices like cellular telephones is stored in embedded flash memory “Embedded System Analysis,” the associated network is also a rich source of evidence. It is useful for investigators to understand the underlying network technologies, the types of data than can exist on mobile networks, and approaches to collecting and analyzing these sources of digital evidence.