About the Author |
|
xvii | |
Preface |
|
xix | |
Acknowledgements |
|
xxi | |
Glossary |
|
xxiii | |
1 Forensic Radio Surveys for Cell Site Analysis |
|
1 | (2) |
|
|
1 | (1) |
|
1.2 Forensic Radio Surveying |
|
|
1 | (2) |
2 Radio Theory |
|
3 | (22) |
|
|
3 | (7) |
|
|
3 | (3) |
|
|
6 | (1) |
|
|
7 | (1) |
|
2.1.4 Multipath Transmission |
|
|
8 | (2) |
|
2.2 Carrying Information on a Radio Signal |
|
|
10 | (3) |
|
2.2.1 Analogue Transmission Systems |
|
|
10 | (1) |
|
2.2.2 Digital Transmission Systems |
|
|
11 | (2) |
|
|
13 | (3) |
|
2.3.1 Radio Bands and Channels |
|
|
13 | (1) |
|
2.3.2 Effects of Frequency on Propagation |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (7) |
|
|
16 | (1) |
|
|
17 | (2) |
|
|
19 | (1) |
|
2.4.4 Cellular Measurements |
|
|
20 | (1) |
|
2.4.5 Measurements Used by Different Cellular Generations |
|
|
21 | (1) |
|
2.4.6 Describing Signal Strengths |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
23 | (2) |
3 Wireless Technologies and Deployments |
|
25 | (12) |
|
3.1 Coordinating Cellular Development |
|
|
25 | (1) |
|
3.2 Evolution from OG to 4G |
|
|
26 | (4) |
|
3.2.1 OG Pre-cellular Networks |
|
|
26 | (1) |
|
3.2.2 1G First Generation Networks |
|
|
27 | (1) |
|
3.2.3 2G Second Generation Networks |
|
|
28 | (1) |
|
3.2.4 3G Third Generation Networks |
|
|
29 | (1) |
|
3.2.5 4G Fourth Generation Networks and Beyond |
|
|
29 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
3.5 Other Types of Network |
|
|
32 | (2) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
33 | (1) |
|
3.5.6 Wireless Local Loop |
|
|
33 | (1) |
|
|
34 | (1) |
|
|
34 | (1) |
|
3.6 Deployed Technologies by Region |
|
|
34 | (2) |
|
3.7 Commonly-used Frequency Bands by Region |
|
|
36 | (1) |
|
|
36 | (1) |
4 Cellular Theory |
|
37 | (56) |
|
4.1 Pre-cellular Radiotelephone Networks |
|
|
37 | (1) |
|
|
38 | (2) |
|
|
40 | (1) |
|
4.4 Cell Size and Coverage |
|
|
41 | (2) |
|
|
43 | (1) |
|
4.5.1 Frequency Division Duplex |
|
|
43 | (1) |
|
4.5.2 Time Division Duplex |
|
|
44 | (1) |
|
4.6 Multiple Access Techniques |
|
|
44 | (2) |
|
4.6.1 Time Division Multiple Access |
|
|
45 | (1) |
|
4.6.2 Code Division Multiple Access |
|
|
45 | (1) |
|
4.6.3 Orthogonal Frequency Division Multiple Access |
|
|
45 | (1) |
|
4.6.4 Multiple Radio Access Technologies |
|
|
46 | (1) |
|
4.7 Generic Network Architecture |
|
|
46 | (1) |
|
|
47 | (1) |
|
4.8.1 The Third Generation Partnership Project Mobile Devices |
|
|
47 | (1) |
|
4.8.2 Other Network Types |
|
|
48 | (1) |
|
4.9 Radio Access Networks |
|
|
48 | (3) |
|
4.9.1 Cells and Base Stations |
|
|
48 | (1) |
|
|
49 | (2) |
|
|
51 | (1) |
|
4.10.1 2G/3G Core Networks |
|
|
51 | (1) |
|
|
52 | (1) |
|
4.11 Subscriber and Device Identifiers |
|
|
52 | (5) |
|
4.11.1 Mobile Subscriber Integrated Services Digital Network |
|
|
53 | (1) |
|
4.11.2 International Mobile Subscriber Identity |
|
|
53 | (2) |
|
