Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Mobile Forensics > Day 2: SIM Cards + Handsets > Flashcards

Day 2: SIM Cards + Handsets Flashcards

1
Q
  1. What is A SIM Card?
A

A small computer found inside a phone with its own storage which provides access to a provider’s network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q
  1. What information can a SIM card store?
A

Contacts, SMS messages and call logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the difference between SIM and USIM.

A
  • SIM released in 1991. USIM released in 1998.
  • USIM has larger storage.
  • USIm contact entries typically have more detail (allow for multiple numbers/emails).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Can we physically extract data from a SIM card?

A

No - We can only logically read it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Can we create an image of a SIM

A

No. We can only image SD cards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name the form factors of an insertable SIM card

A
  • SIM (1FF)
  • mini-SIM (2FF)
  • micro-SIM (3FF)
  • nano-SIM (4FF)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Identify the components of the SIM file system.

A
  • Master File (MF): The root of the files.
  • Dedicated File (DF): Equivalent of a SIM directory.
  • Elementary File (EF): Equivalent of a SIM file.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is an embedded SIM (eSIM)?

A

A SIM card is a physical chip that is soldered onto the PCB of the mobile device. It cannot be inserted or removed like a standard card. It is set up and configured through the phone itself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Name the two identifiers that a SIM card uses.

A

Integrated Circuit Card Identifier (ICCID)

International Mobile Subscriber Identity (IMSI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  1. What does the ICCID do?
  2. How long is an ICCID identifier?
  3. Can an ICCID always be retrieved during a logical read?
  4. Can an ICCID be edited?
  5. Name the components of the following ICCID identifer:

89 44 11 006479304397 1

A
  1. It is a globally unique ID for identifying the SIM card itself.
  2. 19 or 20 digits.
  3. Yes!
  4. No! Therefore it is considered reliable when extracted off a device.
  5. 89 44 11 006479304397 1

89 = Standard telecommunications code.

44 = Country of origin code.

11 = Network provider identifier.

006479304397 = Individual Account Identification Number

1 = Check digit (Validated by Luhn algorithm).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  1. What does an International Mobile Subscriber Identity Do?
  2. How long is an IMSI?
  3. Is an IMSI always accessible?
  4. Can an IMSI be edited?
  5. Describe the components of the following IMSI identifier:

234 10 3943614733

A
  1. The IMSI uniquely identifies every user of a network.
  2. 15 digits.
  3. No! It’s PIN protected! You need a valid PIN to get in or a PUK from the network provider to reset the PIN!
  4. No! It is considered reliable!
  5. 234 = Mobile country code (MCC)
    10 = Mobile Network Code (MNC)
    3943614733 = Mobile Station Identification Number (MSIN)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Can you recover a deleted contact from a SIM?

A

No!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can you recover a deleted SMS message from a SIM

A

Yes! They are not erased!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What happens when a message goes over the character limit for SMS messages on a SIM card?

A

Any text over the character limit is sent as an additional SMS/SMSs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the difference between SIM and USIM call logs?

A

SIM has no date, time or duration data available.

USIM tracks made, missed and received calls with date, time and duration data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  1. What is the Mobile Station International Subscriber Identifier (MSISID) for?
  2. How long is the MSISID?
  3. Is the MSISID reliable?
  4. Where can we validate the MSISID? What information do we need to do this?
A
  1. It uniquely identifies each device within a network provider’s GSM network. It links the user, their device and the network together.
  2. 11 digits.
  3. No! It can be changed!
  4. We can verify the MSISID against the network provider. We will need to provide them with the ICCID and IMSI to do this.
17
Q

How long is a SIM PIN code?

A

4-8 digits.

18
Q

How many attempts do you get to correctly enter a SIM PIN?

A

3 guesses.

19
Q

What is the purpose of the Personal Unblocking Key (PUK) and who has access to it?

A

To reset a SIM PIN password in the event it is forgotten and the user is locked out. Network providers will hold this.

20
Q

How long is a PUK key?

A

8 digits exactly.

21
Q

How many attempts is a user permitted for PUK key entry?

A
  1. The card is disabled when this limit is exceeded.
22
Q

Why would we clone a SIM?

A

A device we want to perform an examination on requires a SIM to operate. However a fully functioning SIM means we can’t have network isolation. Instead, we satisfy both by providing a non-functional SIM which does not send or receive data, but which tricks the phone into believing it is the same SIM by using the same ICCID and IMSI. Use of the same values is important as we don’t want to lose the call logs!

23
Q

What does an International Mobile Equipment Identifier (IMEI) do?

A

It uniquely identifies the mobile handset.

24
Q

The number of IMEI’s on a device corresponds to:

A

The number of SIM cards installable on the device.

25
Q

How many digits is an IMEI?

A

15

26
Q

Break down the following IMEI code into its components?

35230001 578604 7

A

3523001 = Type Allocation Code (TAC). This includes make, model and country of origin.

578604 = Serial Number (SNR)

7 = Check digit (Luhn Algorithm)

27
Q

Is an IMEI reliable?

A

No! It can be reprogrammed. Double check with the network provider if in any doubt!

28
Q

What are the interfaces for a logical extraction of a handset?

A
  • Cable.
  • Bluetooth.
  • WiFi.
  • Infrared.
29
Q
  1. Does the interface for a logical read affect the speed of the transfer?
  2. Does the interface for a logical read affect the amount of data recovered?
A
  1. Yes. Cable is typically fastest.
  2. Yes. Some may extract more or less than each other!
30
Q

What is the chipset within the device?

A

It’s the PVB board, processor and mounted chip components (I.e WiFi, storage, GPS, sensors) that allow the phone to function.

31
Q

How can we use a chipset profile to help us logically read data from a device?

A

Some tools use generic chipset read profiles which can sometimes retrieve data when all other avenues have failed.

32
Q

What considerations need to be made when attempting to extract data from modern smartphones?

A
  • Security is advanced (PINs, Biometrics, Passwords). We may not always have direct access in.
  • The amount of data stored on a phone these days is huge. There might be a lot to extract + long waits if the device has storage of around 500Gb - 1TB.
  • Smartphone connectivity is significant. Network isolation should be achieved to avoid violating ACPO principle 1 (remote wipe or interception). We should be competent enough to do this and log when we isolate to satisfy ACPO 2 and 3.
  • Encryption is common in new devices which renders physical reads impossible if no decryption key can be found.
33
Q

Order these in order of most data retrieved from extraction (Least to most):

Physical
Logical,
Full File System,

A

Logical
Full File System
Physical.

34
Q

How can an IMEI be recovered (3 answers)

A
  • Dial *#06# on a device
  • Via logical extraction.
  • Check the app settings.

Mobile Forensics (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions