Tuesday, December 02, 2008

Nokia 6233 Clock

Nokia 6233 Clock
I have mentioned Vinny Parmar's name on this webblog previously. Vinny has just sent to me an email setting out a quirk that he has noted with the Nokia 6233 Clock.
.
Vinny Parmar, Lead Forensic Examiner:
"Basically I was working on a Nokia 6233. I used XRY and Oxygen Phone Manager (OPM) to read the data. No issues with the content as far as the text was concerned. XRY, as always, advanced the time of each SMS by 1 hour and Oxygen did not, howvever Oxygen did not pull off the SMSC associated with each SMS.
.
"Now your asking so what was the issue, well let me tell you. After the read I proceeded with a manual verification of the date\times for each SMS. What I noticed was that although Oxygen pulled of the dates\times there was a slight issue in what was displayed, for example: An SMS received - OPM listed the date\time as 15/05/08 15:51:49, the handset displayed this as 15/05/08 03:51:49.
.
"As far as the verification goes, one would assume that the correct time was as reported by the handset which was 03:51:49 which would suggest AM due to the format. However what I noticed was that when I checked the date\time format setting on the handset this turned out to be set to the 12 hour clock, but the handset did not display what I was expecting, which was the AM or PM prefix?
.
"So after a little adjustment with the handset, changed the format to 24hr clock all the SMS date\time were now displayed exactly as displayed by OPM. My suspicions were also confirmed by the content of messages and the suspects involved, they are school kids, so I couldn't really see SMS transmissions being sent/received at 3am. So, in essence, the above would suggest that as examiners we may need to consider adjusting the date\time format setting on a handset to confirm the correct format. Most of the handsets which are set to the 12-hour clock tend to display the appropriate prefix of AM or PM but for some unknown reason this was not the case with the Nokia 6233. This certainly requires further research."

No comments: