Content area

Full Text

ABSTRACT

With the rapid evolution of the smartphone industry, mobile device forensics has become essential in cybercrime investigation. Currently, evidence forensically-retrieved from a mobile device is in the form of call logs, contacts, and SMSs; a mobile forensic investigator should also be aware of the vast amount of user data and network information that are stored in the mobile SIM card such as ICCID, IMSI, and ADN. The aim of this study is to test various forensic tools to effectively gather critical evidence stored on the SIM card. In the first set of experiments, we compare the selected forensic tools in terms of retrieving specific data; in the second set, genuine user data from eight different SIM cards is extracted and analyzed. The experimental results on a real-life dataset support the effectiveness of the SIM card forensics approach presented in this paper.

Keywords: SIM card, Digital Forensics, Forensic tools, ICCID, IMSI

1.INTRODUCTION

Regardless of its role in crime (direct or indirect), data within a mobile phone remains crucial. A wealth of information is stored on cell phones that includes, but is not limited to, call history, text messages, email messages, web pages, and photos. Mobile phone forensics, the most challenging digital forensics field, should be enriched with SIM card forensics.

Most of the existing research is focused on searching for the following key evidence in a mobile telephone:

* Calls made, including numbers dialed, dates, and times.

* Calls received, including numbers received, dates, and times.

* Data stored within address book/phone book.

* SMS details.

* Pictures/video clips on the phone or memory card.

The SIM (Subscriber Identity Module) is a smart card that is used in mobile phones to store user data and network information that is required to activate the handset for use. SIM card demand has been growing worldwide on a yearly basis (ABIResearch, 2015) and is expected to break the record of 5.4 billion shipments for the year 2015 alone. Given this widespread usage, a massive amount of information is available for forensic investigators.

Since the introduction of UMTS, better known as 3G technologies, USIM cards are favored. While SIM cards provide network access, the tiny computer within a USIM enables it to handle several mini-applications and video calls if...

Show less