Forensics and the GSM mobile telephone system
Svein Yngvar Willassen · International journal of digital evidence · 2003
The GSM system has become the most popular system for mobile communication in the world. Criminals commonly use GSM phones, and it is therefore a need for forensic investigators to understand which evidence can be obtained from the GSM system. This paper briefly explains the basics of the GSM system. Evidence items that can be obtained from the Equipment, the SIM and the core network are explored. Tools to extract such evidence from the components of the system exist, but there is a need to develop more sound forensic procedures and tools for extracting such evidence. The paper concludes with a short presentation on the future UMTS system, which largely builds on the design of GSM. All these factors make it important for forensic investigators to understand how the GSM system works, and how evidence can be extracted from it. Criminals took the step into the mobile age a long time ago, and information from the mobile system can give the investigator crucial information on the criminal's actions. It is however important that the information contained in the system is retrieved with a forensically sound method. It is equally important that the investigator understands the system in order to be able to explain to the courts how the system works. It is the aim of this paper to give forensic investigators an introduction to the current state of GSM forensics, and highlight some of the issues that will have to be solved in the future. 2.0 History of the GSM system In the beginning of the 1980s several different systems for mobile communications were developed in Europe. The need for a common system that allowed roaming between countries was early recognized. In 1982 a number of European countries created a new standardization organisation called Groupe Speciale Mobile (GSM). The mandate of this group was to develop a standard to be common for the countries that created it. In 1988 the GSM was included in the European Telecommunication Standards Institute (ETSI), and the standards developed by GSM thus became standards for all telecommunication administrations in Europe. The main work with the GSM took place from 1988 - 1990 and resulted in 12 series of specifications which in great detail specified the inner workings of GSM. In 1990, when phase 1 of the specifications was finished, there were three dominating automatic systems for mobile communications in the world: