Mission setup screen

Locations are geographic points of interests that are used for investigating case data visually on the ESPA analysis center screen to determine the proximity of the locations to the sectors used during phone calls. They are also used in IQ packets and advanced analysis reports, may also be useful for drive planning, and are used in the geo-fence and reverse geo-fence live location monitoring alerts. For example, a location may be:

• A crime scene.
• A place of interest related to the crime or a phone user, for example the location of a phone user's home and locations a phone user is known to frequent.
• A place that you want to monitor a person entering or leaving using live location monitoring.

Although locations can be entered manually using the Locations of interest screen (Case management) you can also select to upload a file containing locations from both the Locations of interest screen (Case management) screen, the Manage case screen and the Manage files screen. This is useful if you already have a file containing multiple locations of interest, possibly from surveillance videos or credit card transactions. If the file also includes event times then an event is also automatically created on the Event timeline screen. Locations can also be created automatically by OSS-ESPA, for example when you upload geofence, tower dump or subscriber information files, and they can also be created manually in the ESPA analysis center and Sentinel screens.

For further information on the file's content requirements refer to Import locations from file screen.

Although persons can be entered manually using the People and devices screen you can also select to upload a file containing persons from both the People and devices of interest screen, the Manage case screen and the Manage files screen. This is useful if you already have a file containing multiple persons of interest, possibly from surveillance videos or credit card transactions. People can also be created automatically be OSS-ESPA, for example when you upload a subscriber information file.

The person file must either be either a .csv, .xls, or .xlsx file format, or a .zip file containing one of these file types. For the information in the file to import correctly, you must include the column headings in the first row of your file; refer to the following list for details of the column headings and content requirements, both of which are case insensitive. Alternatively click here to download an .xlsx template file provided by Gladiator Forensics.

For further information on the file's content requirements refer to Import persons from file screen.

Call Detail Records (CDR) are records provided by the mobile phone service provider (that is, the operator) that contains relevant information regarding calls made or services used by a subscriber.

If you add a person and phone numbers to the case using the People and devices screen then you must also import a CDR for each phone number if you want to include each phone number in your analysis. If you do not import a CDR for a phone number then on the ESPA analysis center screen the number is not displayed.

If you do not already have these files from the operator and require information on how to obtain them refer to I want to obtain historical Call Detail Records on a phone.

The CDR files can either be Excel based files (.xls or .xlsx) or delimited text files (for example CSV and tab delimited). You must not edit the CDR that the operator provides to you as OSS-ESPA uses data in the file to automatically detect the operator, the phone number the CDR belongs to, and the format of the CDR. OSS-ESPA normalizes the time based on the location of the tower and its time zone.

OSS-ESPA requires the following information from an operator's CDR:

• Type of service: voice call, data service, messaging (SMS, MMS, Text)
• Date and time of service (start and end times)
• Sectors used during the call or service. This must include the sector the call was initiated and terminated in. Each of these sectors must include the required unique identifiers to allow OSS-ESPA to analyze the case and present the geographical correlation of the CDR records and the sector data on the ESPA analysis center screen and advanced analysis reports. These unique identifiers are different for different technologies: for UMTS, GSM and IDEN these are the Local Area Code (LAC) and Cell ID; for CDMA these are typically the Switch Name/ID, Cell ID, and Sector/Face ID.

Different types of CDRs and advanced CDRs are supported, for example: RTT, PCMD, Nelos, Handover; truecall, IP Session, IPDR, VoLTE, VoNR, TOT, MNI, SMS, Landline, Scamp, and toll.

Supported file content

• ATT (.txt, .xls, .xlsx, .csv. The .pdf format is not supported.)

• Caroline West ( .xls, .xlsx, .csv)

• Cricket ( .xls, .xlsx, .csv)

• MetroPCS ( .xls, .xlsx, .csv)

• Nextel

• Sprint ( .xls, .xlsx, .csv)

• T-Mobile ( .xls, .xlsx, .csv)

• US Cellular ( .xls, .xlsx, .csv)

• Verizon ( .xls, .xlsx, .csv)

This feature requires option E4 Phone data/analytics. If you do not have this option then you cannot upload phone data files.