4.11.3 Temporary Mobile Subscriber Identity |
|
|
55 | (1) |
|
4.11.4 International Mobile Equipment Identity |
|
|
55 | (2) |
|
|
57 | (2) |
|
4.12.1 Home Location Register/Home Subscriber Server |
|
|
57 | (1) |
|
4.12.2 Local Mobility Management Database |
|
|
57 | (1) |
|
4.12.3 Equipment Identity Register |
|
|
58 | (1) |
|
4.12.4 Network Types MNOs and MVNOs |
|
|
58 | (1) |
|
|
59 | (7) |
|
4.13.1 Channels and Carriers |
|
|
59 | (1) |
|
|
60 | (2) |
|
|
62 | (1) |
|
|
63 | (1) |
|
4.13.5 Physical-layer Cell Identifiers |
|
|
64 | (1) |
|
4.13.6 Cell Global Identifiers |
|
|
64 | (1) |
|
4.13.7 Decimal, Binary and Hexadecimal |
|
|
65 | (1) |
|
4.14 Antennas and Azimuths |
|
|
66 | (2) |
|
|
68 | (1) |
|
4.16 Cell Types and Sizes |
|
|
69 | (1) |
|
4.17 Cell Site Types and Uses |
|
|
70 | (1) |
|
4.18 Single and Multi Frequency Networks |
|
|
71 | (3) |
|
4.18.1 Single Frequency Networks |
|
|
71 | (1) |
|
4.18.2 Multi Frequency Networks |
|
|
72 | (1) |
|
4.18.3 Multi Carrier SFNs |
|
|
73 | (1) |
|
4.19 Cell Coverage Concepts |
|
|
74 | (3) |
|
|
74 | (1) |
|
|
75 | (1) |
|
4.19.3 Poor Coverage Areas |
|
|
76 | (1) |
|
4.20 Small Cells and Closed Subscriber Groups |
|
|
77 | (1) |
|
|
78 | (5) |
|
4.21.1 Mobile Device Activities at Power On |
|
|
78 | (2) |
|
|
80 | (1) |
|
4.21.3 Authentication and Ciphering |
|
|
81 | (1) |
|
|
82 | (1) |
|
|
82 | (1) |
|
4.22 Idle Mode and Connected Mode |
|
|
83 | (4) |
|
4.22.1 Idle Mode Procedures (Cell Selection and Reselection) |
|
|
83 | (2) |
|
4.22.2 Connected Mode Procedures (Connection Setup and Handover) |
|
|
85 | (1) |
|
4.22.3 Transition from Idle Mode to Connected Mode |
|
|
86 | (1) |
|
|
87 | (2) |
|
|
88 | (1) |
|
|
88 | (1) |
|
4.24 Location Updating (Idle Mode Mobility) |
|
|
89 | (2) |
|
4.25 Handover (Connected Mode Mobility) |
|
|
91 | (1) |
|
4.25.1 Inter-carrier Handover |
|
|
91 | (1) |
|
4.25.2 Intra-carrier Handover |
|
|
91 | (1) |
|
|
92 | (1) |
5 3GPP Network Types |
|
93 | (56) |
|
|
94 | (17) |
|
5.1.1 2G GSM Access Networks |
|
|
94 | (1) |
|
5.1.2 2G GSM Radio Interface |
|
|
95 | (1) |
|
5.1.3 GSM Channel Configuration |
|
|
96 | (1) |
|
5.1.4 2G GSM Cell Selection |
|
|
97 | (5) |
|
5.1.5 2G GSM Reselection Candidates |
|
|
102 | (1) |
|
5.1.6 2G GSM Cell Configurations |
|
|
103 | (2) |
|
5.1.7 2G GSM Channel Numbering |
|
|
105 | (2) |
|
5.1.8 2G GSM Cell Identifiers |
|
|
107 | (2) |
|
5.1.9 2G GSM Cell Discrimination |
|
|
109 | (1) |
|
5.1.10 2G GSM Radio Measurements |
|
|
110 | (1) |
|
5.2 3G UMTS/HSPA Networks |
|
|
111 | (19) |
|
5.2.1 3G UMTS Access Networks |
|
|
112 | (1) |
|
5.2.2 3G UMTS Radio Interface |
|
|
113 | (2) |
|
5.2.3 3G UMTS Cell Selection |
|
|
115 | (1) |
|
5.2.4 Active and Monitored Cells |
|
|
116 | (1) |
|
5.2.5 Single and Multi Frequency 3G UMTS Networks |
|
|
117 | (2) |
|
5.2.6 3G UMTS Handover Soft Handover |
|
|
119 | (1) |
|
5.2.7 Other Kinds of 3G UMTS Handover |
|
|
120 | (1) |
|
|
121 | (2) |
|
5.2.9 3G UMTS Radio Measurements |
|
|
123 | (2) |
|
5.2.10 3G UMTS Channel Numbering |
|
|
125 | (1) |
|
5.2.11 3G UMTS Cell Identifiers |
|
|
126 | (2) |
|
5.2.12 3G UMTS Cell Configurations |
|
|
128 | (1) |
|
5.2.13 3G UMTS Cell Discrimination |
|
|
129 | (1) |
|
5.2.14 Multi-carrier UMTS Services |
|
|
130 | (1) |
|
|
130 | (16) |
|
5.3.1 4G LTE Network Architecture |
|
|
131 | (1) |
|
5.3.2 4G LTE Radio Interface |
|
|
132 | (2) |
|
5.3.3 4G LTE Cell Selection and Reselection |
|
|
134 | (2) |
|
|
136 | (1) |
|
5.3.5 4G LTE Cell Configurations |
|
|
137 | (1) |
|
5.3.6 4G LTE Radio Bands and Channel Numbering |
|
|
138 | (1) |
|
5.3.7 4G LTE Cell Identifiers |
|
|
138 | (3) |
|
5.3.8 4G LTE Cell Discrimination |
|
|
141 | (1) |
|
5.3.9 4G LTE Radio Measurements |
|
|
142 | (1) |
|
5.3.10 4G LTE Variants TDD and FDD |
|
|
143 | (1) |
|
5.3.11 4G LTE Voice Call Options |
|
|
144 | (2) |
|
5.3.12 LTE Evolution LTE -Advanced and Beyond |
|
|
146 | (1) |
|
|
146 | (3) |
6 Other Cellular Network Types |
|
149 | (26) |
|
|
149 | (1) |
|
6.2 3G IS-2000/CDMA2000 1xRTT |
|
|
150 | (13) |
|
6.2.1 CDMA2000 Generations and Variants |
|
|
150 | (1) |
|
6.2.2 CDMA2000 Network Architecture |
|
|
151 | (1) |
|
6.2.3 CDMA2000 Network Structure |
|
|
152 | (1) |
|
6.2.4 3G CDMA2000 User and Device Identities |
|
|
153 | (2) |
|
6.2.5 3G CDMA2000 Radio Interface |
|
|
155 | (2) |
|
6.2.6 3G CDMA2000 Cell Selection |
|
|
157 | (1) |
|
6.2.7 3G CDMA2000 Handover |
|
|
158 | (1) |
|
6.2.8 3G CDMA2000 Radio Measurements |
|
|
158 | (1) |
|
6.2.9 3G CDMA2000 Band Classes and Channel Numbering |
|
|
159 | (1) |
|
6.2.10 3G CDMA2000 Cell Identifiers |
|
|
159 | (3) |
|
6.2.11 3G CDMA2000 Cell Configurations |
|
|
162 | (1) |
|
|
163 | (2) |
|
6.3.1 EV-DO Forensic Surveys |
|
|
164 | (1) |
|
6.3.2 CDMA2000 Specifications |
|
|
165 | (1) |
|
6.4 Surveying Other Technologies |
|
|
165 | (8) |
|
|
166 | (1) |
|
6.4.2 2G Personal Digital Cellular (Japan) |
|
|
166 | (1) |
|
|
166 | (2) |
|
6.4.4 2G GSM for Railways |
|
|
168 | (1) |
|
6.4.5 3G TD-SCDMA (China) |
|
|
168 | (2) |
|
|
170 | (1) |
|
|
171 | (2) |
|
|
173 | (2) |
7 Forensic Radio Surveys |
|
175 | (80) |
|
7.1 Forensic Radio Survey Objectives |
|
|
175 | (1) |
|
7.2 Forensic Radio Survey Terminology |
|
|
175 | (1) |
|
7.3 Forensic Radio Survey Types and Techniques |
|
|
176 | (11) |
|
7.3.1 Spot/Location Surveys |
|
|
177 | (2) |
|
|
179 | (1) |
|
7.3.3 Static Spot Surveys |
|
|
180 | (1) |
|
|
180 | (1) |
|
7.3.5 All-Network Profiles |
|
|
181 | (2) |
|
7.3.6 Cell Coverage Surveys |
|
|
183 | (2) |
|
7.3.7 Route Profile Surveys |
|
|
185 | (2) |
|
7.4 Idle Mode versus Connected Mode Surveys |
|
|
187 | (9) |
|
|
187 | (1) |
|
|
188 | (1) |
|
7.4.3 Transition from Idle Mode to Connected Mode |
|
|
188 | (1) |
|
|
188 | (3) |
|
7.4.5 Connected Mode Surveys |
|
|
191 | (3) |
|
|
194 | (1) |
|
7.4.7 Suggested Survey Modes |
