Forensics Dangers

Some feature phones only work with a SIM card inserted.

However, if the handset detects that the SIM card has changed (based on IMSI, ICCID, or both) it could potentially delete the call register entries.

Solution:

  • when available, clone SIM card ICCID and IMSI (requires special equipment).

    • SIM with cloned ICCID and IMSI cannot connect to the cell network.

SIM card security.

  • PIN (personal identification number) - if the PIN is enabled and entered incorrectly 3 times in a row, the SIM card will be blocked.

  • PUK (PIN unlock key) - if PUK is entered 10 times incorrectly, the SIM card will become permanently blocked and unrecoverable.

    • PUK is a SIM-specific code assigned by the service provider.

    • cannot be changed by the user.

Without the PIN.

  • only ICCID can be read from the SIM card.

  • with the ICCID ask the service provider for the PUK -> requires legal procedures.

Mobile Station International Subscriber Directory Number (MSISDN)

SIM cards can store one or more phone numbers (MSISDNs), but entries are unreliable:

  • the number may never have been used.

  • the MSISDN may have been ported over from a previous SIM.

  • in older handsets, the number may be missing or edited by the owner.

  • MSISDN must be confirmed with the service provider.

Last updated