Potential Evidence

What data can potentially be evidence on the (U)SIM?

• ICCID and IMSI.

• phonebook/contacts.

• SMS messages, including deleted (if not overwritten).

• call information.

What happens when an SMS on the (U)SIM is deleted?

• the message status is changed to indicate the message is no longer required.

• however, the content of the message is typically left intact.

• message is only overwritten when space is required for a new SMS.

• So deleted SMS may be retrieved by accessing SIM via a card reader.

Each SMS message has a maximum length.

• 160 characters (for the GSM Latin alphabet).

• less characters per message for Arabic, Hebrew, etc.

• long SMS is split into 2 or more separate messages.

Network data on SIM card.

• location area information can be retrieved from SIM cards but its value is limited.

  • likely to reflect the location of the seizure, but could be used to ensure the handset hasn't been switched on after the seizure.

• list of allowed or forbidden networks.

• other network information can also be retrieved, e. g. TMSI, Kc, etc.

  • may not be relevant to many investigations.