Phone data files are files that have been extracted from a person's phone using tools such as Cellebrite and XRY. OSS-ESPA then makes the data from the files available on the ESPA analysis center screen for you to analyze in a variety of ways:

• Timeline tab: any data from the phone data files that includes timing information is included on this tab. This allows you to then analyze the sequence of events from all the data you've entered and uploaded into OSS-ESPA.
• Contact data tab: any contact data from the phone data files is displayed on this tab, for example names and telephone numbers.
• Events layer: any data from the phone data files that includes location details can be viewed on the map if this layer is selected.
• Link analysis tab: after running a link analysis this tab provides you with all the connections between the phone users. For further information refer to Running a link analysis.
• CDR data tab and Call analyses tab: any alias names from the phone data files are displayed alongside the respective phone numbers.

Phone data files do not include files such as photographs that are on the phone. If there are photographs on the phone that you think are of use to the case then these can be uploaded on the Pictures tab of the People and devices screen.

You can import multiple phone data files for the same phone number. Due to their size, it is recommended that the files are uploaded in .zip format, however they can be uploaded in their native .xml phone data file format. When zipping your phone data files you must ensure that you zip them individually with the file at the root folder level as subfolders are not supported.

This feature requires option E6 Public records data. If you do not have this option this screen is not available.

These files come from public records tools such as Thomson Reuters CLEAR or Whooster. Public records tools allow you to do reverse phone number look-up. This allows you to correlate phone numbers from the CDRs with names and address of the owners of those numbers. This is helpful in your investigation on the ESPA analysis center screen and in your IQ packets where it includes this information in the common and frequent analyses results.

OSS-ESPA imports Thomson Reuters CLEAR files and Whooster files automatically. However if you are using a different public records tool, or have a file you have manually created yourself, you must ensure that the following column titles are used in the .csv file:

• Name: this is mandatory and displays the name of the person associated with the phone number.
• Phone: this is mandatory.
• Latitude and Longitude: these columns are optional but if provided they allow an address marker to be displayed on the map.
• Address, City, State, Zip: these columns are optional but if provided they allow OSS-ESPA to calculate the latitude and longitude which allows an address marker to be displayed on the map.
• Source, First imported date, Last imported date, Service connect date, Operating company affiliated to: these columns are optional but if provided they are displayed on the Public records tab.
• Any additional columns are imported and available for you to view on the Properties dialog box.

Geo-location files are records which provide an accurate location of a person at an accurate time. These records may come from the mobile phone service provider (that is, the operator) if the source is for example a mobile phone, or they may come from a GPS tracker fitted to a vehicle, or a license plate reader which is located in a known position, or ankle bracelets fitted to a person. OSS-ESPA requires the following information from a geo-location file: time, latitude and longitude, and additionally for GPS ping files the accuracy buffer or call location confidence. A geo-location template is available to download from the Manage files screen when Data type is set to Geo-location files. For further information on using the template, refer to Importing geo-location data.

If you do not already have these files from the operator and require information on how to obtain them refer to I want to obtain real-time GPS location information on a phone.

You can import multiple files for the same phone number or vehicle if required. The files can either be Excel based files (.xls or .xlsx), or delimited text files (for example CSV and tab delimited). Alternatively click here to download an .xlsx template file provided by Gladiator Forensics.

OSS-ESPA imports Facebook, Snapchat, Instagram and WhatsApp social media files. You can import historical pdf files and realtime data using Smart Track. Social media files allow you to determine a person's social media activity, such as what groups and people they are following, which posts they are liking, who the person is contacting, and the information they are sharing. If the social media file contains geo-location information then this information is used to provide an accurate location of a person at an accurate time.

You can import multiple files for the same social media account if required. The files are pdf, .csv, .xlxs and .txt files.

Tower dump files are CDR files that contain call records for a specific location rather than for a specific phone number. If you are interested in what phones were in a specific location at a specific time you can request that each operator provides you, for the time period of interest, tower dump CDR records for all the cell towers that cover the location. Some operators provide all the CDR records for multiple locations in one tower dump file while others provide one tower dump file per cell tower. For tower dump files containing CDR records for multiple locations OSS-ESPA automatically creates a separate tower dump file for each location and provides options on how you define which location the file is applicable to. If required it also allows you to reassign each tower dump file to another location.

