Timing Advance Reports - Cell Phone Forensics

Here is another blog on Timing Advance and the use of it for cell phone forensic location analysis. Timing Advance maintains a great deal of interest in the mobile forensic world due to its efforts to estimate the location of a cell phone and its impact on legal cases.

This blog looks at the timing advance data in two different ways. First we will look at the speed required to go from one point to the next point in the records and see if it makes logical sense. Next we will look at time gaps in the raw timing advance files. This can indicate issues with the logging of the data or phone non-usage.

My company wrote a web-based software package called WebMap that converts CDR and Timing Advance data files into Google Earth Maps and Excel reports. For more information, videos and trials go to www.zkservices.net/software.

WebMap automatically generates two Excel reports from the timing advance file; the Speed Flag report and Gap Analysis Report. The Speed Flag report allows you to set a speed threshold; then the software will look at the time and location for every record in the file and determine the speed necessary to get from one point to the next. I typically set the speed threshold at 90mph, meaning the report will only list record pairs that exceed a minimum speed of 90mph required to get from one point to the next point in time.

For the Gap Analysis report the user enters the minimum time gap threshold and the software looks for consecutive points that exceed the minimum gap time setting and logs them in the Gap Analysis report. This can identify times where the phone was not in use or possibly turned off. It could also identify issues in the original logging of the data by the network operator. I typically set the minmum gap at 30 minutes but this can be set by the user.

WebMap creates two maps from the timing advance records. The first is the Timing Advance Phone Map. This map displays the latitude longitude estimate of the phone's location and the confidence, or error factor, radius as a shaded circle around the point. An example of one of the maps is shown below.

A WebMap Speed Flag report for this map looks like the following.

The software calculates the minimum distance needed to travel between the two points inclusive of the error/confidence factor. In other words, it looks at two consecutive points in time and finds the shortest distance between the outside edge of each shaded circle. It determines the distance, then calculates the speed required to travel that minimum distance. See the following map showing a pictorial view of the minimum distance between the two points highlighted in yellow in the report above. The speed required to travel this distance is over 15,000 mph as shown in the report above in the yellow row in column T.

The second map WebMap creates is a Timing Advance Tower Map. This map plots the location and direction (azimuth) of the tower antenna the phone was connected to for each record in the file. It then plots a 120-degree arc at the distance logged in the file for the Timing Advance value. The user has the ability to edit the width of the arc by setting inner and outer band offsets, thus increasing the thickness of the arc in the inward or outward directions. This map is used quite often by law enforcement, and it estimates that the location of the phone is somewhere inside the arc band. A map of two tower locations with their corresponding arcs are shown below.

The Speed Flag report for the Tower Map is shown below.

The map showing the distance between the two points highlighted in yellow in the report above is shown here. The minimum distance between the arcs is 0.49 miles. The speed required to travel that distance is 441.5 mph. Obviously, something is wrong.

If you click on "Map" (see below) . . .

. . . in the report a Google Maps map pops up in your browser showing you the starting and ending locations with a route and time. This shows you the actual driving route rather than the line-of-sight distance.

The other report that WebMap creates is the Gap Analysis. The user enters the minimum gap threshold, and the software looks for consecutive points that exceed the minimum gap time setting and logs them in the Gap Analysis report. This can identify times where the phone was not in use or possibly turned off. It could also identify issues in the original logging of the data by the network operator. A sample of this report is shown below.

The column at the far right shows the length of the gap. The first gap in this data was over 15 hours.

As forensic specialists we need to be careful in how we use and present timing advance data. While it can be useful, we also need to be aware of the pitfalls. It does not provide pinpoint accuracy and can have many inconsistencies. However, when taken as a whole it can provide general location information.