Manage files screen

Locations are geographic points of interests that are used for investigating case data visually on the ESPA analysis center screen to determine the proximity of the locations to the sectors used during phone calls. They are also used in IQ packets and advanced analysis reports, may also be useful for drive planning, and are used in the geo-fence and reverse geo-fence live location monitoring alerts. For example, a location may be:

• A crime scene.
• A place of interest related to the crime or a phone user, for example the location of a phone user's home and locations a phone user is known to frequent.
• A place that you want to monitor a person entering or leaving using live location monitoring.

Although locations can be entered manually using the Locations of interest screen (Case management) you can also select to upload a file containing locations from both the Locations of interest screen (Case management) screen, the Manage case screen and the Manage files screen. This is useful if you already have a file containing multiple locations of interest, possibly from surveillance videos or credit card transactions. If the file also includes event times then an event is also automatically created on the Event timeline screen. Locations can also be created automatically by OSS-ESPA, for example when you upload geofence, tower dump or subscriber information files, and they can also be created manually in the ESPA analysis center and Sentinel screens.

For further information on the file's content requirements refer to Import locations from file screen.

Although persons can be entered manually using the People and devices screen you can also select to upload a file containing persons from both the People and devices of interest screen, the Manage case screen and the Manage files screen. This is useful if you already have a file containing multiple persons of interest, possibly from surveillance videos or credit card transactions. People can also be created automatically be OSS-ESPA, for example when you upload a subscriber information file.

The person file must either be either a .csv, .xls, or .xlsx file format, or a .zip file containing one of these file types. For the information in the file to import correctly, you must include the column headings in the first row of your file; refer to the following list for details of the column headings and content requirements, both of which are case insensitive. Alternatively click here to download an .xlsx template file provided by Gladiator Forensics.

For further information on the file's content requirements refer to Import persons from file screen.

Call Detail Records (CDR) are records provided by the mobile phone service provider (that is, the operator) that contains relevant information regarding calls made or services used by a subscriber.

If you add a person and phone numbers to the case using the People and devices screen then you must also import a CDR for each phone number if you want to include each phone number in your analysis. If you do not import a CDR for a phone number then on the ESPA analysis center screen the number is not displayed.

If you do not already have these files from the operator and require information on how to obtain them refer to I want to obtain historical Call Detail Records on a phone.

The CDR files can either be Excel based files (.xls or .xlsx) or delimited text files (for example CSV and tab delimited). You must not edit the CDR that the operator provides to you as OSS-ESPA uses data in the file to automatically detect the operator, the phone number the CDR belongs to, and the format of the CDR. OSS-ESPA normalizes the time based on the location of the tower and its time zone.

OSS-ESPA requires the following information from an operator's CDR:

• Type of service: voice call, data service, messaging (SMS, MMS, Text)
• Date and time of service (start and end times)
• Sectors used during the call or service. This must include the sector the call was initiated and terminated in. Each of these sectors must include the required unique identifiers to allow OSS-ESPA to analyze the case and present the geographical correlation of the CDR records and the sector data on the ESPA analysis center screen and advanced analysis reports. These unique identifiers are different for different technologies: for UMTS, GSM and IDEN these are the Local Area Code (LAC) and Cell ID; for CDMA these are typically the Switch Name/ID, Cell ID, and Sector/Face ID.

Different types of CDRs and advanced CDRs are supported, for example: RTT, PCMD, Nelos, Handover; truecall, IP Session, IPDR, VoLTE, VoNR, TOT, MNI, SMS, Landline, Scamp, and toll.

Supported file content

• ATT (.txt, .xls, .xlsx, .csv. The .pdf format is not supported.)

• Caroline West ( .xls, .xlsx, .csv)

• Cricket ( .xls, .xlsx, .csv)

• MetroPCS ( .xls, .xlsx, .csv)

• Nextel

• Sprint ( .xls, .xlsx, .csv)

• T-Mobile ( .xls, .xlsx, .csv)

• US Cellular ( .xls, .xlsx, .csv)

• Verizon ( .xls, .xlsx, .csv)

This feature requires option E4 Phone data/analytics. If you do not have this option then you cannot upload phone data files.

Phone data files are files that have been extracted from a person's phone using tools such as Cellebrite and XRY. OSS-ESPA then makes the data from the files available on the ESPA analysis center screen for you to analyze in a variety of ways:

• Timeline tab: any data from the phone data files that includes timing information is included on this tab. This allows you to then analyze the sequence of events from all the data you've entered and uploaded into OSS-ESPA.
• Contact data tab: any contact data from the phone data files is displayed on this tab, for example names and telephone numbers.
• Events layer: any data from the phone data files that includes location details can be viewed on the map if this layer is selected.
• Link analysis tab: after running a link analysis this tab provides you with all the connections between the phone users. For further information refer to Running a link analysis.
• CDR data tab and Call analyses tab: any alias names from the phone data files are displayed alongside the respective phone numbers.

Phone data files do not include files such as photographs that are on the phone. If there are photographs on the phone that you think are of use to the case then these can be uploaded on the Pictures tab of the People and devices screen.

You can import multiple phone data files for the same phone number. Due to their size, it is recommended that the files are uploaded in .zip format, however they can be uploaded in their native .xml phone data file format. When zipping your phone data files you must ensure that you zip them individually with the file at the root folder level as subfolders are not supported.

This feature requires option E6 Public records data. If you do not have this option this screen is not available.

These files come from public records tools such as Thomson Reuters CLEAR or Whooster. Public records tools allow you to do reverse phone number look-up. This allows you to correlate phone numbers from the CDRs with names and address of the owners of those numbers. This is helpful in your investigation on the ESPA analysis center screen and in your IQ packets where it includes this information in the common and frequent analyses results.

OSS-ESPA imports Thomson Reuters CLEAR files and Whooster files automatically. However if you are using a different public records tool, or have a file you have manually created yourself, you must ensure that the following column titles are used in the .csv file:

• Name: this is mandatory and displays the name of the person associated with the phone number.
• Phone: this is mandatory.
• Latitude and Longitude: these columns are optional but if provided they allow an address marker to be displayed on the map.
• Address, City, State, Zip: these columns are optional but if provided they allow OSS-ESPA to calculate the latitude and longitude which allows an address marker to be displayed on the map.
• Source, First imported date, Last imported date, Service connect date, Operating company affiliated to: these columns are optional but if provided they are displayed on the Public records tab.
• Any additional columns are imported and available for you to view on the Properties dialog box.

Geo-location files are records which provide an accurate location of a person at an accurate time. These records may come from the mobile phone service provider (that is, the operator) if the source is for example a mobile phone, or they may come from a GPS tracker fitted to a vehicle, or a license plate reader which is located in a known position, or ankle bracelets fitted to a person. OSS-ESPA requires the following information from a geo-location file: time, latitude and longitude, and additionally for GPS ping files the accuracy buffer or call location confidence. A geo-location template is available to download from the Manage files screen when Data type is set to Geo-location files. For further information on using the template, refer to Importing geo-location data.

If you do not already have these files from the operator and require information on how to obtain them refer to I want to obtain real-time GPS location information on a phone.

You can import multiple files for the same phone number or vehicle if required. The files can either be Excel based files (.xls or .xlsx), or delimited text files (for example CSV and tab delimited). Alternatively click here to download an .xlsx template file provided by Gladiator Forensics.

OSS-ESPA imports Facebook, Snapchat, Instagram and WhatsApp social media files. You can import historical pdf files and realtime data using Smart Track. Social media files allow you to determine a person's social media activity, such as what groups and people they are following, which posts they are liking, who the person is contacting, and the information they are sharing. If the social media file contains geo-location information then this information is used to provide an accurate location of a person at an accurate time.

You can import multiple files for the same social media account if required. The files are pdf, .csv, .xlxs and .txt files.