The Target development preview tab allows you to preview the results of both the geofence and tower dump files. If there are devices you are interested in, you can select them and add the device numbers and their associated locations into the case which allows you to use these records as CDRs. You can also filter the results based on one or more device identifiers, operator, data type, target buffer, location and the number of locations a device was found, cell identifier, sector, azimuth and intersects and save the results for use on the ESPA analysis center. The Target development management tab allows you to reassign each file to another location.

The files can be uploaded individually in their native format or in .zip format. However when zipping your tower dump files you must ensure that you zip them individually with the file at the root folder level as subfolders are not supported and they must all be for the same tower dump location or all multiple location files.

Geofence files are files that contain device records for an area surrounding a specific location. They are used for the same purpose as tower dump files but additionally provide you with timing advance data. If you are interested in what devices were in a specific location at a specific time you can request that an operator provides you, for the time period of interest, a geofence file for all the devices within the location. Currently only Google, T-mobile, Verizon, ATT and US Cellular provide geofence files. The Target development preview tab allows you to preview the results of both the geofence and tower dump files. If there are devices you are interested in, you can select them and add the device numbers and their associated locations into the case which allows you to use these records as CDRs. You can also filter the results based on one or more device identifiers, operator, data type, target buffer, location and the number of locations a device was found, cell identifier, sector, azimuth and intersects and save the results for use on the ESPA analysis center. The Target development management tab allows you to reassign each file to another location. You can then use the ESPA analysis center screen to analyze these records further.

The files can be uploaded individually in their native format or in .zip format. However when zipping your geofence files you must ensure that you zip them individually with the file at the root folder level as subfolders are not supported.

You can import multiple cell tower data files to the same case if required. The cell tower data files can either be Excel based files (.xls or .xlsx), delimited text files (for example CSV and tab delimited), or a zip file containing multiple files for the same operator and of the same format.

NOTE: If your file is large, or if you have multiple files from the same operator and of the same format it is recommended that you zip the files to minimize the upload time. Also, if you have previously uploaded a cell tower data file for the operator you cannot upload an additional cell tower data file for that operator. You must first delete any existing uploaded cell tower data files for that operator then upload the new file along with any of the previous files that you still require.

Additional files are those that you want to include in your IQ packet reports, advanced analysis reports and live location monitoring notification emails and for use in other features on the ESPA analysis center screen. For example you may want to upload photos of cell towers, locations, people, operations plans, intelligence packages and case related documents. For example you may want to include:

• photographs of the cell tower in your report. You can add these photographs into:
  • advanced analysis reports using the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box to add these files into text items if the files are .png, .jpg or .jpeg file format, or use the Add case files dialog box to add to these files as a case item.
  • IQ packets using the Additional case source files on the IQ packet settings screen.
• technical documents or presentations in your report that may be useful in providing support during the court case. You can add these files into:
  • advanced analysis reports using the Add case files dialog box.
  • IQ packets using the Additional case source files on the IQ packet settings screen.
• networks of special interests for use in WiFi analyses. You can select these files prior to running your analysis using the WiFi footprint analysis dialog box. They are then available for reference on this screen and are available to add into:
  • advanced analysis reports your reports using the Add case files dialog box.
  • IQ packets using the Additional case source files on the IQ packet settings screen.

• you can upload photographs of suspects and target locations from here, however it is recommended that you upload these types of images using the People and devices screen and the Locations of interest screen (Case management) as these screens allow you to set the default image. The default image is the one used in the narrative's Case info panel on the ESPA analysis center and the one included:

  • in advanced analysis reports when you select Add persons and Add selected target locations. In advanced analysis reports you can also use the Insert image dialog box available from the Add text dialog box, Edit text dialog box, and Edit notes dialog box to add these files into text items, or use the Add case files dialog box to add to these files as a case item.
  • by default in IQ packets.

