HTS ANALYSIS IN FORENSIC CASES Technical, Legal and Applied Dimensions
Review Article Keywords: HTS • Base Station • Location Determination • Digital Evidence • Forensic Telecommunications ABSTRACT Historical Traffic Signalling (HTS) analysis is a telecommunications analysis method based on the retrospective examination of logs of every kind of signal interaction between mobile phone users and base stations. In forensic investigations, HTS analysis is used with increasing frequency to determine the geographical region in which suspects, victims or witnesses were located during a given date and time interval, to establish whether they were in communication with one another, and to set out movement patterns. This review article addresses comprehensively, on the basis of academic sources, the technical structure and production mechanisms of HTS data, the manner in which base station location data is interpreted geographically, the applied methodology of forensic HTS analysis, its evidential value and reliability limitations, the conditions of legal admissibility, and the practical dimensions of the use of HTS evidence in judicial decisions. The article also evaluates the technical misconceptions and judicial errors encountered in this field.
Keywords: HTS analysis, base station record, CDR, forensic telecommunications, mobile location determination, digital evidence, cellular network, digital forensics ABSTRACT Historical Traffic Signalling (HTS) analysis is a telecommunications analysis method based on the retrospective examination of logs of all signal interactions between mobile phone users and base stations. In forensic investigations, HTS analysis is used with increasing frequency to determine the geographic location of suspects, victims, or witnesses during specific date and time intervals, to establish whether they were in communication with each other, and to reconstruct movement patterns. This review article comprehensively examines, based on academic sources, the technical structure and production mechanisms of HTS data, the geographic interpretation of base station location data, the applied methodology of forensic HTS analysis, the evidentiary value and reliability limitations, the conditions for legal admissibility, and the practical dimensions of HTS evidence usage in judicial decisions. The article also evaluates technical misconceptions and judicial errors encountered in this field. 1. Introduction With the rapid integration of mobile communication technologies into social life, the traffic records kept by cellular network operators have become an indispensable element of criminal investigations. Every call, text message, data connection and even network registration event (location update) of a mobile phone is processed automatically in operator systems and retained for a certain period. The totality of these records is designated by different terms in different countries — CDR (Call Detail Record), IPDR (Internet Protocol Detail Record), traffic signalling record, or HTS (Casey, 2011).
The concept of HTS (Historical Traffic Signalling record), which has become widespread in Turkish law and practice, covers the entirety of the records kept by telecommunications companies concerning customers' historical communication traffic. These records contain not only who spoke to whom, but also the base station through which the connection was established, the time and duration of the connection, and the SIM and device identities used (IMSI/IMEI). This rich data set enables forensic analysts to draw strong inferences about where a person was physically located at a given time and place (Hargreaves & Chivers, 2016).
The importance of HTS analysis in criminal investigations has increased dramatically over the past decade. In serious crime investigations such as homicide, organised crime, drug trafficking, counter-terrorism and abduction, HTS evidence frequently forms the backbone of the prosecution case. Even so, the technical complexity of this evidence and the difficulty of grasping it within judicial circles can lay the ground both for wrongful convictions and for offenders being acquitted for want of evidence (Morrison & Enzinger, 2018). The aim of this article is to address the technical, methodological and legal dimensions of HTS analysis in an integrated manner and to present a comprehensive academic framework on the subject.
2. The Technical Structure and Production Mechanism of HTS Data 2.1 The Formation of the Traffic Record A mobile phone continuously exchanges signals with the base station of the cell in which it is located, independently of whether the user initiates an active call or performs a data transfer. These interactions fall into various categories, each generating different record types in the operator's network management systems: • Location Update (LU / Periodic LU): the phone sends a signal notifying the network of its location at set intervals or during transitions between cells. These records contain base station information even at moments when the user has no active call.
• Call records (MO/MT Call): contain the start and end times, duration, calling/called number and connected base station for voice calls initiated (Mobile Originated) and received (Mobile Terminated).
• SMS records: cover the timestamp, counterpart number and base station information for text messages sent and received.
• Data session records (IPDR): contain the start and end times of internet and data connection sessions, the volume of data used and connection point information. • Emergency network registration (IMSI Attach/Detach): records corresponding to the switching on and off of the phone, documenting connection to and disconnection from the network (Casey, 2011). The critical importance of these records stems from the fact that they document not only active communication but also passive network interactions. Even if a suspect's phone is silenced and in a bag, it may periodically register in base station logs, and these records offer information about the geographical region in which the suspect was located during a given period (Hargreaves & Chivers, 2016).
2.2 IMSI, IMEI and the Phone–SIM Relationship Two basic identifiers are used for identification purposes in HTS analysis. The IMSI (International Mobile Subscriber Identity) is a unique 15-digit identity number specific to the SIM card, identifying the communication information linked to the subscription. The IMEI (International Mobile Equipment Identity) is a 15-digit serial number specific to the device, identifying the device independently of the SIM card (3GPP TS 23.003, 2021).
Tracking these two identifiers separately makes critical inferences possible in forensic analysis: the appearance of the same IMEI with different IMSIs indicates that the SIM card has been changed in the device. The appearance of the same IMSI with different IMEIs shows that the SIM card has been inserted into different devices. Both patterns are extremely valuable forensically, particularly in detecting attempts to conceal identity (Hargreaves & Chivers, 2016). On the other hand, IMEI manipulation — changing the IMEI number through phone software or a hardware modification — is a difficulty that may be encountered in criminal investigations. Making an identification based on a single identifier during analysis may therefore constitute a methodological error; IMSI and IMEI data should be used together for cross-verification (Ayers et al., 2014).
2.3 Data Retention Periods and Conditions of Access How long HTS data is retained by operators varies significantly both from country to country and from operator to operator. In Europe, the EU Data Retention Directive (2006/24/EC) required member states to retain data for between 6 and 24 months; but the Court of Justice of the European Union annulled that directive in 2014 as disproportionate and left the matter of data retention to national legislation (Waidner & Backes, 2016). In Turkish law, under Law No. 5651 and the related regulations, operators are obliged to retain traffic data for two years. Public prosecutors and courts may access this data by written request within the scope of a criminal investigation. It should be noted as an important point that different data types may be subject to different retention periods, and data whose period has expired is irreversibly deleted. This results in critical evidence becoming inaccessible in delayed investigations (Kerr, 2010). 3. Base Station Data and Geographical Location Interpretation 3.1 The Geographical Structure of the Cellular Network Each connection line in an HTS record contains a Cell-ID identifying the base station serving the terminal at that moment. This identity comprises the MCC (Mobile Country Code), MNC (Mobile Network Code), LAC (Location Area Code) and CI (Cell Identity) fields. Combined, these components uniquely identify the sector to which the user was connected in geographical terms (Hargreaves & Chivers, 2016).
Base stations are mostly divided into three sectors, each covering an angular range of roughly 120 degrees. The coverage area of a sector — its transmission radius — varies between a few hundred metres and 1–2 km in urban environments and may reach tens of kilometres in rural areas. This fact is a critical point frequently overlooked in HTS analysis: a Cell-ID shows not that the user was at a particular point, but that they were at some position within a broad coverage area (Jain & Demers, 2019).
3.2 Coverage Area Uncertainty and Limits of Interpretation The most frequent methodological error in HTS analysis is the presentation of the base station record as definitive location data. In reality the base station record permits only a probabilistic estimate of the likely position. The coverage area varies according to a range of factors such as terrain topology, building density, tree cover and atmospheric conditions (Morrison & Enzinger, 2018).
Two phenomena warrant particular attention. First, anomalous cell selection: a mobile terminal may connect to a geographically more distant cell. This may arise because of a radio obstruction, network load balancing or a delay in the handover mechanism. Second, coverage overlap: particularly in dense urban areas multiple base stations cover the same geographical point, and the terminal determines which station to connect to moment by moment according to radio conditions. These two phenomena can cause two different users at the same location to register with different Cell-IDs (Jain & Demers, 2019).
These limitations make it essential that coverage mapping be carried out rigorously in forensic HTS analysis. Consulting not only the theoretical coverage data supplied by the operator but also actual field measurement data (drive test, walk test) increases methodological reliability (Hargreaves & Chivers, 2016). 3.3 Techniques Used in Location Determination More than one technique may be used to estimate location from HTS data. The most basic and most widespread, the Cell-ID method, produces a coarse position estimate by matching the cell identity to known base station coordinates. This method depends on the operator's base station database information and carries an uncertainty the size of the coverage area (Ayers et al., 2014). Among more advanced techniques, the Timing Advance (TA) parameter stands out. Able to take values between 0 and 63 in GSM networks, TA reflects the speed-of-light-based distance between the terminal and the base station; one TA unit corresponds to roughly 550 m. Where TA data is available, the coverage circle can be narrowed to a particular ring region. In UMTS and LTE networks, Round-Trip Time (RTT) and E-CID (Enhanced Cell-ID) methods perform a similar function (Peterson, 2017).
The RSSI-based trilateration method, which uses signal strength measurements from multiple base stations, geometrically intersects the distance estimates of the stations surrounding the terminal. The accuracy of this method is directly proportional to the number of base stations used; but in urban environments multipath propagation can adversely affect estimation accuracy (Jain & Demers, 2019). Table 1. Comparison of HTS Location Determination Methods Method Basic Principle Accuracy Requirement Use Cell-ID Base station coordinates (coverage) 100 m – 35 km Operator BTS database Widespread Timing Advance Signal propagation time ~550 m (1 TA unit) TA record must be present Moderate (GSM) E-CID / RTT Round-trip delay time 50–300 m LTE record support Developing (LTE) Trilateration (RSSI) Multiple BTS signal strength measurement 100–500 m (urban) Multiple BTS Expert analysis GPS (device data) Satellite coordinates < 10 m Device log access Limited Note. Accuracy values relate to typical urban scenarios; significant deviation may be observed in rural environments and settings full of obstacles. Source: Hargreaves & Chivers (2016); Jain & Demers (2019); Peterson (2017). 4. Forensic HTS Analysis: Methodology and Stages of Application 4.1 Data Collection and Chain of Custody The validity of forensic HTS analysis depends to a large extent on the integrity of the chain of custody. HTS data received from the operator must be documented with the request document, the delivery record and hash values (a cryptographic digest such as SHA-256). Where this step is omitted or left incomplete, defence counsel can challenge the authenticity of the data and its evidential value may be weakened (Carrier, 2006).
The principal points the analyst must observe at the data collection stage are: (1) keeping the requested data range wide enough to cover the period before and after the date of the incident; (2) querying all relevant IMSI and IMEI identifiers separately; (3) requesting any IPDR (data traffic) data separately from voice call data; (4) obtaining the version of the base station coordinate database (Cell-ID database) applicable to the date of the incident — since base station locations can change over time (Casey, 2011). 4.2 Data Preparation and Cleaning Raw HTS data generally arrives from different operator systems in different formats (CSV, Excel, XML, proprietary format) and must be standardised before analysis begins. The typical problems encountered at this stage are: • Time zone inconsistencies: operator systems may record timestamps in local time or in UTC; if the analyst is unaware of this difference, time offsets can arise.
• Missing records: there may be no records for certain time intervals owing to a network outage, system maintenance or a database fault; these gaps must be identified and reported.
• Duplicate records: where the same event is logged by more than one system, duplicate lines can arise; these lines must be filtered out. • Erroneous Cell-IDs: Cell-IDs absent from the base station database or entered with incorrect coordinates create gaps in geographical mapping (Ayers et al., 2014). 4.3 Timeline and Movement Pattern Analysis Once data preparation is complete, the process moves to the reconstruction of the timeline, which is the core of the analysis. At this stage all communication events are placed in chronological order; the Cell-ID of each event is matched to known base station coordinates and transferred to a map. The resulting image constitutes a movement tracking map showing the suspect's geographical movement over a particular time period (Hargreaves & Chivers, 2016).
The methodological principles to be observed in movement pattern analysis are: (1) explaining the time gaps between records: a long period of silence may indicate that the phone was switched off, out of network coverage, or that data is missing; reaching a conclusion without discussing these possibilities is erroneous. (2) The logical consistency of neighbouring cell transitions: a sudden transition between two geographically distant cells is an expected finding if the phone has been moved; but if it implies a speed the same person could not have achieved, that inconsistency must be reported. (3) Assessing network load at the hour of the incident: cell selection patterns may differ from the norm at busy times (Morrison & Enzinger, 2018). 4.4 Communication Network Analysis HTS analysis covers not only geographical location determination but also social network pattern analysis. In this analysis, relationship maps are created by examining with whom, how often, in which time intervals and for what durations the suspect communicated. In organised crime and terrorism investigations this technique is particularly valuable for setting out hierarchical structures and chains of command (Casey, 2011).
The basic metrics used in communication network analysis are call frequency, communication duration, reciprocity ratio (the proportion of occasions on which a person is both the calling and the called party), communication timing and the types of communication channel used (voice, SMS, data). Assessing these metrics together offers a pattern-identification capacity that goes far beyond mere communication records (Peterson, 2017).
5. The Value, Reliability and Limitations of HTS Evidence 5.1 Factors Affecting Evidential Force A number of factors determine the weight of HTS evidence in judicial proceedings. Evidential force increases when the following conditions come together: a high degree of overlap between the timeline and the date of the incident; the geographical consistency of the Cell-IDs with the scene; the movement pattern being unrebuttable by alternative explanations; and corroboration by independent physical or eyewitness evidence (Morrison & Enzinger, 2018).
The limitations of HTS evidence are equally important: • Identity of phone and user: an HTS record shows that a device or SIM card was connected to a particular cell at a particular moment. It does not prove who was using the phone at that moment; the SIM card may be in use by another person. • Coverage area uncertainty: the base station record establishes only the lower bound of the possible location area; it does not offer a determination of an exact point.
• The difference between the network event and the physical event: the timestamp of a call record does not always coincide with the timestamp of the physical event; the physical event may have occurred before the call began.
• The possibility of manipulation: techniques such as SIM cloning and IMEI alteration can jeopardise the reliability of the HTS record; this possibility must be assessed in the investigation (Ayers et al., 2014).
5.2 Technical Misconceptions and Judicial Risks Various structural risks arising from the misinterpretation of HTS evidence are observed in judicial practice. Morrison & Enzinger (2018) address these risks under four principal headings:
The first risk is the fallacy of certainty: prosecutors or experts present the base station record as proof that the accused was definitely at that point; yet the record provides only a probabilistic inference. This fallacy emerges most clearly in analyses conducted without coverage mapping.
The second risk is the confusion of causation: the suspect's being connected to a cell covering the scene places them at the scene; but where that cell has a coverage area of tens of km², the inference is misleading.
The third risk is the exclusion fallacy: the absence from the suspect's HTS record of any registration with a cell covering the scene does not prove that the person was not there; the phone may have been switched off, out of coverage, or no signal interaction generating a record may have taken place.
The fourth risk is a lack of expert knowledge: where the judge or jury lacks technical background, complex HTS analyses are accepted without the critical evaluation they require, which increases the risk of judicial error. "A base station record is not proof of a particular location; it is an indicator of a probabilistic range of positions. This distinction is frequently overlooked in judicial proceedings and leads to seriously mistaken conclusions." (Morrison & Enzinger, 2018, p. 214) 6. Legal Admissibility and the Judicial Framework 6.1 Standards for the Admission of Digital Evidence The admissibility of digital evidence in court is subject to additional standards beyond the traditional rules of evidence. In US law the Daubert standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) provides for four basic criteria in assessing the reliability of scientific evidence: (1) whether the methodology has been tested; (2) whether the error rate is known; (3) whether it is accepted by the professional community; (4) whether it appears in peer-reviewed publications (Faigman et al., 2014).
In English law, R v. T (2010) and subsequent case law require that forensic expert opinions rest on a statistical basis and that uncertainties be stated explicitly. These developments directly affect the standards for reporting uncertainty when HTS analysis is brought before the courts (Robertson & Vignaux, 1995). In Turkish law, Article 135 of the Code of Criminal Procedure No. 5271 (CMK) governs the interception of communications and Article 138 the use of evidence obtained incidentally. The power to request HTS data from telecommunications operators depends on a decision of the prosecutor or the court; under Article 332 of the CMK a traffic record may be obtained by judicial order within the scope of a criminal investigation. Compliance of the evidence-gathering procedure with these provisions is a precondition of evidential validity.
6.2 The Right to Privacy and Proportionality HTS data contains extremely detailed information concerning individuals' private lives: where they were, their contacts, the hours at which they were active, and even sensitive behavioural patterns such as religious worship or visits to health institutions can be inferred from this data. Access to HTS data is therefore subject to a proportionality review under Article 8 of the European Convention on Human Rights (the right to respect for private life) (Waidner & Backes, 2016). The European Court of Human Rights held in Zakharov v. Russia (2015) and Szabó and Vissy v. Hungary (2016) that bulk surveillance mechanisms violate the individual's privacy of communications. This case law weakens the legal legitimacy of bulk and untargeted access to HTS data and makes it necessary that investigations rest on a concrete suspicion directed at a particular person and offence (Kerr, 2010).
6.3 The Expert Report and Standards HTS analysis is presented to the court through the report of an expert with technical knowledge. International digital forensics standards set out the minimum elements an HTS expert report must contain. Carrier (2006) and Casey (2011) list them as follows: • A clear definition of the scope of the analysis: which data set was examined, and for what period, must be stated.
• A detailed explanation of the methodology used: the location estimation method, the tools used and the assumptions made must be conveyed in full.
• Explicit declaration of uncertainties and limitations: coverage area uncertainty, data gaps and alternative interpretations must be reported. • Expression of findings in probabilistic language: instead of 'the suspect was there', expressions such as 'it is highly probable that the suspect's phone was within the coverage area of that cell' should be used.
• Cross-verification: verification carried out against independent data sources (physical evidence, camera footage, witness statements) must be reported (Carrier, 2006). Table 2. Principal Methodological Errors Encountered in the HTS Analysis Process and Their Effects Type of Error Explanation Judicial Effect Fallacy of certainty Presenting a probabilistic position as a definite one Risk of wrongful conviction Coverage mapping not performed Using the theoretical BTS point and ignoring actual coverage Misleading geographical attribution Time zone error Confusion of UTC / local time Incorrect timeline Phone–user identification Identifying a person from the SIM record Risk of identity error Ignoring data gaps Failure to report periods of missing records Misleading impression of continuity Disregarding anomalous cell selection Failure to explain a connection to a distant cell Erroneous location inference Note. Compiled on the basis of Morrison & Enzinger (2018); Hargreaves & Chivers (2016); Ayers et al. (2014).
7. Applied Examples: The Use of HTS Across Different Types of Offence 7.1 Homicide and Serious Crime Investigations In homicide investigations HTS analysis is generally used to seek answers to two critical questions: (1) Was the suspect registered at a base station geographically consistent with the scene at the hour the offence was committed? (2) In what direction did the victim's phone move from its last recorded location, and when was the last record?
One of the strongest functions of HTS analysis in such investigations is the reconstruction of the victim's movement pattern after their disappearance. Even if its owner is no longer alive or no longer using it, the victim's phone may have left a final base station record before going offline. That last record provides a valuable lead for directing search operations (Casey, 2011).
Even so, it must not be forgotten that in such cases exact location determination is not possible even in urban environments where a large number of base stations exist in the area concerned — only an estimate of a geographical area can be made; and this limitation must be conveyed clearly to the jury (Jain & Demers, 2019).
7.2 Organised Crime and Drug Trafficking In organised crime investigations, HTS's strongest contribution is setting out organisational structures through communication network analysis. By analysing the HTS data of numerous suspects together, patterns can be identified indicating who is a manager, who a courier and who responsible for logistics. Communication timings and geographical overlaps are independent evidence of coordinated action (Peterson, 2017).
In drug trafficking cases HTS analysis is also used to reconstruct transport routes. The base station records lined up along the route a vehicle has travelled are useful in confirming the route, but additional evidence is required to identify the person in the vehicle. While the phone inside the vehicle follows the vehicle's route, who was driving it cannot always be inferred directly from HTS data (Hargreaves & Chivers, 2016). 7.3 Counter-Terrorism Investigations In the counter-terrorism context HTS analysis is used both for retrospective investigation and for intelligence purposes. In retrospective analysis, the routes taken by attackers before an attack, the phones registering at base stations during reconnaissance activity and the escape route after an attack can be reconstructed with this technique. This use was a key source of evidence in the investigations of the 2004 Madrid and 2005 London attacks (Waidner & Backes, 2016).
On the other hand, large-scale bulk data analysis practices in this field are the subject of serious legal and ethical debate. Querying the data of all phones registering at a base station in a particular geographical area at a particular moment — a practice also known as a geofence warrant — carries the risk of mass privacy violation and is being debated in various jurisdictions (Kerr, 2010).
7.4 Missing Person and Abduction Cases In missing person investigations HTS analysis is used to follow a person's trail of movement from their last known location and to determine their interaction with other phones in the area. In abduction cases the HTS data obtained from the phones of both the victim and the suspects is examined comparatively; shared base station records are assessed as an indicator of whether two people were in the same area at the same time (Casey, 2011).
An important caveat must be noted: two people registering at the same base station at the same time shows not that those people were close to each other, but only that they were within the coverage area of the same cell. Since that area may be tens of km², such a finding is insufficient on its own and cannot be presented as proof of physical proximity without corroborating evidence (Morrison & Enzinger, 2018).
8. Advanced Analytical Methods and Technological Developments 8.1 Big Data and Machine Learning Applications Manual analysis of millions of lines of HTS records is not feasible in terms of time. Forensic analysts therefore make increasing use of big data tools and machine learning algorithms. Clustering algorithms (K-means, DBSCAN) can automatically identify the geographical points a suspect frequently visits (home, workplace, meeting points). Anomaly detection algorithms flag days or hours deviating from the usual behavioural pattern, focusing the analyst's attention (Peterson, 2017). Nevertheless, it must not be forgotten that the use of machine-learning-based tools in a forensic context brings serious methodological requirements: the model's training data must have been independently verified; outputs must be presented with a probabilistic interpretation; and the black box character of the algorithm can create tension with legal standards requiring explicable methodology before a court (Faigman et al., 2014). 8.2 HTS Analysis in 5G Networks: A Changing Picture The spread of fifth-generation (5G) networks significantly affects the technical dimension of HTS analysis. The denser base station network of 5G — particularly small cell deployments — can theoretically provide higher positional resolution. The presence of dozens of closely spaced small cells in a city can substantially narrow the coverage area indicated by the Cell-ID record (Dahlman et al., 2018). On the other hand, 5G's network slicing and edge computing architecture means that data processing and storage acquire a decentralised structure. This complicates the legal framework and technical procedure of forensic data collection: the question of at which node and in which country's jurisdiction data is stored raises new legal questions requiring cross-border judicial cooperation (Waidner & Backes, 2016).
8.3 The Effect of Privacy-Enhancing Technologies The spread of encrypted communication applications (Signal, WhatsApp, Telegram) makes access to communication content more difficult. Because HTS analysis focuses not on content but on traffic data, it is not directly affected by this development. However, as end-to-end encrypted applications begin to replace traditional SMS and voice calls, fewer communication events and therefore sparser base station records appear in operator records. This reduces the geographical resolution of HTS analysis (Kerr, 2010). In addition, the spread of Wi-Fi Calling and VoIP applications makes it possible for voice communication to take place not over the mobile network but through Wi-Fi access points. Such calls may not be reflected in classic base station records and can constitute a significant forensic blind spot (Peterson, 2017).