Tower dump files are CDR files that contain call records for a specific location rather than for a specific phone number. If you are interested in what phones were in a specific location at a specific time you can request that each operator provides you, for the time period of interest, tower dump CDR records for all the cell towers that cover the location. Some operators provide all the CDR records for multiple locations in one tower dump file while others provide one tower dump file per cell tower. For tower dump files containing CDR records for multiple locations OSS-ESPA automatically creates a separate tower dump file for each location and provides options on how you define which location the file is applicable to. If required it also allows you to reassign each tower dump file to another location.

The Target development preview tab allows you to preview the results of both the geofence and tower dump files. If there are devices you are interested in, you can select them and add the device numbers and their associated locations into the case which allows you to use these records as CDRs. You can also filter the results based on one or more device identifiers, operator, data type, target buffer, location and the number of locations a device was found, cell identifier, sector, azimuth and intersects and save the results for use on the ESPA analysis center. The Target development management tab allows you to reassign each file to another location.

The files can be uploaded individually in their native format or in .zip format. However when zipping your tower dump files you must ensure that you zip them individually with the file at the root folder level as subfolders are not supported and they must all be for the same tower dump location or all multiple location files.

Geofence files are files that contain device records for an area surrounding a specific location. They are used for the same purpose as tower dump files but additionally provide you with timing advance data. If you are interested in what devices were in a specific location at a specific time you can request that an operator provides you, for the time period of interest, a geofence file for all the devices within the location. Currently only Google, T-mobile, Verizon, ATT and US Cellular provide geofence files. The Target development preview tab allows you to preview the results of both the geofence and tower dump files. If there are devices you are interested in, you can select them and add the device numbers and their associated locations into the case which allows you to use these records as CDRs. You can also filter the results based on one or more device identifiers, operator, data type, target buffer, location and the number of locations a device was found, cell identifier, sector, azimuth and intersects and save the results for use on the ESPA analysis center. The Target development management tab allows you to reassign each file to another location. You can then use the ESPA analysis center screen to analyze these records further.

The files can be uploaded individually in their native format or in .zip format. However when zipping your geofence files you must ensure that you zip them individually with the file at the root folder level as subfolders are not supported.

You can import multiple cell tower data files to the same case if required. The cell tower data files can either be Excel based files (.xls or .xlsx), delimited text files (for example CSV and tab delimited), or a zip file containing multiple files for the same operator and of the same format.

NOTE: If your file is large, or if you have multiple files from the same operator and of the same format it is recommended that you zip the files to minimize the upload time. Also, if you have previously uploaded a cell tower data file for the operator you cannot upload an additional cell tower data file for that operator. You must first delete any existing uploaded cell tower data files for that operator then upload the new file along with any of the previous files that you still require.

Additional files are those that you want to include in your IQ packet reports, advanced analysis reports and live location monitoring notification emails and for use in other features on the ESPA analysis center screen. For example you may want to upload photos of cell towers, locations, people, operations plans, intelligence packages and case related documents. For example you may want to include:

• photographs of the cell tower in your report. You can add these photographs into:
  • advanced analysis reports using the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box to add these files into text items if the files are .png, .jpg or .jpeg file format, or use the Add case files dialog box to add to these files as a case item.
  • IQ packets using the Additional case source files on the IQ packet settings screen.
• technical documents or presentations in your report that may be useful in providing support during the court case. You can add these files into:
  • advanced analysis reports using the Add case files dialog box.
  • IQ packets using the Additional case source files on the IQ packet settings screen.
• networks of special interests for use in WiFi analyses. You can select these files prior to running your analysis using the WiFi footprint analysis dialog box. They are then available for reference on this screen and are available to add into:
  • advanced analysis reports your reports using the Add case files dialog box.
  • IQ packets using the Additional case source files on the IQ packet settings screen.

• you can upload photographs of suspects and target locations from here, however it is recommended that you upload these types of images using the People and devices screen and the Locations of interest screen (Case management) as these screens allow you to set the default image. The default image is the one used in the narrative's Case info panel on the ESPA analysis center and the one included:

  • in advanced analysis reports when you select Add persons and Add selected target locations. In advanced analysis reports you can also use the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box to add these files into text items, or use the Add case files dialog box to add to these files as a case item.
  • by default in IQ packets.

