2.3 The first hour

This is one session, in order, from nothing to a case that contains evidence. Every command below is real; substitute your own frequencies, PLMN and paths. The example uses a GSM survey with a synthetic GSMTAP source, so it can be followed on a machine with no radio at all.

Step 1 — declare the case before touching a radio

python3 tools/casebook.py status
python3 tools/casebook.py case-create "site-a" "two macro cells, 900 and 1800" \
        "written authorisation, ticket 1234"

The case has a name, a scope and an authorisation note. The casebook asks for the last two because a capture without a stated basis is a file that gets deleted the first time somebody asks a lawyer about it, and because scope is what tells a later reader which of your rows are inside the experiment.

Step 2 — check the bench

modules/00_deps.sh --preflight
modules/05_field_kit.sh --capability

Nothing else happens until this is clean. If --preflight says the capture path is unusable, fix it now; if --capability says receive only, plan a passive session rather than discovering the limitation halfway through an attack.

Step 3 — choose and check the radio

modules/01_radio.sh --list-tsv
modules/01_radio.sh --select 0
modules/01_radio.sh --caps-tsv
modules/01_radio.sh --band-check 942

--band-check answers whether the device you selected can actually reach the frequency you intend to work on, including the antenna and amplifier question that a bare frequency range hides.

Step 4 — survey

modules/02_cell_recon.sh --scan gsm
modules/02_cell_recon.sh --list

The survey writes loot/cell_recon/cells.tsv:

rat  gen  arfcn  freq_mhz  plmn  mcc  mnc  operator  country
cell_id  tac_lac  band  rsrp_dbm  cipher  source  ts

Read the source column. A row that came out of a live scan and a row decoded out of somebody else's capture are both useful and are not the same evidence.

Step 5 — declare the target

modules/02_cell_recon.sh --set-target GSM 42 26201
python3 tools/casebook.py target-set GSM 26201 42 0A1B

Two commands, one meaning, two consumers. 02_cell_recon --set-target writes the shared radio target that modules read before they decode. The casebook's target-set writes the target into the case, which is what the GUI's target panel and the reports read. Keeping them in step is the operator's job, and the GUI shows both so a mismatch is visible rather than silent.

Step 6 — watch the air

modules/03_gsmtap.sh --listen 30
modules/03_gsmtap.sh --read captures/gsmtap-*.pcap
modules/03_gsmtap.sh --identities-tsv

--listen captures UDP 4729 into a pcap for the given number of seconds. Any GSMTAP source can feed it: this toolkit's field kit, gr-gsm, srsRAN, Open5GS, a node over the network. --read decodes a pcap into loot/gsmtap/decoded.tsv, and --identities-tsv prints the identities that crossed the air in the clear — which, on a 2G network with no cipher, is all of them.

Step 7 — read what you wrote, then close the loop

ls loot/cell_recon loot/gsmtap
python3 tools/casebook.py captures
python3 tools/casebook.py evidence-add loot/gsmtap/decoded.tsv 03_gsmtap observation
python3 tools/casebook.py report-html

evidence-add takes a file, a module tag, free tags and a sensitivity marker, so the case records where the file came from and how it should be handled. report-html renders the case — target, evidence, timeline, alerts — into one document. At this point the first hour is over and you have: a scoped case, a survey store, a decoded capture, an evidence index and a report, all of which are files you can hand to somebody else.

Part 2 has covered the bench, the radio and a session end to end. Part 3 describes the interfaces those same commands are exposed through — the CLI in more detail, then the TUI, then the GUI — and the gate suite that keeps the whole structure from drifting.