|
|
195 | (1) |
|
7.5 Additional Survey Techniques |
|
|
196 | (5) |
|
7.5.1 Surveying using Multiple Devices |
|
|
196 | (2) |
|
7.5.2 Test Call Protocols |
|
|
198 | (1) |
|
|
199 | (1) |
|
|
200 | (1) |
|
|
201 | (4) |
|
7.6.1 Survey Specifications |
|
|
201 | (1) |
|
7.6.2 Preparing Survey Devices |
|
|
202 | (2) |
|
|
204 | (1) |
|
7.7 Typical Survey Actions and Procedures |
|
|
205 | (12) |
|
7.7.1 Spot/Location Surveys |
|
|
205 | (5) |
|
7.7.2 All-Network Profiles |
|
|
210 | (1) |
|
7.7.3 Cell Coverage Surveys |
|
|
210 | (6) |
|
7.7.4 Route Profile Surveys |
|
|
216 | (1) |
|
7.8 Survey Results: Checking and Confirmation |
|
|
217 | (3) |
|
7.8.1 Confirming the Expected Results |
|
|
217 | (1) |
|
7.8.2 Expected Results Not Found |
|
|
217 | (1) |
|
7.8.3 Surveying Near Location/Tracking Area Boundaries |
|
|
218 | (2) |
|
7.9 Survey Notes and Progress Maps |
|
|
220 | (1) |
|
7.10 Survey Equipment Types |
|
|
221 | (4) |
|
7.10.1 3G Forensics CSury |
|
|
221 | (1) |
|
|
222 | (1) |
|
|
223 | (1) |
|
7.10.4 Forensic Mobile Services CSU-4 L |
|
|
224 | (1) |
|
|
225 | (5) |
|
|
225 | (1) |
|
|
225 | (3) |
|
|
228 | (1) |
|
|
229 | (1) |
|
|
230 | (1) |
|
7.12 Processing Survey Results |
|
|
230 | (9) |
|
7.12.1 Spot/Location Raw Survey Results |
|
|
230 | (3) |
|
7.12.2 Spot/Location Survey Summarised Results |
|
|
233 | (2) |
|
7.12.3 All-Network Profile Results |
|
|
235 | (1) |
|
7.12.4 Coverage Survey Results |
|
|
235 | (3) |
|
7.12.5 Route Profile Results |
|
|
238 | (1) |
|
7.13 Understanding Survey Results |
|
|
239 | (6) |
|
7.13.1 Understanding Coverage and Route Survey Results |
|
|
240 | (1) |
|
7.13.2 Understanding Spot/Location Survey Results |
|
|
241 | (2) |
|
7.13.3 Finding 'Missing' Cell IDs |
|
|
243 | (2) |
|
7.14 Storage of Survey Data |
|
|
245 | (3) |
|
7.14.1 Continuity of Evidence |
|
|
245 | (1) |
|
7.14.2 Historical Survey Data |
|
|
246 | (1) |
|
|
247 | (1) |
|
7.15 Quality and Best Practice |
|
|
248 | (4) |
|
7.15.1 Survey Preparation |
|
|
248 | (1) |
|
7.15.2 Idle Mode versus Connected Mode |
|
|
248 | (1) |
|
7.15.3 Best Practice for Survey Types |
|
|
249 | (1) |
|
7.15.4 Contemporaneous Note Taking |
|
|
250 | (1) |
|
7.15.5 Post-Survey Reports |
|
|
250 | (1) |
|
7.15.6 Summary of Survey Best Practice |
|
|
251 | (1) |
|
7.16 Summary of Typical Survey Results |
|
|
252 | (2) |
|
|
252 | (1) |
|
|
252 | (1) |
|
|
253 | (1) |
|
7.16.4 cdmaOne and CDMA2000 Measurements |
|
|
253 | (1) |
|
|
254 | (1) |
8 Cell Site Analysis |
|
255 | (42) |
|
|
256 | (1) |
|
8.2 Uses and Limitations of Cell Site Evidence |
|
|
257 | (7) |
|
|
257 | (1) |
|
|
258 | (3) |
|
8.2.3 Historical versus Live Cell Site |
|
|
261 | (1) |
|
8.2.4 Combining Cell Site Analysis with Other Evidence |
|
|
261 | (2) |
|
|
263 | (1) |
|
8.3 Regulation of Cell Site Analysis |
|
|
264 | (1) |
|
8.4 Components of Cell Site Analysis |
|
|
265 | (1) |
|
|
265 | (11) |
|
|
