SIM Card Forensics

What it is and why it matters

The SIM is a smart card with its own processor and file system. Its main job is authentication, proving to the network that this subscriber is who they claim to be, using a secret key that never leaves the card. Around that job it stores a small set of files: identifiers, a few contacts, some SMS, the last location area the card registered in and a list of networks it was refused.

Modern phones keep contacts and messages in the handset, so the SIM holds less personal data than it did fifteen years ago. It is still important. The identifiers on the card are what tie a seized handset to a subscriber record at the operator, and the location file can show which network area the phone was last in. For feature phones and older handsets the SIM can still hold the contact list and the messages that matter.

Reading a SIM is quick with the right reader and software, but it is governed by the card's own security. Three wrong PIN entries lock the card and ten wrong PUK entries block it permanently. An examiner who guesses has destroyed evidence.

Types of digital evidence

ICCID
The Integrated Circuit Card Identifier printed on the card and stored in it. It identifies the physical card and is the key to the operator's subscriber record.
IMSI
The International Mobile Subscriber Identity, which identifies the subscription on the network. It includes the mobile country code and mobile network code.
Abbreviated Dialling Numbers
The contact list stored on the card, usually a few hundred entries at most, with the name and number as the user typed them.
Stored SMS
Messages saved to the card rather than the handset, including their status flags. Deleted messages sometimes remain in the record with the status byte changed.
Location Information
The last Location Area Identity or Tracking Area the card registered in, which places the phone within a network area at the time it was last on.
Forbidden Networks
The list of networks the card was refused, which can show roaming history or travel across borders.
Last Numbers Dialled
Some cards keep a short list of recently dialled numbers, though most handsets now keep this in their own storage.
Service Tables and Operator Data
The services the subscription supports, the preferred network list and the operator's own name and settings, which help identify the issuing operator.

Devices and data sources

Standard, micro and nano SIM cards removed from handsets
eSIM profiles stored in the phone's embedded secure element, read through the handset not a card reader
SIM cards found loose at a scene or in packaging with the ICCID printed on the carrier
Dual-SIM handsets, where each slot and card must be recorded separately
Operator subscriber records and call detail records obtained by lawful request
Handset records of the SIM, such as the IMSI and ICCID stored in the phone's own databases
Older feature phones where the SIM is still the main store for contacts and messages

How an examination runs

The order matters. Each step protects the one after it.

01
Authority and Handling
Confirm the legal basis. Photograph the card in the handset and after removal, record the printed ICCID and handle it by the edges to protect the contacts.
02
Clone or Reader Decision
Decide whether to read the card directly through a PC/SC reader with forensic software, or to create a forensic SIM clone so the handset can be examined without connecting to the live network.
03
PIN Status Check
Let the software report whether a PIN is set and how many attempts remain. Never guess a PIN. Obtain the PIN or PUK from the user under authority or from the operator.
04
Read the File System
Read the master file, dedicated files and elementary files that hold identifiers, contacts, SMS and location data. Save the raw output and the decoded report together.
05
Hash and Record
Hash the extraction files and record the reader, software version and the time of reading. The card itself cannot be hashed in the usual way, so the extraction record is the reference.
06
Interpret and Correlate
Decode the location file against the operator's area codes, match the IMSI to subscriber records and compare SIM contents with the handset's own data.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

UICC: Universal Integrated Circuit Card, the smart card platform that hosts the SIM or USIM application. The specifications come from ETSI and 3GPP.
USIM: The Universal Subscriber Identity Module application used on 3G and later networks, defined in 3GPP TS 31.102.
Elementary File: A single data file on the card, such as the file that holds SMS records or the location information. Files are grouped under dedicated files beneath a master file.
Ki: The authentication key shared between the card and the operator. It is never readable from the card, which is why a SIM cannot simply be copied.
PIN and PUK: The user PIN protects access to the card. The PUK unblocks a card after three wrong PINs. Ten wrong PUK entries block the card for good.
Location Area Identity: The combination of mobile country code, network code and location area code that identifies a group of cells. The card stores the last one it registered in.
Forensic SIM Clone: A card programmed with the identifiers of the original so that a handset can be powered and examined without registering on the real network.
eSIM: A subscription profile downloaded into a chip soldered inside the phone. There is no card to remove, so the profile is read through the handset.

Challenges and limits

What makes it hard

A PIN-locked card can only be read with the correct PIN or PUK, and guessing destroys the evidence
Most data that used to sit on the SIM now sits in the handset or in the cloud, so expectations must be set early
eSIM profiles cannot be removed and read in a card reader, which ties SIM evidence to the handset examination
Decoding location and status bytes needs the right specification version, and operators vary in how they use optional fields
Operator records needed to turn an IMSI into a name are held under their own legal process and retention periods

Keeping the evidence intact

Photograph the printed ICCID before reading so the card can be matched to the extraction later
Use a reader and software that do not write to the card, and record the versions used
Record the PIN attempt counter before and after reading
Keep the raw card dump with the decoded report so that another examiner can re-decode it

Standards and legal considerations

NIST SP 800-101 Rev. 1
Covers SIM and UICC examination within mobile device forensics, including the file system, identifiers and handling.
Read the guide
ISO/IEC 27037:2012
The general evidence handling rules that apply to the card from seizure through preservation.
Read the guide
SWGDE Best Practices
SWGDE mobile device documents include the handling of SIM cards alongside the handset.
Read the guide
ETSI TS 102 221 and 3GPP TS 31.102
The specifications that define the UICC physical and logical interface and the USIM file structure. Essential for decoding the raw files, not a forensic standard in themselves.

In practice

Which Subscriber Used This Handset
A handset is recovered with no SIM. Its own databases record the IMSI and ICCID of the last two cards used. The examiner reports those identifiers so the investigating officer can request subscriber details from the operators.
Last Known Network Area
A feature phone is found switched off. The SIM's location file holds the last location area code. Mapped against the operator's area list, it shows the phone last registered in a different district from where it was found.
Contacts on an Old Handset
A basic phone used in a lottery fraud holds its contacts on the SIM. The examiner reads the abbreviated dialling numbers and the stored SMS, finding templates of the fraud messages still saved as drafts.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cardsBeginnerDCMFE

MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsIntermediateDCMFE

MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone casesIntermediateDCMFE

Standards for this area

NIST SP 800-101 Rev. 1NIST SP 800-101 Rev. 1 is the reference most mobile forensic procedures trace back to. It gives the tool classification pyramid, the preservation routine and the acquisition rules that laboratories still follow.Standard

Careers that use it

Mobile Forensic Analyst

Questions people ask

Can a SIM card be copied?

The identifiers and stored files can be read and a forensic clone can be made for examination purposes. The authentication key cannot be read, so a clone cannot register on the real network, which is exactly what the examiner wants.

What happens if I enter the wrong PIN?

After three wrong entries the card locks and asks for the PUK. After ten wrong PUK entries the card is blocked permanently. Forensic software reports the remaining attempts so the examiner never guesses.

Is an eSIM examined the same way?

No. There is no card to remove. The profile lives in a secure chip inside the phone and its identifiers are read as part of the handset examination.

Does the SIM show where the phone has been?

Only roughly. It stores the last location area it registered in, not a trail. Movement history comes from the handset's location data and from operator records.