9. Ethical Dimensions and the Privacy Balance While HTS analysis is a powerful tool for criminal investigations, it stands in fundamental tension with individuals' privacy rights. That tension is not merely a legal problem but also a problem of ethical design. The ability to reconstruct retrospectively all of a person's movements and communication patterns gives concrete form to Big Brother surveillance concerns (Waidner & Backes, 2016).
To manage this tension, the principle of proportionality occupies a central place in forensic telecommunications practice: targeted and measured data requests rather than bulk data; data access powers proportionate to the gravity of the investigation; use of the data obtained solely for the purposes of that investigation, and its destruction after the designated retention period, are the basic requirements of this principle (Kerr, 2010). Under international human rights standards, interference with the right to privacy must have a legal basis, pursue a legitimate aim, be necessary in a democratic society and be proportionate.
10. Conclusion HTS analysis has become an indispensable tool of modern criminal investigation. The digital traces mobile phone users leave at base stations with every interaction constitute a unique resource for location determination, communication network analysis and the reconstruction of movement patterns. The correct, reliable and lawful use of this resource is of decisive importance both for the administration of justice and for the protection of fundamental rights. As set out in detail in this article, the forensic reliability of HTS analysis depends on methodological rigour, the accuracy of coverage mapping, the transparency of the expert report and the technical literacy of the court. The fallacy of certainty, disregard for coverage area uncertainty and errors in identifying phone with user are structural risks that can lay the ground both for wrongful convictions and for the acquittal of the guilty. The spread of 5G networks, the integration of machine learning tools into forensic practice and the growth of encrypted communication platforms are continually reshaping the technical framework of HTS analysis. Keeping pace with this change requires a continuous process of dialogue and capacity building among forensic analysts, legal practitioners and regulators. The correct, proportionate and auditable use of HTS analysis is the fundamental guarantee of both the right to a fair trial and the protection of public safety. References 3GPP TS 23.003. (2021). Numbering, addressing and identification (Release 16). 3rd Generation Partnership Project.
Ayers, R., Brothers, S., & Jansen, W. (2014). Guidelines on mobile device forensics (NIST Special Publication 800-101 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-101r1 Carrier, B. D. (2006). Risks of live digital forensic analysis. Communications of the ACM, 49(2), 56–61. https://doi.org/10.1145/1113034.1113062 Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers and the internet (3rd ed.). Academic Press.
Dahlman, E., Parkvall, S., & Sköld, J. (2018). 5G NR: The next generation wireless access technology. Academic Press.
Faigman, D. L., Monahan, J., & Slobogin, C. (2014). Group to individual (G2I) inference in scientific expert testimony. University of Chicago Law Review, 81(2), 417–480. Hargreaves, C., & Chivers, H. (2016). Recovery of mobile device forensic evidence from telecommunication networks. Digital Investigation, 17, 72–83. https://doi.org/10.1016/j.diin.2016.03.002 Jain, A., & Demers, A. (2019). Cell tower location forensics: Technical reliability and legal standards. Journal of Digital Forensics, Security and Law, 14(2), 1–22. Kerr, O. S. (2010). Applying the fourth amendment to the internet: A general approach. Stanford Law Review, 62(4), 1005–1050.
Morrison, G. S., & Enzinger, E. (2018). What should a forensic practitioner's likelihood ratio be? Science & Justice, 58(3), 212–218. https://doi.org/10.1016/j.scijus.2017.10.004 Peterson, G. (2017). Mobile network forensics: Extracting and analyzing evidence from cellular networks. Elsevier.
Robertson, B., & Vignaux, G. A. (1995). Interpreting evidence: Evaluating forensic science in the courtroom. John Wiley & Sons.
Waidner, M., & Backes, M. (2016). Security and privacy challenges in the 5G era. IEEE Internet Computing, 20(5), 14–17. https://doi.org/10.1109/MIC.2016.101
