CDR IPDR Investigation for law enforcements.pdf

CDR IPDR Investigation

1. Understanding CDR / IPDR

2. Mobile Technology –As Source of Evidence
Mobile Memory
SIM card
Service
Provider:
CDR
IPDR
Tower
dumps
Cell Chart id

3. Mobile Technology –As Source of Evidence

4. call detail record (CDR)
•Acalldetailrecord(CDR)isadatarecordproducedbyatelephone
exchangeorothertelecommunicationsequipmentthatdocuments
thedetailsofatelephonecallorothertelecommunications
transactions(e.g.,textmessage)thatpassesthroughthatfacilityor
device.
•Therecordcontainsvariousattributesofthecall,suchastime,
duration,completionstatus,sourcenumber,anddestinationnumber
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 4

5. CALL DETAIL RECORD (CDR)
•A Call Data Record(CDR) is a detailed record of SMS and
calls that are sent and received by a subscriber of a service
provider.
•The following details can be obtained from the MSP
•Call Detail Record (CDR)
•Subscriber Detail Record (SDR)
•Customer Application form (CAF)
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India

6. CDR Analysis

8. IMEI Structure
351950009019358
ItemDescription Example
TAC TypeAllocationCode(previously,TypeApprovalCode)
-FirsteightdigitsofIMEINo.
-Identifiesmake,modelandcountryoforigin(not
necessarilywhereitwasmanufactured)
35195000
SNR SerialNumber-Ninththroughfourteenthdigits
-SNRUniquelyassignedtothathandset
901935
CD CheckDigit-Fifteenthdigit,Usedtocheckthevalidityof
theIMEICalculatedby“Luhn”formula.Forearly
handsets,thiswasalwayszero.
8
HTTPS://EN.WIKIPEDIA.ORG/WIKI/TYPE_ALLOCATION_CODE

9. Luhnformula

10. Demonstration
•https://www.imei.info/
•https://imei24.com/
•https://www.imeipro.info/
•https://eimei24.com/
•https://imeidb.gsma.com/

12. IMSI Structure
234108925129799
Items Description Example
MCC Mobile Country Code-First three digits, denotes the country of the issuing service
provider. e.g. “234” = UK
234
MNC Mobile Network Code-Next 2 or 3 digits, denotes network within that country the
subscriber belongs to –e.g. “10” = O2.
NOTE –MNC is only unique in a particular country i.e. (MCC + MNC) is unique. Most
MNCs are 2 digits, 3 digits used in parts of Americas
10
MSIN Mobile Station Identification Number -Remaining digits are used by the service provider
in question to identify the subscriber.
8925129
799

14. Example

15. Cell id Chart

16. Are any items left off CDR reports?
•Communications transmissions that do not cost money are generally
kept off the CDR.
•Many Voice over Internet Protocol (VoIP) services offer free SIP-to-SIP
calling. This is when a VoIP phone calls another VoIP phone without
ever going through the public switch telephone network (PSTN).
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 16

17. ILD –International Long Distance
•International Long Distance Service is a Long Distance Service
involving a telephone call originating in one country and terminating
in another country.
•To call a phone in another country, dial 011, and then the code for
the country you are calling, the area or city code, and the phone
number. For example, if you are trying to call someone in Brazil
(country code 55), in the city of Rio de Janeiro (city code 21), you
would dial 011 -55 -21 -XXXX-XXXX.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 17

18. National Long Distance (NLD) and
International Long Distance (ILD)
•National Long Distance (NLD) and International Long Distance (ILD)
telecom services are provided for calls and text messages across
national and international borders.
•NLD and ILD services are network carriage services which provide
national and cross-border connectivity, and services to the network
operated by foreign and national carrier providers.
•Furthermore, NLD and ILD services include calls or messages
originating or terminating from one country to another and
provisioning of international bandwidth require for calls.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 18

19. National Long Distance (NLD) and
International Long Distance (ILD)
•In addition, with increasing smartphone penetration, NLD and ILD
service providers are using mobile applications to integrate the NLD
and ILD services with the traditional home phones and provide
applications based voice services.
•For instance, Matrix Telecom, Inc. (Impact Telecom) has introduced a
mobile application “ImpactConnectApp” to provide long distance
calls through traditional phone. Furthermore, NLD and ILD service
providers have enabled direct phone calls for national and
international long distances with better call quality and competitive
call charges.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 19

20. National Long Distance (NLD) and
International Long Distance (ILD)
•The major players in the global NLD and ILD telecom service market include
•G3 Telecom, Inc.,
•Matrix Telecom,
•Inc. (Impact Telecom),
•LumosNetworks,
•Telecom North America (telna), Inc.,
•SelectcomTelecom,
•AT&T, Inc.,
•Reliance Communication Limited,
•Tata Communications Limited,
•Bharti Airtel Ltd.,
•Spice Communications Ltd.,
•Idea Cellular Ltd., SifyCommunications Ltd., and
•Microsoft Corporation (Skype).
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 20

21. Demonstration

22. VOIP Calls
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 22
•VoIP is a type of technology that allows users to make and receive
phone calls via the internet instead of the regular phone lines or a
PSTN (public-switched telephone network).

23. VOIP Calls
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 23

24. VOIP Calls
•VoIP is not to be confused with similar and related
technologies, such as:
•Cloud PBX, the technology that manages incoming calls by routing
them to the right person.
•Session Initiation Protocol (SIP), the component responsible for
establishing and ending VoIP connections.
•WebRTC(web real-time communications), which enables
communication through a browser like Chrome or Firefox. VoIP does
this via software or an app.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 24

25. VOIP Calls -Works
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 25

26. VOIP Calls -Protocols
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 26
•To avoid packet loss (when the voice data gets lost in the network), a
certain set of rules apply. These are the internet protocols.
•There are several types of protocol relating to VoIP:
•Transport Control Protocol (TCP)
•User Datagram Control (UDP)
•Real-Time Transport Protocol (RTP)
•Session Initiation Protocol (SIP)

27. VoIP-to-VoIP calls
•When you dial or click, SIP establishes a connection with your VoIP
provider’s server.
•The server then connects the call to the device of the person you’re
contacting.
•During the conversation, your packets of voice data are broken down
and reassembled in real time.
•When you say goodbye, SIP terminates the connection.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 27

28. VoIP-to-PSTN calls
•Although VoIP services are growing in popularity, many small
businesses are still using traditional phone systems. So, what happens
if you have a VoIP phone, but the person at the other end doesn’t?
•Luckily, you can use something called a “VoIP gateway.”
•This is a component of SIP, which is used to convert landline
connections into VoIP connections and vice-versa.
•When voice data is transported between digital and analog devices,
the gateway translates it into a suitable audio format.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 28

29. What is Wi-Fi Calling?
•Wi-Fi itself operates on a series of standards established by the IEEE
and the Wi-Fi Alliance.
•If you have a high-speed broadband connection, odds are that you
also have a router capable of providing this wireless coverage.
•Wi-Fi calling gives you the chance to make phone calls using a
wireless internet connection.
•Additionally, Android and iOS devices now have accepted, universal
standards (APIs) for VoIP callsin a way that is optimized for battery
life and the user experience.
27 September 2022 Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 29

30. Case discussion
•One person registered one number (fake
documents) on WhatsApp and then removed the
sim card.
•Now WhatsApp is active in this account without
the active sim card.