267 | (1) |
|
|
268 | (4) |
|
|
272 | (4) |
|
8.6 Sources of Cellular Coverage Data |
|
|
276 | (2) |
|
|
276 | (1) |
|
|
277 | (1) |
|
8.7 Forensic Radio Surveys |
|
|
278 | (1) |
|
8.7.1 Role of Forensic Survey Results |
|
|
278 | (1) |
|
8.7.2 Limitations of Forensic Surveys |
|
|
278 | (1) |
|
|
279 | (6) |
|
8.8.1 Report Writing and Structure |
|
|
279 | (6) |
|
|
285 | (1) |
|
|
286 | (3) |
|
8.11 Report Checking and Peer Review |
|
|
289 | (1) |
|
8.12 Professional and Expert Witnesses |
|
|
290 | (3) |
|
|
290 | (1) |
|
8.12.2 Witness of Opinion |
|
|
291 | (1) |
|
8.12.3 Duties of an Expert Witness |
|
|
291 | (1) |
|
8.12.4 Defence Cell Site Reports |
|
|
292 | (1) |
|
|
293 | (3) |
|
|
293 | (2) |
|
8.13.2 Typical Cross-Examination Questions |
|
|
295 | (1) |
|
|
296 | (1) |
9 Summary and Practical Activities |
|
297 | (66) |
|
9.1 Radio and Cellular Concepts |
|
|
297 | (4) |
|
9.1.1 Basic Radio Terminology |
|
|
297 | (1) |
|
|
297 | (1) |
|
|
298 | (1) |
|
9.1.4 Cellular Radio Bands |
|
|
299 | (1) |
|
9.1.5 Cellular Radio bands by Region |
|
|
299 | (1) |
|
9.1.6 Decimal, Binary and Hexadecimal |
|
|
300 | (1) |
|
|
301 | (6) |
|
9.2.1 Mobile Country Code List |
|
|
301 | (6) |
|
9.3 Cellular Network Types |
|
|
307 | (5) |
|
|
307 | (1) |
|
|
307 | (2) |
|
9.3.3 2G cdmaOne and 3G CDMA2000 Networks |
|
|
309 | (1) |
|
|
309 | (3) |
|
9.4 Forensic Radio Surveys |
|
|
312 | (9) |
|
9.4.1 Spot/Location Surveys |
|
|
312 | (2) |
|
9.4.2 All-Network Profiles |
|
|
314 | (2) |
|
9.4.3 Cell Coverage Surveys |
|
|
316 | (1) |
|
|
317 | (1) |
|
9.4.5 Survey Specifications |
|
|
318 | (1) |
|
9.4.6 Preparing Survey Devices |
|
|
318 | (2) |
|
|
320 | (1) |
|
9.5 Survey Results: Checking and Confirmation |
|
|
321 | (1) |
|
9.5.1 Confirming the Expected Results |
|
|
321 | (1) |
|
9.5.2 Expected Results Not Found |
|
|
321 | (1) |
|
9.6 Survey Notes and Progress Maps |
|
|
322 | (1) |
|
|
323 | (7) |
|
9.7.1 Spot/Location Survey Results |
|
|
323 | (1) |
|
9.7.2 All-Network Profile Results |
|
|
324 | (2) |
|
9.7.3 Coverage Survey Results |
|
|
326 | (1) |
|
9.7.4 Route Profile Results |
|
|
327 | (3) |
|
9.7.5 Summary of Survey Best Practice |
|
|
330 | (1) |
|
|
330 | (5) |
|
9.8.1 Limitations of Cell Site Analysis |
|
|
330 | (1) |
|
9.8.2 Components of Cell Site Analysis |
|
|
331 | (3) |
|
9.8.3 Report Checking and Peer Review |
|
|
334 | (1) |
|
|
335 | (1) |
|
9.10 Master List of Events/Locations |
|
|
336 | (1) |
|
9.11 Source Files Attribution List |
|
|
336 | (1) |
|
9.12 Normalise Call Data into a Standard Format |
|
|
337 | (7) |
|
|
338 | (6) |
|
9.13 Create a Master Cell List |
|
|
344 | (1) |
|
9.14 Creating a Case Master Map |
|
|
345 | (2) |
|
9.15 Compile Radio Survey Summary Tables |
|
|
347 | (8) |
|
9.16 Creating Call and Cell Labels |
|
|
355 | (3) |
|
9.17 Cell Site Mapping Presentations |
|
|
358 | (2) |
|
|
360 | (1) |
|
|
361 | (2) |
Index |
|
363 | |