If you require information on uploading or deleting additional files refer to Managing files or if you require information on adding them into:

• advanced analysis reports, depending on where you want to add them, refer to either Using target location information in advanced analysis reports, Using case files in advanced analysis reports or Managing advanced analysis reports.
• IQ packets refer to Using IQ packets.

All file types are supported.

Drive data files are used in cell and WiFi footprint analyses. When you upload drive data files OSS-ESPA automatically converts your drive data file into a usable format. This file conversion, depending on the size of the drive data file and your server availability, can take between ten minutes to an hour to complete. OSS-ESPA notifies you via email for each drive data file that you uploaded that this file conversion is complete. If you uploaded a .zip file then you will receive an email for each drive data file within the .zip file. Once you have received email notification that all your drive data files have successfully completed the file conversion you can then use the data to run an analysis.

If you require information on uploading or deleting drive data refer to Managing files.

It is recommended that the files are uploaded in .zip format, however they can be uploaded in their native drive test file format, for example .gtz and .aod. When zipping your drive data files you must ensure that all the files are at the root folder level as subfolders are not supported.

Subscriber information files are records provided by the mobile phone service provider (that is, the operator) that contain relevant information regarding the subscriber's personal details. Subscriber records are normally supplied automatically when you request a CDR from the operator. When you import these files OSS-ESPA creates the person's name and phone number, if it is not already in the case, and adds their email and a location using their address. The location is named "<person name> residence".

You can import .csv, .xlxs and .txt files.

This indicates the status of uploaded file that you have added to the case. The import process may not have been completed or successful. Alongside each file is an icon that displays the import status.

• indicates that the import process is queued to start processing or has already started processing and the file cannot yet be used.
• indicates that the import process has completed successfully and the file can be used.
• indicates that the import process has completed but with a warning, however the file can be used.
• indicates that the import process was not completing and the process timed out. The error may be due to the file containing invalid data. Please contact Gladiator Forensics if you require support in resolving this issue.

Click on a file name to assign it to another person, download, view or to delete the file. The Edit uploaded file screen opens.

This displays an OSS-ESPA generated identifier for the file. This identifier can also be displayed alongside each call detail record on the ESPA analysis center screen's CDR data tab so that you can identify which file the call detail record is from.

This displays the type of data contained in the uploaded file as detected by OSS-ESPA.

This displays the person to who the file is applicable. You can change this if required by selecting the file name then using Assigned to on the Edit uploaded file screen.

This displays the number of records in the files, as detected by OSS-ESPA.

Click to download a copy of the file being used by OSS-ESPA. In most instances this file is identical to the one uploaded, however for tower data files containing multi-locations this will be a subset of the original file containing only the data for one location.

Click to view the uploaded file on the View file content screen. The screen displaying the data also allows you to export the data in either .xls or .csv formats. This feature primarily allows you to compare the imported data with the original file to ensure the data imported successfully.

Click to download the log created by OSS-ESPA when the file was uploaded. This can provide useful information if your file did not upload correctly.

This setting is mandatory. Select the operator that the CDR is from. This is used to filter the phone numbers displayed in Phone number.

This setting is mandatory. Select which phone number the CDR file is for. The list displays all the phone numbers that you entered on the People and devices of interest screen for the selected operator.

NOTE: If you have not previously entered the phone number of the CDR you want to upload you must return to the Add Person screen and add the phone number to the correct person. If you have not previously created the person then you will have to add them first then enter the phone number.

Enter an optional description of the CDR file to help you identify the CDR file in the future. This description only appears in this setting, it does not appear on the ESPA analysis center screen, or in IQ packet or advanced analysis reports.

This setting is mandatory. Select the operator that the cell tower data file is for.

This setting is mandatory. Select the operator of the phone that the phone data is from. This is used to filter the phone numbers displayed in Phone number.

