# converts a given date from GSM to DEC decString = encodedDate.decode( ’hex ’) decString = struct.unpack from(’>H5B’, decString) This code fragment translates the given date from the GSM Standard to a readable DEC format.
When dealing with Series40 smartphones those information are kept in the blocks 4, 5, 13 and 35 of the dump files. When decoding the HEX values of block 4 one can find the values of ‘serial number’, ‘product code’, ‘product basic code’, ‘module code’ and ‘hardware number’ in the lines 3 to 7. Block 5
Data being deposited in the memory of the smartphone are the international mobile subscriber identity (IMSI) and the serial number (ICCID) of the SIM card. The IMSI is located at the beginning of block 94 filled up with 0x00. In contrast, the ICCID in block 117 can be found at the beginning of the 5th
Although tools to extract such evidence already exist, there is a strong demand to develop more sound forensic procedures and tools in order to analyze data from a previously created dump as well as from the mobile phone itself. This aspect will be a major focus within this diploma thesis. The developed tool should enable the process of