Hello my white rabbits. 🐰
Before we start:
I want to thank you 500 people on the channel, I'm very happy about that 🎉❤️

I want to talk about mobile network forensics📡 and how this evidence will be used in court.

The post is divided into 3 for it is long, also below will be an archive with detailed material on this topic⭐️

Now literally everyone has a cell phone with the ability to use many Internet services, a similar and increased communication leads to a decrease in "normal" communication events (voice calls, text messages, etc.), recorded in disclosed CDR now has more events with the transfer of GPRS / mobile data recorded in billing data.
And this means that analysts are forced to analyze more and more scales of data which is quite time-consuming🧩
The impact of the uncertainty that exists with respect to CDR GPRS/mobile data, particularly with respect to the "starting cell" specified in the CDR and the correlation between that cell and cell site conclusions based on GPRS evidence often cannot be as certain as data that can be made from GPRS data.

First, a little bit about GPRS

GPRS offers a "packet-switched" data service. 

Services with PS usually only occupy a connection cell when they actually have something to send or receive (messages, calls, etc)
This makes it well suited for transmitting data traffic.

Most data applications - web browsing, email, etc, have data to be exchanged only periodically(packets)
But roughly speaking, the term "GPRS" (and the related term "EDGE") refers only to mobile data service provided in 2G networks.
In 3G, 4G, and 5G networks, this service is called simply "mobile data" or "packet-switched data," but the term "GPRS" has caught on and is mistakenly used as a generic term for all mobile data services.

In the following text, the terms "GPRS" and "PS data networks" will be used to refer to all generations of mobile network 🙃

2G GPRS data services use the same radio channels, cells, and access networks as GSM 2G voice services. 

GSM increases the capacity of its radio channels by separating
each into a set of 8 "timeslots" - up to 8 telephones using the same radio channel simultaneously, each of which periodically transmits/receives small amounts of data into its own
timeslot in a strict sequence.

The BSC in 2G handles traffic received in the "voice" and "data" time slots differently, redirecting voice traffic to the CS core network and data traffic to the PS
of the core network.

3G/4G/5G radio channels do not use timeslots, but do share the resources of the connections they use. The generic terms "connections" or "sessions" will
used to describe the PS data connections used by all network generations.

The core PS 2G/3G network consists of two basic elements known as the SGSN and GGSN .The SGSN communicates with the access network and manages the exchange of data packets

with mobile devices.
The SGSN receives requests to establish a data session from mobile devices and forwards them to the GGSN. Once the session is activated, the SGSN transmits data packets both upstream and downstream and keeps a count of the amount of data sent and received. The SGSN also periodically receives the cell information that each active mobile device is currently using and takes note of any changes to the cell or routing area.
The GGSN is essentially a router that communicates with external networks, such as the Internet
#GPRS #network #mobile #forensics