Showing posts with label examination. Show all posts
Showing posts with label examination. Show all posts

Wednesday, October 29, 2014

Apple's New Nano-SIM Card

Should make examinations interesting. Apparently, an open-ended SIM that can be either postpaid or prepaid account without the need to change SIMs but still switch between carriers. Either Apple intend to go for their own IMSI (thus become an operator) or the IMSI will need to be updated OTA...hmmmm

"If you are among the millions who will purchase one of the 4G versions of the new iPad Air 2 or iPad mini 3 tablets from Apple in the next few months, and you live in the US or UK, then when you switch the tablet on for the first time, you will find a nano-SIM card already installed in the SIM card slot."


..............

"What Apple envisions with its SIM is that users will be able to quickly and easily switch between different carriers to take advantage of the best short-term deals available at any given time - without having to go through the hassle of getting a new SIM card.

"Obviously, if you have signed up to a two-year contract you won't be switching deals that often, but if you are on a pay-as-you-go deal, then this could be a real money-saver......."


Quotes from:
http://www.ibtimes.co.uk/apple-sim-how-does-it-work-end-sim-cards-1471065

Saturday, September 14, 2013

(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later).  This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber. 

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference. 

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
 -  A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.


 Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process. 

 
  Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp?  Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.      













































PIN Enabled SIM Card

PIN Enabled SIM Card

A recent question raised the notion what data would be revealed if the SIM Card was read but had a PIN enabled. Using a free SIM Card reader the results are below. Do remember, using different readers their output can reveal different results dependent upon how the programmer wrote the software. The results are from an old Phase 2 GSM SIM Card.





Additional tests with the PIN Locked SIM Card conducted with different SIM Readers
















Friday, April 25, 2008

Looking back at the future of SIM in 2002

Looking back at the future of SIM in 2002
.
I have always thought looking to the future is important, but equally looking back at what we know or think might be happening, from an historical perspective, can help see what problems can occur in the future and also to note whether foreseeable problems have been addressed or not, over time.
.
I have selected a summary of issues discussed in training back in 2002, which are set out in the downloadable .pdf document "SIM - The Future as Viewed in 2002".
.
.
For example, did you know or remember the slow down in SIM Card manufacturing in 2001? This is hard to believe when we think about the saturation levels of SIMs and handsets in the marketplace today.
.
What about SIM Application Toolkits, applets and the exciting development of Java Standard Edition for mobile phones (KJava and PJava)? Our concerns then were how these advancements were going to impact on mobile telephone and SIM examination. Remember at that time we saw problems and tried to anticipate how to combat problems, but we had no immediate solutions which invariable had to be produced in some instance "on-the-hoof", so to speak.
.
Cloning of SIM Cards had raised its head back in 1998 and devices were starting to appear on the market in 2000/01. The problems we faced then was knowing what to look for to deternmine whether a SIM was cloned or not? And then if the SIM was a clone what impact on evidence could/would it have?
.
What about SIM Cards with multiple IMSIs? Still an issue today as it was then in 2002. The problem being is that SIM readers do not have the capability to read more than one IMSI from a SIM Card at any one time. Consequently, invocation of an IMSI selection in EF-7F20 6F07 is not possible other than the SIM being placed in the handset and another IMSI being selected using the handset menu Network selection. Moreover, once that has been done the green button on the handset needs to be pushed and a location update (and an IMSI-attach) to the network is required, which cannot be performed in a faraday bag, radio dampening field or isolation chamber. The question arises when do you search for more than one IMSI recorded into a SIM? What cases warrant it? How many cases have been missed in the past where more than one IMSI resided in SIM but has gone undetected? Put simply, when should allocution take place?
.
There were a huge range of issues to be addressed then in early 2000, as there are now. When reading these brief discussion documents representing issues spoken about on my training courses, I hope they convey the message that plug and play (PnP) or universal plug and play (UPnP) systems used to extract and harvest data are simply not enough to satisfy the requirements for mobile telephone examination.

Saturday, November 04, 2006

Deleted SMS text messages

Deleted SMS text messages

GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.

Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:

GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."

Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?


http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf

Mobile Telephone Evidence

MCC AND MNC CODES

As examination of SIM Cards and Handsets is on the increase internationally, thus roaming is relevant, the list below identifies Mobile Country Codes (e.g. 234) and Mobile Network Codes (e.g. 44) for global Mobile Operators. Please note the data are subject to change.

20201 Cosmote Greece
20205 Vodafone Greece
20209 Q-Telecom Greece
20210 Telestet Greece
20404 Vodafone Netherlands
20408 KPN Netherlands
20412 O2 Netherlands
20416 T-Mobile Netherlands
20420 Orange Netherlands
20601 Proximus Belgium
20610 Mobistar Belgium
20620 Base Belgium
20801 Orange France
20810 SFR France
20820 Bouygtel Telecom France
21303 S.T.A. MobilAnd Andorra
21401 Vodafone Spain
21402 Movistar Spain
21403 Amena Spain
21404 Xfera Spain
21407 Telefonica Movistar Spain
21601 Pannon GSM Hungary
21630 Westel 900 GSM Mobile Hungary
21670 Vodafone Hungary
21803 Eronet Bosnia Herzegovina
21805 Mobi's Bosnia Herzegovina
21890 GSM BIH Bosnia Herzegovina
21901 Croatian Telecoms Cronet Croatia
21910 VIP Croatia
22001 MOBTEL Yugoslavia
22002 ProMonte GSM Yugoslavia
22003 03 Yugoslavia
22004 Monet Yugoslavia
22201 Telecom Italia Mobile TIM Italy
22210 Vodafone Italy
22288 Wind Telecomunicazioni Italy
22298 BLU Italy
22299 3 Italy
22601 MobiFon CONNEX GSM Romania
22603 Cosmorom Romania
22610 Mobil Rom DIALOG Romania
22801 Swisscom NATEL Switzerland
22802 Sunrise Switzerland
22803 Orange Switzerland
23001 T-mobile Czech Republic
23002 EuroTel Praha Czech Republic
23003 Oskar Czech Republic
23101 Orange GSM Slovak Republic
23102 EuroTel GSM Slovak Republic
23201 MobilKom Austria A1 Austria
23203 T-Mobile Austria
23205 Connect Austria One Austria
23207 Tele.ring Austria
23210 3AT Austria
23400001 Virgin United Kingdom
23410 02 United Kingdom
23415 Vodafone United Kingdom
23420 3 United Kingdom
23430 Virgin United Kigndom (others)
23430 T-Mobile United Kingdom
23433 Orange United Kingdom
23450 Jersey Telecom GSM United Kingdom
23455 Guernsey Telecoms GSM UK
23458 Manx Telecom Pronto GSM UK
23800001 Debitel Denmark
23801 Tele-Danmark Mobil Denmark
23802 Sonofon Denmark
23820 Telia Denmark Denmark
23830 Orange Denmark
24001 Telia Mobitel Sweden
24002 3 Sweden
24003 Orange Sweden
24007 Comviq GSM Sweden

24008 Vodafone Sweden
24201 Telenor Mobil Norway
24202 NetCom GSM Norway
24403 Telia Finland Finland
24405 Radiolinja Finland
24407 AT&T U.S.A.
24409 Finnet Group Finland
24412 2G Finland
24414 AMT Finland
24491 Sonera Corporation Finland
24601 Omnitel Lithuania
24602 UAB Bite GSM Lithuania
24603 Tele 2 Lithuania
24701 Latvian Mobile Tel. Latvia
24702 Tele 2 Latvia
24801 Estonian Mobile Telephone Estonia
24802 RadioLinja Eesti Estonia
24803 Tele 2 Estonia
25001 MTS Moscow Russia
25002 Megafon Russia
25005 Siberian Cellular Russia
25007 Zao Smarts Russia
25010 Don Telecom Russia
25012 New Telephone Company Russia
25013 Kuban GSM Russia
25039 Uratel Russia
25044 North Caucasian GSM Russia
25099 BeeLine Russia
25501 Ukrainian Mobile Comms Ukraine
25502 Ukrainian Radio Systems Ukraine
25503 Kyivstar GSM Ukraine
25505 Golden Telecom Ukraine
25701 Velcom
25702 MTS
25901 Voxtel Moldova
25902 Moldcell Moldova
26001 Polkomtel PLUS GSM Poland
26002 ERA GSM Poland
26003 IDEA Centertel Poland
26201 T-Mobile Germany
26202 Vodafone Germany
26203 E-Plus Mobilfunk Germany
26207 O2 Germany
26213 MobilCom Germany
26214 Quam Germany
26601 Gibraltar Telecoms Gibtel Gibraltar
26801 Vodafone Portugal
26803 Optimus Telecom. Portugal
26806 Telecom Moveis Nac. TMN Portugal
27001 P+T LUXGSM Luxembourg
27077 Millicom Tango GSM Luxembourg
27201 Vodafone Ireland
27202 O2 Ireland
27203 Meteor Ireland
27401 Iceland Telecom Siminn Iceland
27402 TAL hf Iceland
27403 Islandss Iceland
27404 Viking Iceland
27601 Albanian Mobile Comms Albania
27602 Vodafone Albania
27801 Vodafone Malta
27821 Go Mobile Malta
28001 Cyprus Telecoms Authority Cyprus
28201 Geocell Limited Georgia
28202 Magti GSM Georgia
28203 Geo 03 Georgia
28301 ArmenTel Armenia
28401 MobilTel AD Bulgaria
28405 Globul Bulgaria
28601 Turkcell Turkey
28602 TELSIM Turkey
28603 Aria Turkey
28604 Aycell Turkey

28801 FT-GSM
28802 KALL
29001 Tele Greenland Greenland
29340 Si.mobil Slovenia
29341 Si-GSM Slovenia
29370 Si VEGA 070 Slovenia
29401 MobiMak Macedonia
29402 MTS AD Macedonia
29501 Telecom
29502 Montel
29505 FL1
29577 Tango
30200001 Fido Canada
30237 Microcell Connexions Inc Canada
30272 Rogers AT&T Canada
31001 Pacific Mobile Comms Pap New Guinea
31002 APC Sprint Spectrum U.S.A.
31011 Wireless 2000 Telephone U.S.A.
31015 BellSouth Mobility DCS U.S.A.
31017 Cingular (Pacific Bell Wireless) U.S.A.
31020 T-Mobile U.S.A.
31026 Western Wireless Voicestream U.S.A.
31027 Powertel U.S.A.
31031 Aerial Communications U.S.A.
31038 AT&T U.S.A.
31077 Iowa Wireless Services U.S.A.
33805 Digicel JM
34001 Orange French West Indies
34020 BouygTel French West Indies
36801 C-Com CU
37412 TSTT
40001 Acell Telekom B.M. Azerbaijan
40002 BKcell GSM 2000 Azerbaijan
40101 K-Mobile Kazaksthan
40102 KCELL Kazaksthan
40217 B-Mobile BT
40401 Aircel Digilink Essar Cellph. India
40402 Bharti Cellular Telecom Airtel India
40403 Bharti Cellular Telecom Airtel India
40405 Hutch India
40407 TATA Cellular India
40408 Ushafon India
40410 Bharti Cellular Telecom Airtel India
40411 Hutch India
40412 Escotel Mobile Comms India
40413 Hutch India
40414 Ina Spice India
40415 Aircel Digilink Essar Cellph. India
40419 Escotel India
40420 Orange India
40421 BPL USWest Cellular India
40422 Idea India
40423 Usha Martin Tel. Command India
40424 Idea India
40426 Usha Martin Tel. Command India
40427 BPL USWest Cellular India
40430 Usha Martin Tel. Command India
40431 Bharti Cellular Telecom Airtel India
40432 Ushafone India
40434 BPL USWest Cellular India
40438 BPL USWest Cellular India
40440 INA AIRTel India
40441 RPG MAA India
40442 Srinivas Cellcom India
40443 BPL USWest Cellular India
40444 Spice India
40445 Bharti Cellular Telecom Airtel India
40446 BPL USWest Cellular India
40449 Bharti Cellular Telecom Airtel India
40451,53,54,55 BSNL Mobile India
40456 Escotel India
40457,58,59 BSNL Mobile India
40460 Aircel Digilink Essar Cellph. India

