MobileAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsSIM / Memory Card Forensics
ICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cards
- Beginner
- Online or on campus
- 4 hands-on labs
- 6 modules
About this course
Small items are easy to overlook in an evidence bag. A SIM card from a keypad phone, a microSD card from a dashcam, a spare card found in a wallet. These can hold numbers, messages and photos that exist nowhere else. Each needs its own handling.
The SIM part covers what a SIM really stores. The ICCID identifies the card and the IMSI identifies the subscriber on the network. The card can also hold contacts in the ADN file, SMS records, last dialled numbers and location area data. You learn the PIN and PUK limits that can block a card for good if someone guesses carelessly. You also see how eSIMs change the picture. The memory card part covers write protection, imaging, the FAT32 and exFAT file systems, how deletion works on each and how to carve photos and videos from unallocated space.
Most smartphones keep SMS and contacts on the phone itself, so a modern SIM may hold very little. The course is honest about that and shows where the SIM still matters, for example in tying a number to a handset or reading an old keypad phone.
ICCID and IMSISIM SMS and contactsFAT and exFATFile carving
After this course you can
- Read a SIM card with a PC/SC reader and record its ICCID, IMSI and network details
- Explain the difference between ICCID, IMSI, IMEI and MSISDN to a non-technical reader
- Recover SMS and contacts stored on a SIM, including records marked as deleted
- Image an SD or microSD card through a write blocker and verify the hash
- Explain how FAT32 and exFAT record files and what deletion changes
- Carve photos and videos from unallocated space and judge which results are complete
Syllabus
6 modules · 23 topics
01SIM card basics4 topics
- The difference between a SIM or USIM card and an eSIM profile
- The ICCID printed on the card and stored in EF_ICCID
- The IMSI and its parts (MCC, MNC and MSIN), with 404 and 405 as India's country codes
- The MSISDN (the phone number) and why the SIM often does not store it
02Handling a SIM safely3 topics
- PIN tries, the PUK and the risk of a permanently blocked card
- Getting the PUK from the service provider through proper legal channels
- Keeping the phone off the network and using forensic access cards in place of the original SIM
03Data stored on the SIM4 topics
- Contacts in ADN and the FDN and SDN files
- SMS records and their status byte for read, unread, sent and free slots
- Last numbers dialled (LND) on cards that keep them
- TMSI and the last location area in the LOCI file
04Memory cards and file systems4 topics
- SD, SDHC, SDXC and microSD cards and the file system each one usually carries
- FAT32 structure with the boot sector, FAT tables and directory entries
- exFAT structure with the allocation bitmap, directory entry sets and the NoFatChain flag
- What deletion changes, such as the 0xE5 marker on FAT and the in-use bit on exFAT
05Acquisition4 topics
- Why the lock switch on an SD adapter cannot be trusted as a write blocker
- Hardware write blockers and card readers for SD and microSD
- Imaging to E01 or raw format with FTK Imager and recording hashes
- Android adoptable storage, where the card is encrypted to one phone
06Recovery and carving4 topics
- Recovering deleted entries that still point to their data
- Signature carving of JPEG, PNG, MP4 and other file types
- Fragmented files, partial results and how to report them
- Linking carved photos back to a camera or phone through EXIF data
Hands-on labs
- Lab 1
Read a test SIM, record its ICCID and IMSI and decode the MCC and MNC
- Lab 2
Recover SMS records marked as free from a SIM read-out and present them with their status
- Lab 3
Image a microSD card through a write blocker in FTK Imager and verify MD5 and SHA-256 hashes
- Lab 4
Find deleted files on an exFAT card in Autopsy, carve the same card with PhotoRec and compare the results
Tools you will use
- MSAB XRY
- Cellebrite UFED
- pySim
- PC/SC smart card reader
- FTK Imager
- Autopsy
- PhotoRec
- Tableau forensic bridges
Who it suits
- Students starting out in mobile forensics
- Police officers and cyber cell staff who seize phones and cards
- Laboratory assistants who prepare storage media for examination
- Corporate security teams that handle lost or returned devices
Before you join
- Basic computer skills
- No forensics background needed. This is a good first course in the mobile track
Questions about this course
Can I read call history from a SIM card?
Not in the way most people expect. Some SIMs keep a short list of last dialled numbers. A smartphone keeps its call log on the phone. Full call records come from the service provider through legal process.
Do deleted SMS stay on a SIM?
Sometimes. A deleted SMS record is usually marked free and its content can stay until a new message reuses that slot. Many smartphones never save SMS to the SIM at all.
What if the memory card is physically broken?
A cracked or water-damaged card may need chip-level recovery, especially a monolithic microSD card. This course covers working cards and teaches you when to stop and send a card to a specialist.
More courses in Mobile & IoT Forensics
MobileAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
MobileDrone ForensicsRecover DJI flight logs, GPS tracks and home points from drones, controllers and phone apps
MobileIoT Device ForensicsEvidence from smart speakers, cameras, wearables and routers, plus firmware extraction basicsNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.