CH15_SIM File System and its Data Acquisition Method

Mobile country code (MCC)

is a 2- to 3-digit identification number printed on the SIM that represents the country code of a SIM user internationally on a GSM network. It can be used with the mobile network code (MNC) to identify a mobile phone operator.

Mobile network code (MNC)

is a two-digit network identification number used along with the MCC printed on a SIM. It is used to identify the SIM user on a mobile phone network.

Master File (MF)

is the root of the file system; it contains one or more DFs. It may contain one or more EFs. A 2-byte file identifier of 3F00 identifies the MF, which is completely reserved for MF.

Text message status (SMSS)

is the status of the message received by the sender. The Short Message Center sends the delivery status to clarify whether the message has been delivered to the concerned recipient.

Wireshark

lets you capture and interactively browse the traffic running on a computer network. This tool uses WinPcap to capture packets on its own supported networks.

IMEI number

can be obtained by keying in *#06#

International Mobile Equipment Identifier (IMEI)

is a 15-digit number that denotes the manufacturer, model type, and country of approval for GSM devices.

Integrated circuit card identifier (ICCID)

is a 19-digit unique identification number printed on the SIM to identify each SIM internationally. It helps investigators in tracing a lost mobile.

Phase ID (Phase)

It is a SIM identification number that is used for identifying each SIM. It is stored in bytes in the SIM; forensic tools are required to extract this information.

SIM service table (SST)

A subscriber provides the service data stored in the SIM; these data are stored in the form of a table, where the associated services include N27- MENU SELECTION and N38-GPRS.

Dedicated File (DF)

DFs or directories are available next to the MF in the hierarchy; they only contain the header that holds information related to the file structure and security. Similar to the MF, a 2-byte identifier is used in DFs to identify them.

Elementary File (EF)

EFs are next to the DF in the hierarchy; they contain both the header and body, which store the actual data in different forms, including the transparent, linear fixed, and cyclic forms.

MOBILedit

This tool can be used to clone the original SIM card(s) of the phone being investigated without knowing the PIN, create new SIM cards with any ICCID, or format the SIM card to renew for next use. It can also be used to connect multiple SIM card readers simultaneously.

HOIC

HOIC is a network stress and DoS/DDoS attack application written in BASIC language.

Mobile subscriber identification number (MSIN)

It is a 10-digit number mobile identification number that helps in identifying the mobile phone service provider within a mobile carrier network.

International mobile subscriber identity (IMSI)

It is a 15-digit subscriber identification number that helps investigators in tracing a lost mobile device. It defines a subscriber in the wireless world, including the country and mobile network to which the subscriber belongs.

Service provider name (SPN)

It signifies a SIM card service provider (for example, Idea, and Airtel). Investigators must pay more attention to the authenticity and verifiability of the service provider records.

Shodan

Search engine for Internet-connected devices.

Type Allocation Code (TAC)

The first eight digits of IMEI Number.

Text message parameters (SMSP)

are messaging protocols that a sender should follow and input data such as the recipient number, message body, and file format.