Title Page -- Copyright Page -- Contents -- About the Author -- Preface -- Acknowledgements -- Glossary -- Chapter 1 Forensic Radio Surveys for Cell Site Analysis -- 1.1 Cell Site Analysis -- 1.2 Forensic Radio Surveying -- Chapter 2 Radio Theory -- 2.1 RF Propagation -- 2.1.1 Radio Theory -- 2.1.2 Basic Terminology -- 2.1.3 Propagation Modes -- 2.1.4 Multipath Transmission -- 2.2 Carrying Information on a Radio Signal -- 2.2.1 Analogue Transmission Systems -- 2.2.2 Digital Transmission Systems -- 2.3 Radio Spectrum -- 2.3.1 Radio Bands and Channels -- 2.3.2 Effects of Frequency on Propagation -- 2.3.3 Cellular Bands -- 2.4 RF Measurements -- 2.4.1 Decibel Notation -- 2.4.2 Decibels -- 2.4.3 Decibel Milliwatts -- 2.4.4 Cellular Measurements -- 2.4.5 Measurements Used by Different Cellular Generations -- 2.4.6 Describing Signal Strengths -- Note -- References -- Chapter 3 Wireless Technologies and Deployments -- 3.1 Coordinating Cellular Development -- 3.2 Evolution from 0G to 4G -- 3.2.1 0G - Pre-cellular Networks -- 3.2.2 1G - First Generation Networks -- 3.2.3 2G - Second Generation Networks -- 3.2.4 3G - Third Generation Networks -- 3.2.5 4G - Fourth Generation Networks and Beyond -- 3.3 3GPP Network Types -- 3.4 3GPP2 Network Types -- 3.5 Other Types of Network -- 3.5.1 TD-SCDMA -- 3.5.2 iDEN -- 3.5.3 WiFi -- 3.5.4 Wireless Broadband -- 3.5.5 WIMAX -- 3.5.6 Wireless Local Loop -- 3.5.7 GSM-R -- 3.5.8 TETRA -- 3.6 Deployed Technologies by Region -- 3.7 Commonly-used Frequency Bands by Region -- References -- Chapter 4 Cellular Theory -- 4.1 Pre-cellular Radiotelephone Networks -- 4.2 Radio Cells -- 4.3 Frequency Reuse -- 4.4 Cell Size and Coverage -- 4.5 Duplex Techniques -- 4.5.1 Frequency Division Duplex -- 4.5.2 Time Division Duplex -- 4.6 Multiple Access Techniques -- 4.6.1 Time Division Multiple Access.

4.6.2 Code Division Multiple Access -- 4.6.3 Orthogonal Frequency Division Multiple Access -- 4.6.4 Multiple Radio Access Technologies -- 4.7 Generic Network Architecture -- 4.8 Mobile Devices -- 4.8.1 The Third Generation Partnership Project Mobile Devices -- 4.8.2 Other Network Types -- 4.9 Radio Access Networks -- 4.9.1 Cells and Base Stations -- 4.9.2 Location Areas -- 4.10 Core Networks -- 4.10.1 2G/3G Core Networks -- 4.10.2 4G Core Networks -- 4.11 Subscriber and Device Identifiers -- 4.11.1 Mobile Subscriber Integrated Services Digital Network -- 4.11.2 International Mobile Subscriber Identity -- 4.11.3 Temporary Mobile Subscriber Identity -- 4.11.4 International Mobile Equipment Identity -- 4.12 Network Databases -- 4.12.1 Home Location Register/Home Subscriber Server -- 4.12.2 Local Mobility Management Database -- 4.12.3 Equipment Identity Register -- 4.12.4 Network Types - MNOs and MVNOs -- 4.13 Cell Sites -- 4.13.1 Channels and Carriers -- 4.13.2 Cells and Sectors -- 4.13.3 Cell Capacity -- 4.13.4 Cell Identifiers -- 4.13.5 Physical-layer Cell Identifiers -- 4.13.6 Cell Global Identifiers -- 4.13.7 Decimal, Binary and Hexadecimal -- 4.14 Antennas and Azimuths -- 4.15 Uptilt and Downtilt -- 4.16 Cell Types and Sizes -- 4.17 Cell Site Types and Uses -- 4.18 Single and Multi Frequency Networks -- 4.18.1 Single Frequency Networks -- 4.18.2 Multi Frequency Networks -- 4.18.3 Multi Carrier SFNs -- 4.19 Cell Coverage Concepts -- 4.19.1 Dominance -- 4.19.2 Non-dominance -- 4.19.3 Poor Coverage Areas -- 4.20 Small Cells and Closed Subscriber Groups -- 4.21 Network Activities -- 4.21.1 Mobile Device Activities at Power On -- 4.21.2 Attach and Detach -- 4.21.3 Authentication and Ciphering -- 4.21.4 TMSI Allocation -- 4.21.5 Detach -- 4.22 Idle Mode and Connected Mode -- 4.22.1 Idle Mode Procedures (Cell Selection and Reselection).

4.22.2 Connected Mode Procedures (Connection Setup and Handover) -- 4.22.3 Transition from Idle Mode to Connected Mode -- 4.23 Cell Access Control -- 4.23.1 Cell Barring -- 4.23.2 Forbidden LAC/TAC -- 4.24 Location Updating (Idle Mode Mobility) -- 4.25 Handover (Connected Mode Mobility) -- 4.25.1 Inter-carrier Handover -- 4.25.2 Intra-carrier Handover -- References -- Chapter 5 3GPP Network Types -- 5.1 2G GSM Networks -- 5.1.1 2G GSM Access Networks -- 5.1.2 2G GSM Radio Interface -- 5.1.3 GSM Channel Configuration -- 5.1.4 2G GSM Cell Selection -- 5.1.5 2G GSM Reselection Candidates -- 5.1.6 2G GSM Cell Configurations -- 5.1.7 2G GSM Channel Numbering -- 5.1.8 2G GSM Cell Identifiers -- 5.1.9 2G GSM Cell Discrimination -- 5.1.10 2G GSM Radio Measurements -- 5.2 3G UMTS/HSPA Networks -- 5.2.1 3G UMTS Access Networks -- 5.2.2 3G UMTS Radio Interface -- 5.2.3 3G UMTS Cell Selection -- 5.2.4 Active and Monitored Cells -- 5.2.5 Single and Multi Frequency 3G UMTS Networks -- 5.2.6 3G UMTS Handover - Soft Handover -- 5.2.7 Other Kinds of 3G UMTS Handover -- 5.2.8 Cell Breathing -- 5.2.9 3G UMTS Radio Measurements -- 5.2.10 3G UMTS Channel Numbering -- 5.2.11 3G UMTS Cell Identifiers -- 5.2.12 3G UMTS Cell Configurations -- 5.2.13 3G UMTS Cell Discrimination -- 5.2.14 Multi-carrier UMTS Services -- 5.3 4G LTE Networks -- 5.3.1 4G LTE Network Architecture -- 5.3.2 4G LTE Radio Interface -- 5.3.3 4G LTE Cell Selection and Reselection -- 5.3.4 4G LTE Handovers -- 5.3.5 4G LTE Cell Configurations -- 5.3.6 4G LTE Radio Bands and Channel Numbering -- 5.3.7 4G LTE Cell Identifiers -- 5.3.8 4G LTE Cell Discrimination -- 5.3.9 4G LTE Radio Measurements -- 5.3.10 4G LTE Variants - TDD and FDD -- 5.3.11 4G LTE Voice Call Options -- 5.3.12 LTE Evolution - LTE -Advanced and Beyond -- References -- Chapter 6 Other Cellular Network Types -- 6.1 2G IS-95/cdmaOne.

6.2 3G IS-2000/CDMA2000 1xRTT -- 6.2.1 CDMA2000 Generations and Variants -- 6.2.2 CDMA2000 Network Architecture -- 6.2.3 CDMA2000 Network Structure -- 6.2.4 3G CDMA2000 User and Device Identities -- 6.2.5 3G CDMA2000 Radio Interface -- 6.2.6 3G CDMA2000 Cell Selection -- 6.2.7 3G CDMA2000 Handover -- 6.2.8 3G CDMA2000 Radio Measurements -- 6.2.9 3G CDMA2000 Band Classes and Channel Numbering -- 6.2.10 3G CDMA2000 Cell Identifiers -- 6.2.11 3G CDMA2000 Cell Configurations -- 6.3 3G CDMA2000 EV-DO -- 6.3.1 EV-DO Forensic Surveys -- 6.3.2 CDMA2000 Specifications -- 6.4 Surveying Other Technologies -- 6.4.1 2G iDEN -- 6.4.2 2G Personal Digital Cellular (Japan) -- 6.4.3 2G TETRA -- 6.4.4 2G GSM for Railways -- 6.4.5 3G TD-SCDMA (China) -- 6.4.6 4G WIMAX -- 6.4.7 Non-Cellular: WiFi -- References -- Chapter 7 Forensic Radio Surveys -- 7.1 Forensic Radio Survey Objectives -- 7.2 Forensic Radio Survey Terminology -- 7.3 Forensic Radio Survey Types and Techniques -- 7.3.1 Spot/Location Surveys -- 7.3.2 Location Surveys -- 7.3.3 Static Spot Surveys -- 7.3.4 Indoor Surveys -- 7.3.5 All-Network Profiles -- 7.3.6 Cell Coverage Surveys -- 7.3.7 Route Profile Surveys -- 7.4 Idle Mode versus Connected Mode Surveys -- 7.4.1 Idle Mode -- 7.4.2 Connected Mode -- 7.4.3 Transition from Idle Mode to Connected Mode -- 7.4.4 Idle Mode Surveys -- 7.4.5 Connected Mode Surveys -- 7.4.6 Mixed Mode Surveys -- 7.4.7 Suggested Survey Modes -- 7.5 Additional Survey Techniques -- 7.5.1 Surveying using Multiple Devices -- 7.5.2 Test Call Protocols -- 7.5.3 Lock Files -- 7.5.4 Orbit Tests -- 7.6 Survey Preparation -- 7.6.1 Survey Specifications -- 7.6.2 Preparing Survey Devices -- 7.6.3 Survey Safety -- 7.7 Typical Survey Actions and Procedures -- 7.7.1 Spot/Location Surveys -- 7.7.2 All-Network Profiles -- 7.7.3 Cell Coverage Surveys -- 7.7.4 Route Profile Surveys.

7.8 Survey Results: Checking and Confirmation -- 7.8.1 Confirming the Expected Results -- 7.8.2 Expected Results Not Found -- 7.8.3 Surveying Near Location/Tracking Area Boundaries -- 7.9 Survey Notes and Progress Maps -- 7.10 Survey Equipment Types -- 7.10.1 3G Forensics CSurv -- 7.10.2 Anite NEMO Handy -- 7.10.3 Ascom TEMS -- 7.10.4 Forensic Mobile Services CSU-4 L -- 7.11 Raw Survey Results -- 7.11.1 CSurv Data (2G) -- 7.11.2 CSurv Data (3G) -- 7.11.3 NEMO Data -- 7.11.4 TEMS Data -- 7.11.5 FMS CSU-4 L Data -- 7.12 Processing Survey Results -- 7.12.1 Spot/Location Raw Survey Results -- 7.12.2 Spot/Location Survey Summarised Results -- 7.12.3 All-Network Profile Results -- 7.12.4 Coverage Survey Results -- 7.12.5 Route Profile Results -- 7.13 Understanding Survey Results -- 7.13.1 Understanding Coverage and Route Survey Results -- 7.13.2 Understanding Spot/Location Survey Results -- 7.13.3 Finding 'Missing' Cell IDs -- 7.14 Storage of Survey Data -- 7.14.1 Continuity of Evidence -- 7.14.2 Historical Survey Data -- 7.14.3 Proactive Surveys -- 7.15 Quality and Best Practice -- 7.15.1 Survey Preparation -- 7.15.2 Idle Mode versus Connected Mode -- 7.15.3 Best Practice for Survey Types -- 7.15.4 Contemporaneous Note Taking -- 7.15.5 Post-Survey Reports -- 7.15.6 Summary of Survey Best Practice -- 7.16 Summary of Typical Survey Results -- 7.16.1 GSM Measurements -- 7.16.2 UMTS Measurements -- 7.16.3 LTE Measurements -- 7.16.4 cdmaOne and CDMA2000 Measurements -- References -- Chapter 8 Cell Site Analysis -- 8.1 Cell Site Concepts -- 8.2 Uses and Limitations of Cell Site Evidence -- 8.2.1 Limitations -- 8.2.2 Cell Site Uses -- 8.2.3 Historical versus Live Cell Site -- 8.2.4 Combining Cell Site Analysis with Other Evidence -- 8.2.5 Attribution -- 8.3 Regulation of Cell Site Analysis -- 8.4 Components of Cell Site Analysis -- 8.5 Call Detail Records.

8.5.1 Voice/Text CDRs.