SIM card forensics

We use a range of tools to examine SIM cards. The most commonly used tool is USIM Detective, with the fallback options of .XRY, and SIMCon and others. These tools are used to forensically recover live and deleted data from SIM cards and presented to the client in a clear and formatted report.

The data we can recover includes:

• The phone number of the SIM card (known as the MSISDN - mobile station international subscriber dialling number).
• Contacts/phonebook entries: a list of all contacts stored on the SIM card, often stored in the order in which they were entered onto the memory.
• Text messages, and deleted text messages that can be recovered if they have not been overwritten. The SIM stores messages in a consecutive order, and once deleted by the user of the handset these messages remain on the SIM card until further messages arrive and are saved over the deleted message.
• The last ten dialled calls, stored in most cases without a date/time but this data can occasionally be obtained and is produced in the forensic examination report if it is there.
• Email addresses (3 Network), the numbers of the last ten handsets into which the SIM has been inserted (02).
• Network information - compatible and forbidden mobile networks which the SIM card may or may not be able to use when roaming, i.e. when the user is abroad and wishes to connect to the networks in use in a particular country.

SIM cards are usually read using .XRY Omnikey, or Envisage Towitoko hardware. Other solutions can be used if the SIM card is incompatible with these methods. If a SIM card is PIN locked, we will ask you to ask the network provider to supply the PUK (Personal Unlocking Key).