Should make examinations interesting. Apparently, an open-ended SIM that can be either postpaid or prepaid account without the need to change SIMs but still switch between carriers. Either Apple intend to go for their own IMSI (thus become an operator) or the IMSI will need to be updated OTA...hmmmm
"If you are among the millions who will purchase one of the 4G versions of the new iPad Air 2 or iPad mini 3 tablets from Apple in the next few months, and you live in the US or UK, then when you switch the tablet on for the first time, you will find a nano-SIM card already installed in the SIM card slot."
..............
"What Apple envisions with its SIM is that users will be able to quickly and easily switch between different carriers to take advantage of the best short-term deals available at any given time - without having to go through the hassle of getting a new SIM card.
"Obviously, if you have signed up to a two-year contract you won't be switching deals that often, but if you are on a pay-as-you-go deal, then this could be a real money-saver......."
Quotes from:
http://www.ibtimes.co.uk/apple-sim-how-does-it-work-end-sim-cards-1471065
Showing posts with label SIM cards. Show all posts
Showing posts with label SIM cards. Show all posts
Wednesday, October 29, 2014
Monday, June 21, 2010
Gold Wafer SIM Cards
Gold Wafer SIM Cards
A snippet of information I recently noted that was interesting related to the recyclicable gold used in SIM Cards. It is said that although the thickness of gold is measured in microns, a generalised (perhaps inaccurate) comparison that has been made is that it would take the gold leaf removed from at least 500,000 recycled SIM Cards to make one gold ring. Thought provoking comparison perhaps, but it tells us nothing about the real weight of the gold used for each SIM Card and nothing about the gold's purity either.
So don't give up work just yet.
So don't give up work just yet.
Gold Wafer SIM Cards
Gold Wafer SIM Cards
A snippet of information I recently noted that was interesting related to the recyclicable gold used in SIM Cards. It is said that although the thickness of gold is measured in microns, a generalised (perhaps inaccurate) comparison that has been made is that it would take the gold leaf removed from at least 500,000 recycled SIM Cards to make one gold ring. Thought provoking comparison perhaps, but it tells us nothing about the real weight of the gold used for each SIM Card and nothing about the gold's purity either.
So don't give up work just yet.
So don't give up work just yet.
Wednesday, November 29, 2006
Switch On, Update, Lose Evidence
Switch On, Update, Lose Evidence
The focus of this article relates to what can happen when switching on a mobile telephone and how data can change on a SIM Card. Essentially how a mobile telephone updates a SIM card relating to location data is down to how each make and model of mobile telephone has been programmed. When dealing with location data in SIM Cards it should not be assumed that every make/model updates location data immediately or within a prescribed period. Certain events trigger location update data and therefore it is important to determine on a case by case basis how a mobile telephone and its SIM card should be examined.
I have received several comments from different sources saying that they found location data was not updated when the mobile telephone was held within a shielded device or bag. This is fine, but it has been found that data can change in such environments and it is not the case that it was only a few times, but the fact that it happened at all can mean unilaterally ignoring that such an event (loss of data) might occur may mean losing vital evidence.
A best practise methodology has been outlined in the article for those that wish to follow it and the justification for using such a stated methodology.
http://www.filebucket.net/files/1579_ov3rx/Switch%20On%20Update%20Lose%20Evidence%20.pdf
The focus of this article relates to what can happen when switching on a mobile telephone and how data can change on a SIM Card. Essentially how a mobile telephone updates a SIM card relating to location data is down to how each make and model of mobile telephone has been programmed. When dealing with location data in SIM Cards it should not be assumed that every make/model updates location data immediately or within a prescribed period. Certain events trigger location update data and therefore it is important to determine on a case by case basis how a mobile telephone and its SIM card should be examined.
I have received several comments from different sources saying that they found location data was not updated when the mobile telephone was held within a shielded device or bag. This is fine, but it has been found that data can change in such environments and it is not the case that it was only a few times, but the fact that it happened at all can mean unilaterally ignoring that such an event (loss of data) might occur may mean losing vital evidence.
A best practise methodology has been outlined in the article for those that wish to follow it and the justification for using such a stated methodology.
http://www.filebucket.net/files/1579_ov3rx/Switch%20On%20Update%20Lose%20Evidence%20.pdf
Switch On, Update, Lose Evidence
Switch On, Update, Lose Evidence
The focus of this article relates to what can happen when switching on a mobile telephone and how data can change on a SIM Card. Essentially how a mobile telephone updates a SIM card relating to location data is down to how each make and model of mobile telephone has been programmed. When dealing with location data in SIM Cards it should not be assumed that every make/model updates location data immediately or within a prescribed period. Certain events trigger location update data and therefore it is important to determine on a case by case basis how a mobile telephone and its SIM card should be examined.
I have received several comments from different sources saying that they found location data was not updated when the mobile telephone was held within a shielded device or bag. This is fine, but it has been found that data can change in such environments and it is not the case that it was only a few times, but the fact that it happened at all can mean unilaterally ignoring that such an event (loss of data) might occur may mean losing vital evidence.
A best practise methodology has been outlined in the article for those that wish to follow it and the justification for using such a stated methodology.
http://www.filebucket.net/files/1579_ov3rx/Switch%20On%20Update%20Lose%20Evidence%20.pdf
The focus of this article relates to what can happen when switching on a mobile telephone and how data can change on a SIM Card. Essentially how a mobile telephone updates a SIM card relating to location data is down to how each make and model of mobile telephone has been programmed. When dealing with location data in SIM Cards it should not be assumed that every make/model updates location data immediately or within a prescribed period. Certain events trigger location update data and therefore it is important to determine on a case by case basis how a mobile telephone and its SIM card should be examined.
I have received several comments from different sources saying that they found location data was not updated when the mobile telephone was held within a shielded device or bag. This is fine, but it has been found that data can change in such environments and it is not the case that it was only a few times, but the fact that it happened at all can mean unilaterally ignoring that such an event (loss of data) might occur may mean losing vital evidence.
A best practise methodology has been outlined in the article for those that wish to follow it and the justification for using such a stated methodology.
http://www.filebucket.net/files/1579_ov3rx/Switch%20On%20Update%20Lose%20Evidence%20.pdf
Wednesday, November 15, 2006
Smith's LND Dilemma
Smith's LND Dilemma
In real cases of mobile 'phone and SIM Card examination, as opposed to theoretical discussion about them, entries found in elementary file Last Number Dialled (EFLND) on a SIM Card can be quite complex to determine and today do not have a clearly defined pattern as to the origin of data, as one might think is suggested by the GSM Standard 11.11. This is largely due to misunderstandings as to the interpretation to be given to relevant clauses within the Standard and what they actually mean. There is some commentary in the Standard which provides for minimal comprehension of possible origin of data in LND, but not nearly enough for my work.
Back in the early 1990s there was an considerable amount to be learnt about GSM SIM cards and I needed a way that I could at least comprehend how data was being shared and recorded in elementary files (EF) in the SIM. As data was being recorded in the elementary files Last Number Dialled (EFLND) which appeared to be from origins other than from within the SIM by 2002, this meant a re-think of a simple 'problem' algorithm I had written back in 1995, which was titled "Smith's LND Dilemma", so titled for copyright reasons.
As mentioned above, the early algorithm was written relating to data generated in EFLND internally to the SIM and the 2003 update I did included possible arguments for external sources for generation of the data. I updated Smith's LND Dilemma to consider where less restrictive assumptions are considered regarding determining LND entries, the investigation uncovers a more complex series of potential events and appears as a non-complete combinational problem, due to some undefined sources. The undefined sources are used for investigation having first investigated common sources where data is known to originate. The undefined sources were, in essence, a precaution by me to cover myself where sources occurred from uncommon or a new implementations in SIM, or simlar from external sources, such as mobile telephones. Also, I needed to consider the issue of programs that can generate data on SIM Cards. I didn't wish to be confined by identifying particular program/s.
I have reproduced the main part of Smith's LND Dilemma and cut out coding remarks and other bits etc, which make for uncomfortable reading and comprehension. Well I hope this helps examiners, or newbies to our branch of forensic science, regarding investigating mobile telephone evidence. This is just the tip of the iceberg .
Smith's LND Dilemma
#
# Makefile for Smith's LND Dilemma (c) by Gregory N Smith
#
.
.
.
