9   Analyzing SIM Cards

Previous chapters covered procedures, seizure, and collection of physical and digital evidence on a mobile device. The next several chapters discuss the analysis of the data within the device files and folders. In this chapter, you’ll learn about the SIM (subscriber identity module) card, once used only in GSM devices but now found in CDMA devices, and the evidentiary data that may reside within the file system.

SIM cards contain information that can be used by an examiner to locate a device, identify contacts, and see a user’s communications. The examiner will need to concentrate on the card’s file system—not an easy task, especially because SIM cards often store data in unconventional formats in various locations with ...

Get Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.