31. Accessing internet using someone’s
hotspot or public wifi.
•How to identify the actual user of internet?

32. IP Address

33. SRC: Google Images

34. 27 September 2022
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of
India
34
SRC: Google Images

35. WhatsApp
Law Enforcement Portal

36. WhatsApp –Account information
One must provide mobile phone number and basic information to create a
WhatsApp account.
WhatsApp declares that they do not retain messages in the ordinary
course of providing our Services to users.
Instead, messages are stored on user’s device and not typically stored on
their servers. Once messages are delivered, they are deleted from their
servers.
27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
36

37. WhatsApp for LEAs
WhatsAppappreciatestheworklawenforcementagenciesdoto
keeppeoplesafearoundtheworld.Wearepreparedtocarefully
review,validateandrespondtolawenforcementrequestsbased
onapplicablelawandpolicy.
Address:
WhatsApp Inc., Law Enforcement Response Team WhatsApp
Inc. 1601 Willow Road
Menlo Park, California 94025
United States of America
27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
37

38. WhatsApp
Law Enforcement Portal
Request Account Info by user
Emergency Request
Account Preservation
Records Request
27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
38

39. REQUEST ACCOUNT INFO BY USER
27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
39

40. Requirement for Investigating officer
•OfficialEmailAddressfromdepartmentdomainor
GovdomainorfromNICdomainwhichmaycertify
thattheyarefromlawenforcementagencyorfrom
governmentorganization

41. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
41
WhatsApp
Law Enforcement Portal

42. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
42

43. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
43

44. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
44

45. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
45

46. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
46

47. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
47

48. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA
48

54. Say the IP Address is : 27.56.111.188

55. Say the IP Address is : 27.56.111.188

56. Demonstration on
IP Address & Domain Name

59. •117.199.1.1
•India BB-MultiplayBroadband MultiplayProject, O/o DGM BB,
NOC BSNL Bangalore
•117.199.0.0117.199.255.255117.199.0.0/16
•BSNL HostmasterBroadband Networks, Bharat Sanchar Nigam Limited,
2nd Floor, Telephone Exchange, Sector 62, Noida
•[email protected] [email protected]
•[phone] [phone]
•Source is APNIC

60. INTERNET PROTOCOL DETAIL RECORD

62. •PRIVATEIP
•PRIVATEPORT
•PUBLICIP
•PUBLICPORT
•DESTIP
•DESTPORT
•MSISDN
•IMSI
•IMEI
•CELL_ID
•START_DATE
•START_TIME
•END_DATE
•END_TIME
•UPLINK_VOLUME
•DOWNLINK_VOLUME
•TOTAL_VOLUME
•I_RATTYPE

63. 27 September 2022 63
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of
India
SRC: Google Images

64. IP
Address
IP Address &
Tracing
Techniques
Private &
Public IP
Address
Private IP to
Public IP
Address
Conversion
Who.is
database

65. Private IP numbers
•TherearearangeofIPaddressesthatare
reservedforprivatenetworksandare
nevergivenoutforpublicuse.
27 September 2022 65
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of
India

66. Public IP numbers
•In most cases you will have a public IP address, given to
you by your Internet Service Provider (ISP).
•This is an IP that is unique to you and the entire
worldwide Internet.
•For example we will give our fictional business or home
the public IP address of: 28.135.16.197
27 September 2022 66
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of
India

67. •Android
•Settings
•About
Phone
•Status
•Iphone:
•Setting
•Wireless or
mobile
network

69. connection IP
address

70. Demonstration

71. Destination
IP IP Address to Domain Name

73. Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India

74. ALTERNATIVE TO PROCEED
DURING INVESTIGATION
If the person is using Facebook /
Google type services.
Approach google for assistance with
IMEI number of the handset, email
address, mobile number.

75. 27 September 2022
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of
India
75

76. 27 September 2022
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA,
Govt. of India
76

77. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 77

78. 27 September 2022 Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India 78

79. If device is located –Mobile Forensics
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India

81. Capturing Network Packets

82. 27 September 2022
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA,
Govt. of India
82

83. 27 September 2022
Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA,
Govt. of India
83

84. Any Questions
or
Suggestions

85. Shri Arjun Chetry
Assistant Director (IT)
Email: [email protected]
27 September 2022Mr. Arjun Chetry, Assistant Director (IT), NEPA, MHA, Govt. of India
85