This setting is mandatory. Select which phone number the phone data file is for. The list displays all the phone numbers that you entered on the People and devices screen for the selected operator.

NOTE: If you have not previously entered the phone number of the phone data you want to upload you must return to the People and devices screen and add the phone number to the correct person. If you have not previously created the person then you will have to add them first then enter the phone number.

Enter a name for the phone data file, for example you may want to enter "John Smith personal phone".

Enter a description for the public record file, for example this may include additional information that is useful to you in identifying the file.

This setting is mandatory. Select the person that the geo-location file is for. This is used to filter the phone numbers and vehicle license plates displayed in Phone number.

Either this setting or Vehicle is mandatory. Select which phone number the geo-location file is for. The list displays all the phone numbers associated with the person you currently have selected.

Either this setting or Phone number is mandatory. Select which vehicle license plate the geo-location file is for. The list displays all the vehicle license plates associated with the person you currently have selected.

Select the source of the geo-location information.

• GPS Ping: these are initiated by the telecom network to determine the location of a mobile device, such as a mobile phone or tablet. These files are supplied by the mobile phone service provider and the data maps out as one point for each individual location.

  NOTE: GPS pings can be imported into OSS-ESPA using a variety of methods. The geo-location file type on the Manage files screen allows you to import historical GPS pings as described in Importing geo-location data. The Sentinel screen allows you to import historical GPS pings individually when you right-click the map and select Add location data. The Smart Track feature allows you to import live GPS pings from the operator as described in How to create a smart track alert.

• GPS Tracker: these are fitted onto vehicles and are tracked via the Global Positioning Satellite System. These files are supplied by your GPS tracking software and the data maps out as a breadcrumb trail of movement per day.
• License Plate Reader: these read the license plate of vehicles and are located in a known position. These files are supplied by your license plate reader software.

Select the icon you want to use to display geo-location events on the ESPA analysis center screen's map. This icon is only used if Source type is anything other than GPS Tracker. GPS tracker events are always displayed with small circles displaying the drive route. Click Icons to open the Available icons dialog box which provides you with a large selection of marker icons and also allows you to upload your own icons. If you'd prefer your own icon to be used then click Select to upload a graphic file. Windows Explorer opens. Navigate to the folder and select the required file then click Open.

Enter an optional description of the geo-location file to help you identify the file in the future. This description only appears in this setting, it does not appear on the ESPA analysis center screen, or in IQ packet or advanced analysis reports.

This setting is mandatory. Select the location that the file is for or select:

• Define location later: This can be used for both single location and multiple location files. OSS-ESPA creates individual files for each location in the uploaded file but it does not assign them to any location. This allows you to select any location from those defined in your case, at a later date using the Target development management tab.
• Automatically create a generic location: This can be used for both single location and multiple location files. OSS-ESPA creates individual target locations and target development files for each location in the file and names these locations as "Location <n>".
• Detect location in the file: This setting is only applicable to ATT, T-Mobile and US Cellular files with multiple locations. OSS-ESPA creates individual target locations and target development files for each location in the file and names these locations based on the location identifiers that are detailed in the uploaded file. The location identifiers may be an address, a latitude/longitude or a reference name.
• Detect location in key file: This can be used for T-Mobile tower dump files. Firstly you must upload the T-Mobile key file, with Data type set to Automatic detection, which automatically creates all the locations and events that are in the key. If you then upload the tower dump files using Detect location in key file, it automatically assigns the correct tower dump file to the locations created previously by the key file.

For further recommendations on these settings refer to Creating and analyzing geofence and tower dump cases.

This setting allows you to create only one event for the selected files. If you already have an event for the location then the data in the new files is associated with that event. If in the case you already have multiple events for the location then the data in the new files is associated with the event that was automatically created when you first created the location, and any events created in the event timeline and then associated with the location remain as separate events.

This setting is particularly useful for Verizon geofence files. Verizon geofence files do not contain the location within the file, but instead detail the longitude and latitude as part of the file name. It is recommended that with Verizon geofence files that you first create the location then import the geofence files to the location using this new Event timeline setting when you want the files to be associated with the one event timeline.

