When dealing with Series40 smartphones those information are kept in the blocks 4, 5, 13 and 35 of the dump files. When decoding the HEX values of block 4 one can find the values of ‘serial number’, ‘product code’, ‘product basic code’, ‘module code’ and ‘hardware number’ in the lines 3 to 7. Block 5 contains the ‘IMEI’ of the device and in block 13 the ‘startup message’ which has been inserted by the user and is displayed when the device is switched on, can be found. The ‘security code’ of the smartphones (set to 12345 by the phone manufacturer) can be decoded from its HEX value in block 35 of the Twister Box dump files.
mobile phone forensics and mobile malware