Gathering Information about the Lastly Inserted SIM

Data being deposited in the memory of the smartphone are the international mobile subscriber identity (IMSI) and the serial number (ICCID) of the SIM card. The IMSI is located at the beginning of block 94 filled up with 0x00. In contrast, the ICCID in block 117 can be found at the beginning of the 5th entry. Here the control character at the end has to be cut when decoding the information.

diploma thesis: abstract

Although tools to extract such evidence already exist, there is a strong demand to develop more sound forensic procedures and tools in order to analyze data from a previously created dump as well as from the mobile phone itself. This aspect will be a major focus within this diploma thesis.

The developed tool should enable the process of loading a memory image which was previously created, with the help of Twister-Box. Those retrieved data, which are (dependent on the producer) available in coded form, will be subsequently converted into plain text to nally draw conclusions about the relevance of the content in the context of forensic analysis. Within all those operations it is tremendously important to not change data stored on the mobile phone or the dump, respectively. The reason for this lie in the fact that only unchanged data fulll the requirements of usability in a court of law. Within this part of the diploma thesis we will also address the issues of producer-specic codications of data and their store areas on mobile phones.

This diploma thesis will also include a chapter discussing the possibilities of securely deleting stored data directly from the mobile phone. Optionally, this thesis constitutes the forensic analysis of the SIM card, due to the fact that on the SIM card important data are stored (e.g. location information, which can play a vital role in resolving a crime). In order to conduct such an analysis successfully the PIN number is needed which implies an active commitment of the suspected person.