Select if you need to import the geofence or tower dump files without automatically running the analysis. You may need to do this if the files you are importing are very large, otherwise the import may fail. For example Verizon geofence files are often large and can consist of 0.5 to 1 million rows.

This setting allows the files to first import and then you must run the analysis by clicking Reconsolidate default analysis on the Target development management tab.

Enter a description for the file. If the file is added to an advanced analysis report then this description is also included. This description is coupled with the one on the People and devices screen and Locations of interest screen (Case management).

Select the type of file you want to upload. The selection you make and the file format you are uploading determines where the file will be available to add into your IQ packets and advanced analysis reports.

• Target location: select if the file or files you have uploaded are target location files. The files are then available to add into IQ packets, advanced analysis reports and live location monitoring notification emails.

  The default graphic file is available to add to add into your IQ packet by selecting to include the target location on the New IQ packet screen and the additional files can be included by selecting Additional case source files on the Custom IQ packet report settings screen.

  The files are available to add into your advanced analysis report:

  • all file formats: on the Add case files dialog box and Add selected target locations menu item.
  • graphic file formats: on the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box.

  NOTE: Image files on the Add/Edit locations screens are coupled with image files which are uploaded to a location on this screen. You can only set the default image file on the Add/Edit locations screen.

• Persons: select if the file or files you have uploaded are person files. The files are then available to add into IQ packets, advanced analysis reports and live location monitoring notification emails.

  The default graphic file is available to add to add into your IQ packet by selecting to include the person on the New IQ packet screen and the additional files can be included by selecting Additional case source files on the Custom IQ packet report settings screen.

  The files are available to add into your advanced analysis report:

  • all file formats: on the Add case files dialog box and Add persons menu item. Note, if you are using Add persons the files are embedded in the report therefore they are only useful if your report output is in Microsoft Word format and not a pdf.
  • graphic file formats: on the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box.

  NOTE: Image files on the People and devices screen are coupled with image files which are uploaded to a person on this screen. You can only set the default image file on the People and devices screen.

• Cell tower: select if the file or files you have uploaded are cell tower files. The files are then available to add into IQ packets and advanced analysis reports.

  The file is available to add to add into your IQ packet by selecting Additional case source files on the Custom IQ packet report settings screen.

  The files are available to add into your advanced analysis report:

  • all file formats: on the Add case files dialog box.
  • graphic file formats: on the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box.

• None: select if the file or files you have uploaded are general files, for example technical documents, and not specifically associated with a target location, person, or cell tower. The files are then available to add into IQ packets and advanced analysis reports.

  The file is available to add to add into your IQ packet by selecting Additional case source files on the Custom IQ packet report settings screen.

  The files are available to add into your report:

  • all file formats: on the Add case files dialog box.

  • graphic file format: on the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box.

  All file formats are available to select in other areas of the ESPA analysis center screen such as the Select a file dialog box which opens from the WiFi footprint analysis dialog box.

This is only displayed if you have Type of file selected as a target location. Select which target location the case files are applicable to.

This is only displayed if you have Type of file selected as a person. Select which person the case files are applicable to.

This is only displayed if you have Type of file selected as a cell tower. Select which operator the case files are applicable to.

This is only displayed if you have Type of file selected as a cell tower. Select which site the case files are applicable to.

This is only displayed if you have Type of file selected as a cell tower. Select which cell the case files are applicable to.

Displays whether the uploaded file was a geofence or tower dump file.

Displays any timezone adjustment that has been applied to the file.

Displays the file you uploaded.

Displays the operator of the file as determined by OSS-ESPA.

Displays the address of the location as detailed in the file.

Displays the number of device records in the file.

Displays the location that you selected or that was automatically created when the file was uploaded. Select if you want to apply the file to another location in your case.

Enter a timezone adjustment then click Update timezone to apply it to all the files that you have the check-box selected for in the table above.

If you have recently added more files, click to include the new data on the Manage files screen's Target development preview tab.