If you require information on uploading or deleting additional files refer to Managing files or if you require information on adding them into:

• advanced analysis reports, depending on where you want to add them, refer to either Using target location information in advanced analysis reports, Using case files in advanced analysis reports or Managing advanced analysis reports.
• IQ packets refer to Using IQ packets.

All file types are supported.

Drive data files are used in cell and WiFi footprint analyses. When you upload drive data files OSS-ESPA automatically converts your drive data file into a usable format. This file conversion, depending on the size of the drive data file and your server availability, can take between ten minutes to an hour to complete. OSS-ESPA notifies you via email for each drive data file that you uploaded that this file conversion is complete. If you uploaded a .zip file then you will receive an email for each drive data file within the .zip file. Once you have received email notification that all your drive data files have successfully completed the file conversion you can then use the data to run an analysis.

If you require information on uploading or deleting drive data refer to Managing files.

It is recommended that the files are uploaded in .zip format, however they can be uploaded in their native drive test file format, for example .gtz and .aod. When zipping your drive data files you must ensure that all the files are at the root folder level as subfolders are not supported.

Subscriber information files are records provided by the mobile phone service provider (that is, the operator) that contain relevant information regarding the subscriber's personal details. Subscriber records are normally supplied automatically when you request a CDR from the operator. When you import these files OSS-ESPA creates the person's name and phone number, if it is not already in the case, and adds their email and a location using their address. The location is named "<person name> residence".

You can import .csv, .xlxs and .txt files.

Enter a new name or select one from the existing list. This drop-down is empty if you have just started to create your case.

This setting is mandatory. Enter a new mobile phone number or select one from the existing list. This drop-down is empty if you have just started to create your case. The first setting is for the country code of the mobile phone, for example in the Unites States this is 1.

This setting is mandatory. Select the operator that the mobile phone is registered to.

This is only applicable if the operator is Sprint. Enter the Case ID that Sprint provides you with for the selected phone number.

Select the check-box and choose a date if you require OSS-ESPA to automatically import raw historical live location monitoring for the vehicle. When the historical import both starts and completes, notifications are sent to the case owner and case assignees. Non-raw historical data (such as .csv and .txt files) can be imported using Manage files screen.

Enter a new name or select one from the existing list. This drop-down is empty if you have just started to create your case.

This setting is mandatory if you want to track a vehicle. Enter the license plate of the vehicle.

Select the manufacturer of the vehicle. This information is then included in IQ packets, live location monitoring emails and the advanced analysis reports.

Enter the model of the vehicle. This information is then included in IQ packets, live location monitoring emails and the advanced analysis reports.

Enter the color of the vehicle. This information is then included in IQ packets, live location monitoring emails and the advanced analysis reports.

Select the check-box and choose a date if you require OSS-ESPA to automatically import raw historical live location monitoring for the vehicle. When the historical import both starts and completes, notifications are sent to the case owner and case assignees. Non-raw historical data (such as .csv and .txt files) can be imported using Manage files screen.

Select if you want to monitor when a call location is of a high enough accuracy that it could help you physically locate the phone or vehicle. If a live location monitoring event occurs for a call location within the defined 200 meter minimum accuracy then OSS-ESPA will send an ACCURACY ALERT email.

This creates an accuracy alert that can be managed on the Smart Track alerts & notifications screen titled "High Accuracy", with an Alert type of "Accuracy" and a Minimum accuracy of "200 meters".

This setting is only displayed if Phone is selected.

Select if you want to monitor when a phone is switched on. If the latitude and longitude provided by the live location monitoring event was previously zero but it has now provided a value then this indicates the operator has received a signal from the phone, due to the phone either being switched on or entering an area with signal coverage, then OSS-ESPA will send a PHONE ON ALERT email.

This creates an alert that can be managed on the Smart Track alerts & notifications screen titled "Phone ON".

This setting is only displayed if Phone is selected.

Select if you want to monitor when a phone is switched off. If the latitude and longitude provided by the live location monitoring event is zero which indicates the operator has received no signal from the phone, due to the phone either being switched off or entering an area with no signal coverage, then OSS-ESPA will send a PHONE OFF ALERT email.

This creates an alert that can be managed on the Smart Track alerts & notifications screen titled "Phone OFF".