Where (
Entries = 3F00+2FE2+7F10+6F44+6F4A
)
if (
and 7F20+6F38+7F10+6F3D = allocated+activated+string
)
Where origin needs to be known (
If 7F10+6F3D+6F44+6F3A+6F40+6F4A
)
and/ (
If 7F10+6F3D+6F44+6F4A+6F42
)
/or (
If 7F10+6F3D+6F44+6F3B(6F3A+6F40+6F42+6F4A)+6F4B
)
/or (
If 7F10+6F3D+6F44+6F49+6F4C
)
/or (
If 7F10+6F3D+6F44+6F4D(6F44+6F3A+6F40+6F42+6F49+6F4A+6F4B+6F4C)+6F4E
)= Entries
However, where (
Entries = 3F00+2FE2+7F10+6F44+6F4A
)
If (
and 7F20+6F38+7F10+6F3D = allocated+activated+string
)
Where origin needs to be known (
If +CGMI+CGMM +CGSN
)
If (
and/ +CLCC+7F10+6F3D+6F44+6F4A
)
If (
/or +CPBS(+CPBR)+7F10+6F3D+6F44+6F4A
)
If (
/or +CMGL(+CPMR)+7F10+6F3D+6F44+6F4A
)= Entries
Alternatively, where (
Entries = 3F00+2FE2+7F10+6F44+6F4A
)
if (
and 7F20+6F38+7F10+6F3D = allocated+activated+string
)
Where origin needs to be known (
and/ undefinedsource+7F10+6F3D+6F44+6F4A
)= Entries
(c) Gregory N Smith 1995-2006
In real cases of mobile 'phone and SIM Card examination, as opposed to theoretical discussion about them, entries found in elementary file Last Number Dialled (EFLND) on a SIM Card can be quite complex to determine and today do not have a clearly defined pattern as to the origin of data, as one might think is suggested by the GSM Standard 11.11. This is largely due to misunderstandings as to the interpretation to be given to relevant clauses within the Standard and what they actually mean. There is some commentary in the Standard which provides for minimal comprehension of possible origin of data in LND, but not nearly enough for my work.
Back in the early 1990s there was an considerable amount to be learnt about GSM SIM cards and I needed a way that I could at least comprehend how data was being shared and recorded in elementary files (EF) in the SIM. As data was being recorded in the elementary files Last Number Dialled (EFLND) which appeared to be from origins other than from within the SIM by 2002, this meant a re-think of a simple 'problem' algorithm I had written back in 1995, which was titled "Smith's LND Dilemma", so titled for copyright reasons.
As mentioned above, the early algorithm was written relating to data generated in EFLND internally to the SIM and the 2003 update I did included possible arguments for external sources for generation of the data. I updated Smith's LND Dilemma to consider where less restrictive assumptions are considered regarding determining LND entries, the investigation uncovers a more complex series of potential events and appears as a non-complete combinational problem, due to some undefined sources. The undefined sources are used for investigation having first investigated common sources where data is known to originate. The undefined sources were, in essence, a precaution by me to cover myself where sources occurred from uncommon or a new implementations in SIM, or simlar from external sources, such as mobile telephones. Also, I needed to consider the issue of programs that can generate data on SIM Cards. I didn't wish to be confined by identifying particular program/s.
I have reproduced the main part of Smith's LND Dilemma and cut out coding remarks and other bits etc, which make for uncomfortable reading and comprehension. Well I hope this helps examiners, or newbies to our branch of forensic science, regarding investigating mobile telephone evidence. This is just the tip of the iceberg .
Smith's LND Dilemma
#
# Makefile for Smith's LND Dilemma (c) by Gregory N Smith
#
.
.
.
Where (
Entries = 3F00+2FE2+7F10+6F44+6F4A
)
if (
and 7F20+6F38+7F10+6F3D = allocated+activated+string
)
Where origin needs to be known (
If 7F10+6F3D+6F44+6F3A+6F40+6F4A
)
and/ (
If 7F10+6F3D+6F44+6F4A+6F42
)
/or (
If 7F10+6F3D+6F44+6F3B(6F3A+6F40+6F42+6F4A)+6F4B
)
/or (
If 7F10+6F3D+6F44+6F49+6F4C
)
/or (
If 7F10+6F3D+6F44+6F4D(6F44+6F3A+6F40+6F42+6F49+6F4A+6F4B+6F4C)+6F4E
)= Entries
However, where (
Entries = 3F00+2FE2+7F10+6F44+6F4A
)
If (
and 7F20+6F38+7F10+6F3D = allocated+activated+string
)
Where origin needs to be known (
If +CGMI+CGMM +CGSN
)
If (
and/ +CLCC+7F10+6F3D+6F44+6F4A
)
If (
/or +CPBS(+CPBR)+7F10+6F3D+6F44+6F4A
)
If (
/or +CMGL(+CPMR)+7F10+6F3D+6F44+6F4A
)= Entries
Alternatively, where (
Entries = 3F00+2FE2+7F10+6F44+6F4A
)
if (
and 7F20+6F38+7F10+6F3D = allocated+activated+string
)
Where origin needs to be known (
and/ undefinedsource+7F10+6F3D+6F44+6F4A
)= Entries
(c) Gregory N Smith 1995-2006
Tuesday, November 07, 2006
Super Ghost SIM
Interesting product but which 3F002FE27F206F07 would be relevant? ... happy mobile telephone evidence hunting...
Super Ghost SIM
- NEW FEATURE! Switch between SIMs via the phone's menu!
- NEW FEATURE! Option to auto switch between SIMs every 1-99 minutes
- use the manual sim selection option if you don't want to auto switch
- allows you to use two SIM cards in one phone
- no need to cut your SIM card like with similar products
- more convenient than removing your back cover/battery every time you want to swap SIM cards
- combine business/personal lines and address books on one handset
- switch between networks easily - no more coverage problems!
- take advantages of cheaper rates from different phone companies
- saves your previous calls, received calls, time and date settings etc.
- new ultra slim design - sits inbetween your battery and back cover
- no need to replace your phone's back cover - the ghost SIMs sit inbetween your battery and standard back cover
- works with all SIMs (including 3)
- can be used to add another 200 contacts to your phone book via the second sim card (sim dependent)
- works with virtually all makes and models
- also known as dual SIMs/twin SIMs
http://www.formymobile.co.uk/proddetail.php?prod=supersim
Super Ghost SIM
- NEW FEATURE! Switch between SIMs via the phone's menu!
- NEW FEATURE! Option to auto switch between SIMs every 1-99 minutes
- use the manual sim selection option if you don't want to auto switch
- allows you to use two SIM cards in one phone
- no need to cut your SIM card like with similar products
- more convenient than removing your back cover/battery every time you want to swap SIM cards
- combine business/personal lines and address books on one handset
- switch between networks easily - no more coverage problems!
- take advantages of cheaper rates from different phone companies
- saves your previous calls, received calls, time and date settings etc.
- new ultra slim design - sits inbetween your battery and back cover
- no need to replace your phone's back cover - the ghost SIMs sit inbetween your battery and standard back cover
- works with all SIMs (including 3)
- can be used to add another 200 contacts to your phone book via the second sim card (sim dependent)
- works with virtually all makes and models
- also known as dual SIMs/twin SIMs
http://www.formymobile.co.uk/proddetail.php?prod=supersim
Super Ghost SIM
Interesting product but which 3F002FE27F206F07 would be relevant? ... happy mobile telephone evidence hunting...
Super Ghost SIM
- NEW FEATURE! Switch between SIMs via the phone's menu!
- NEW FEATURE! Option to auto switch between SIMs every 1-99 minutes
- use the manual sim selection option if you don't want to auto switch
- allows you to use two SIM cards in one phone
- no need to cut your SIM card like with similar products
- more convenient than removing your back cover/battery every time you want to swap SIM cards
- combine business/personal lines and address books on one handset
- switch between networks easily - no more coverage problems!
- take advantages of cheaper rates from different phone companies
- saves your previous calls, received calls, time and date settings etc.
- new ultra slim design - sits inbetween your battery and back cover
- no need to replace your phone's back cover - the ghost SIMs sit inbetween your battery and standard back cover
- works with all SIMs (including 3)
- can be used to add another 200 contacts to your phone book via the second sim card (sim dependent)
- works with virtually all makes and models
- also known as dual SIMs/twin SIMs
http://www.formymobile.co.uk/proddetail.php?prod=supersim
Super Ghost SIM
- NEW FEATURE! Switch between SIMs via the phone's menu!
- NEW FEATURE! Option to auto switch between SIMs every 1-99 minutes
- use the manual sim selection option if you don't want to auto switch
- allows you to use two SIM cards in one phone
- no need to cut your SIM card like with similar products
- more convenient than removing your back cover/battery every time you want to swap SIM cards
- combine business/personal lines and address books on one handset
- switch between networks easily - no more coverage problems!
- take advantages of cheaper rates from different phone companies
- saves your previous calls, received calls, time and date settings etc.
- new ultra slim design - sits inbetween your battery and back cover
- no need to replace your phone's back cover - the ghost SIMs sit inbetween your battery and standard back cover
- works with all SIMs (including 3)
- can be used to add another 200 contacts to your phone book via the second sim card (sim dependent)
- works with virtually all makes and models
- also known as dual SIMs/twin SIMs
http://www.formymobile.co.uk/proddetail.php?prod=supersim
Saturday, November 04, 2006
Article on SIM Card Readers
Article on SIM Card readers
http://www.ilexjournal.com/special_features/article.asp?theid=284&themode=2C
http://www.ilexjournal.com/special_features/article.asp?theid=284&themode=2C
Article on SIM Card Readers
Article on SIM Card readers
http://www.ilexjournal.com/special_features/article.asp?theid=284&themode=2C
http://www.ilexjournal.com/special_features/article.asp?theid=284&themode=2C
Deleted SMS text messages
Deleted SMS text messages
GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.
Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:
GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."
Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?
http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf
GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.
Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:
GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."
Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?
http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf
Deleted SMS text messages
Deleted SMS text messages
GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.
Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:
GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."
Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?
http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf
GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.
Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:
GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."
Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?
http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf
Mobile Telephone Evidence
Code and Data go hand in hand
Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.
Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.
Mobile Telephone Evidence
Code and Data go hand in hand
Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.
Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.
Mobile Telephone Evidence
7F10:6F44
For those of you who have attended the TrewMTE GSM Mobile Telephone SIM forensic Card training courses will know the user content elementary file (EF LND) Last Number Dialled. We know from the GSM SIM Standard that this EF is optional, but once allocated and activated in SIM, has a number of mandatory features. The EF stores the number dialled by the user. In the words of the academic authors Redl, Weber & Oliphant "The last number dialed (EFLND) contains a list of the last numbers that were dialed using the SIM." Historically, the numbers found in EFLND have consistently shown to have been stored following selection of numbers from other EFs in the SIM and not numbers dialled on the handset keys or from a handset's phonebook. It has been noted recently that certain SonyEricsson handsets that have dialled numbers are being recorded into this particular elementary file (EFLND). I thought this info was worth passing on - to avoid or reduce confusion during examination.
For those of you who have attended the TrewMTE GSM Mobile Telephone SIM forensic Card training courses will know the user content elementary file (EF LND) Last Number Dialled. We know from the GSM SIM Standard that this EF is optional, but once allocated and activated in SIM, has a number of mandatory features. The EF stores the number dialled by the user. In the words of the academic authors Redl, Weber & Oliphant "The last number dialed (EFLND) contains a list of the last numbers that were dialed using the SIM." Historically, the numbers found in EFLND have consistently shown to have been stored following selection of numbers from other EFs in the SIM and not numbers dialled on the handset keys or from a handset's phonebook. It has been noted recently that certain SonyEricsson handsets that have dialled numbers are being recorded into this particular elementary file (EFLND). I thought this info was worth passing on - to avoid or reduce confusion during examination.
Mobile Telephone Evidence
7F10:6F44
For those of you who have attended my GSM Mobile Telephone SIM forensic Card training courses will know the user content elementary file (EF LND) Last Number Dialled. We know from the GSM SIM Standard that this EF is optional, but once allocated and activated in SIM, has a number of mandatory features. The EF stores the number dialled by the user. In the words of the academic authors Redl, Weber & Oliphant "The last number dialed (EFLND) contains a list of the last numbers that were dialed using the SIM." Historically, the numbers found in EFLND have consistently shown to have been stored following selection of numbers from other EFs in the SIM and not numbers dialled on the handset keys or from a handset's phonebook. It has been noted recently that certain SonyEricsson handsets that have dialled numbers are being recorded into this particular elementary file (EFLND). I thought this info was worth passing on - to avoid or reduce confusion during examination.
For those of you who have attended my GSM Mobile Telephone SIM forensic Card training courses will know the user content elementary file (EF LND) Last Number Dialled. We know from the GSM SIM Standard that this EF is optional, but once allocated and activated in SIM, has a number of mandatory features. The EF stores the number dialled by the user. In the words of the academic authors Redl, Weber & Oliphant "The last number dialed (EFLND) contains a list of the last numbers that were dialed using the SIM." Historically, the numbers found in EFLND have consistently shown to have been stored following selection of numbers from other EFs in the SIM and not numbers dialled on the handset keys or from a handset's phonebook. It has been noted recently that certain SonyEricsson handsets that have dialled numbers are being recorded into this particular elementary file (EFLND). I thought this info was worth passing on - to avoid or reduce confusion during examination.
Subscribe to:
Posts (Atom)