Forensic Cellular Site Survey and Analysis Training

This course has been designed as an intensive master class for forensic radio frequency propagation cell site surveyors. For those new to the topic, it provides a detailed introduction to cellular radio technologies and RF surveying, and for more experienced attendees, it provides a complete refresh of their cellular radio knowledge and introduces new 5G concepts. The course includes the opportunity to practice techniques associated with surveying 5G cell sites.

The course covers the foundation principles of Networking, Radio Propagation, Cellular technologies and Wi-Fi - including the architecture, technologies and techniques employed by 4G and 5G mobile networks. It provides RFPS (Radio Frequency Propagation Survey) practitioners with an opportunity to enhance their understanding of survey techniques in real world scenarios and to develop the skills required to undertake RFPS surveys using their own survey devices.

The course has been designed and is delivered by experienced cellular radio engineers who have over 40 years’ experience of delivering Cell Site Analysis reports and RF survey data in court.

 

Course Aim: by the end of this course delegates will:

• Understand the foundational engineering principles underpinning Cell Site Analysis and RF Propagation Surveying.
• Understand the architecture and general operation of 4G, 5G and WiFi networks
• Appreciate the signal flows and protocols associated with the set up and tear down of voice, SMS, data connections and timing advance.
• Understand the theory and best practice underpinning effective RF Surveying.
• Be able to demonstrate the process of undertaking best practice RF surveys.

 

Course Objectives: by the end of this course delegates will be able to:

• Demonstrate an understanding of cellular radio concepts.
• Discuss the basic properties of concepts such as radio noise, interference and transmit power including an understanding of the decibel measurement scale.
• Describe the configuration of a typical cell and cell site.
• Demonstrate an understanding of the basic techniques and technologies employed by 4G LTE and 5G NR networks.
• Describe the set of basic identifiers used on the LTE/5G NR air interfaces such as Physical Layer Cell IDs (PCIs), EARFCNs and 4G/5G Cell IDs.
• Outline the processes followed by a phone when initially selecting (S algorithm) and then reselecting (R algorithm) a serving cell.
• Demonstrate an understanding of how and why a phone will select a particular cell to use when making a call or tother type of connection.
• Outline the technical processes employed to capture Timing Advance data.
• Outline the processes involved in preparing for an RFPS survey, including CDR analysis, creating survey instructions and a target cell list.
• Describe in the detail the meanings of various RFPS survey data, such as dB, dBm, RSRP, RSRQ, RSSI, ARFCN, PCI, CGI and others.
• State the expected signal strength ranges for 4G and 5G surveys with an indication of the high and low ends of each typical strength range.
• Demonstrate an understanding of the best practice RF survey methodologies – including survey preparation, survey safety, survey techniques, data analysis and report writing.
• Demonstrate proficiency in undertaking RF surveys using the supplied equipment.
• Successfully complete and pass the course assessments to attain Forensic Analytics certified accreditation as an RFPS Practitioner.

 

Course resources:

PowerPoint presentation, video clips, live survey data, exercise handouts, anonymised call data examples, online assessment via Moodle.

We will also provide access to the Lima Cell Monitor RF survey device and a copy of CSAS to process and visualise RF data. Participants are free to bring their own RF survey devices and/or processing software to use on the course, but we can’t guarantee that the instructors will be familiar will all of them.

All modules are Instructor led unless stated.

 

Course delivery methodology:

The course is instructor led with explanatory sessions, exercises and activities. There will be a pre/post course test and a morning test each day to confirm understanding of the previous day’s training.

The instructor led explanatory sessions consist of PowerPoint presentations that introduce the underlying radio and cellular technologies and develop the participant’s understanding of the aims and objectives of RFPS surveys. The PowerPoint presentations will be aided by video clips and/or examples of case studies including survey results. The instructor led sessions are delivered by experienced cell site practitioners, who intersperse the learning with relevant examples drawn from their own experience.

The practical sessions consist of fictitious, but realistic scenarios. Each scenario will present details of a case, along with CDRs or other source evidence. The participants will be required to analyse the source data, compare it to the case allegations, create the required survey preparation documents and undertake RF surveys. After the survey, the captured data will be analysed and an RF report created.

Post-course support resources include a telephone support line, access to an experienced RFPS practitioner as a mentor and access to a secure online community forum.

 

Meet Your Instructor

Joe Hoy - Forensic Analytics Co-Founder

Joe has a background in telecoms engineering and training. Gaining experience initially as an IT and telecoms engineer with BT, NCR and AT&T, Joe moved across to cellular telecoms and worked on a variety of engineering and training projects for Nokia around the world.

He has also worked as a cell site analyst and expert witness and has compiled many forensic reports for a variety of police forces and agencies including Scotland Yard in London and has presented them in a range of courts, including the Old Bailey. He is the author of ‘Forensic Radio Survey Techniques for Cell Site Analysis’ (Joseph Hoy, Wiley 2024) and was a member of the UK Forensic Science Regulator’s cell site analysis best practice working group. Joe is also a contributor to the US SWGDE standards group.

 

Obligatory

• Basic maths skills
• Computer literacy
• Basic Windows skills (open Windows File Explorer, open text files using Notepad)
• Basic Microsoft Excel skills (open an Excel spreadsheet, import data into a spreadsheet from a text file, add tabs to a spreadsheet) 
• Familiarity with using generic Android apps

Highly recommended

• An understanding of Call Detail Records (CDR) and cell site interpretation and analysis,
• Previous exposure to RF surveys as part of cell site investigations is desirable.

Note: Basic skills in this area can be gained by pre-reading ‘Forensic Radio Survey Techniques for Cell Site Analysis, 2nd Edition’, Joseph Hoy, Wiley 2024, ISBN: 978-1-394-19717-0.

 

Day 1

Module 1.1: Introduction to Radio. Radio concepts; frequency/wavelength/amplitude; cycles per second/hertz; radio spectrum; bands & channels; radio measurements; propagation; multipaths.

Module 1.2: Cellular Technologies. Cellular theory; duplex techniques; cell/tower sites; cell configurations; azimuth & beamwidth; cell coverage concepts; cell types; single frequency networks; stack cells; cell discrimination; ARFCNs & PCIs; CGIs; cellular generations; mobile devices & SIMs; multiple access techniques; OFDMA; OFDMA numerology; 4G LTE; 5G NR; carrier aggregation & dual connectivity; idle mode behavior; tracking areas.

Day 2

Module 2.1: RFPS Measurements. dB/dBm; RSRQ/RSRP/RSSI; selection & reselection; managing reselections.

Module 2.2: Core Networks & Services. Core networks; device identifiers; network activities; idle & connected modes; timing advance; device registration & authentication; tracking area updates & paging; handovers.

Module 2.3: Cell Site Analysis. Overview; cell site analysis outputs; CDRs; data session CDRs; limitations of cell site analysis; conclusions; device location techniques; cell visualisation methods

Day 3

Module 3.1: RF Surveys. Forensic radio surveys; survey equipment types; types of survey; location surveys; cell coverage surveys; route surveys; survey preparation; survey safety; undertaking surveys; processing survey results; best practice report writing.

Module 3.2: Survey Equipment Overview. Lima Cell Monitor; review any equipment participants have brought along.

Scenario contents may change and so will not be detailed here.

Day 4

Module 4.1: Scenario 1 – Planning & prep

Module 4.2: Scenario 1 – RF survey

Module 4.3: Scenario 1 – Data analysis & report writing

Day 5

Module 5.1: Scenario 2

Module 5.2: End of course review and assessment - Delegates have 60 minutes to answer 40 randomized questions based upon RFPS theory and survey technique.