40462,64,66 BSNL Mobile India
40468 Dolphin India
40469 Dolphin India
40470 Oasis India
40471,72,73,74,75,76,77 BSNL Mobile India
40478 IDEA India
40479,80,81 BSNL Mobile India
40486 Hutch India
40490,92,93,94,95,96,97,98 Bharti Cellular
Telecom Airtel India
41001 Ufone Pakistan
41201 AWCC AF
41302 MTN Networks Dialog GSM Sri Lanka
41303 CellTel Sri Lanka
41401 MPTGSM
41501 FTML Cellis Lebanon
41503 LibanCell Lebanon
41601 J.M.T.S Fastlink Jordan
41677 MobCom Jordan
41701 SyriaTel Syria
41702 94 Syria
41709 MOBILE Syrian Telecom Est. Syria
41793 SyriaTel Syria
41801 Iraq Telecom Iraq
41902 Mobile Telecoms MTCNet Kuwait
41903 Wataniya Kuwait
42001 Ministry of PTT Al Jawal Saudi Arabia
42007 Electronics App' Est. EAE Saudi Arabia
42202 General Telecoms Oman
42401 UAE ETISALAT-G1 United Arab Emirates
42402 UAE ETISALAT-G2 United Arab Emirates
42501 Orange Israel
42502 Cellcom Israel
42505 JAWWAL Israel
42601 Batelco Bahrain
42701 QATARNET Qatar
42899 MobiCom MN
43211 TCI Iran
43214 Kish Iran
43400 Uzmacom Uzbekistan
43401 Buztel Uzbekistan
43402 Uzmacom Uzbekistan
43404 Daewoo Unitel Uzbekistan
43405 Coscom Uzbekistan
43407 UZD Uzbekistan
43603 MLT TJK
43605 TajikTel
43701 Bitel Kyrgyz Republic
44010 DoCoMo Japan
45201 Mobifone Vietnam
45202 Vinaphone Vietnam
45400 Hong Kong Telecom CSL Hong Kong
45404 Hutchison Telecom Hong Kong
45406 SmarTone Mobile Comms Hong Kong
45410 New World PCS Hong Kong
45412 Peoples Telephone Hong Kong
45416 Mandarin Com. Sunday Hong Kong
45418 Pacific Link Hong Kong
45422 P Plus Comm Hong Kong
45501 C.T.M. TELEMOVEL+ Macau
45601 Mobitel Cambodia
45602 SM Cambodia
45618 Camshin Cambodia
45701 Lao Shinawatra Telecom Lao
45702 ETLMNW Lao
45703 LatMil Lao
45708 Tango Lao
46000 China Telecom GSM China
46001 China Unicom GSM China
46002 Liaoning PPTA China
46601 Far EasTone Telecoms Taiwan
46606 TUNTEX Telecom Taiwan
46688 KG Telecom Taiwan

46692 Chunghwa Telecom Taiwan
46693 Mobitai Communications Taiwan
46697 Pacific Cellular TWNGSM Taiwan
46699 TransAsia Telecoms Taiwan
46701 Sun KP PRK
47001 Grameen Phone Bangladesh
47002 Aktel Bangladesh
47003 Sheba Telecom Bangladesh
47201 DHI Mobile MV
50202 Binariang Malaysia
50212 Maxis Malaysia
50213 Telekom Cellular TM Touch Malaysia
50216 DiGi Telecommunications Malaysia
50217 TimeCel Wireless Adam Malaysia
50219 Celcom Malaysia
50501 Telstra Mobile Comms Australia
50502 Optus Australia
50503 Vodafone Australia
50503 3 Australia
50508 OneTel Australia
51001 PT. SATelindo C Indonesia
51008 Lippo Telkomsel Indonesia
51010 TelKomSel Indonesia
51011 Pro XL Indonesia
51021 IM3 Indonesia
51501 Isla Comms Philippines
51502 Globe Telecom Philippines
51503 Smart Communications Philippines
51505 DigiTel Philippines
52001 Advanced Info Service AIS Thailand
52010 Orange Thailand
52018 DTotal Access Worldphone Thailand
52023 GSM 1800 Thailand
52099 Orange Thailand
52501 Sing. Tel. GSM 900 Singapore
52502 Sing. Tel. GSM 1800 Singapore
52503 MobileOne Asia Singapore
52504 M1-3GSM Singapore
52505 StarHub Singapore
52811 DST Communications Brunei Darussalam
53001 Vodafone New Zealand
53901 O-Call ton
54101 Smile VUT
54201 Vodafone Fiji Fiji
54601 Mobilis New Caledonia
54720 Vini French Polynesia
55001 FSM Telecom FSM
60201 MobiNil Egypt
60202 Vodafone Egypt
60301 Algerian Mobile Network Algeria
60302 Djezzy Algeria
60400 Meditel Marocco
60401 Itissalat Al-Maghrib IAM Marocco
60502 Tunisie Telecom Tunicell Tunisia
60503 Tunisiana Tunisia
60701 GamCel GMB
60702 AfriCELL GMB
60801 Sonatel ALIZE Senegal
60802 Sentel Senegal
60901 Mattel MR
61001 Matitel ML
61002 Ikatel ML
61201 Comstar Cellular Network Cote d'Ivoire
61203 Orange Cote d'Ivoire
61205 Telecel Cote d'Ivoire
61302 CelTel BF
61402 CelTel NE
61501 Togo Telecom TOGO CELL Togo
61602 TLCL-Ben BJ
61603 Benincell BJ
61604 BBcom BJ
61701 Cellplus Mobile Comms Mauritius
61710 Emtel Mauritius

61801 Lonestar Liberia
62001 ScanCom Ghana
62002 OneToch Ghana
62003 Mobitel Ghana
62120 Econet NG
62130 MTN NG
62140 Nitel NG
62201 CelTel TC
62202 Libertis TD
62401 MTN Cameroon
62402 Orange Cameroon
62501 Cabo Verde Movel Cape Verde
62601 CSTMovel STP
62701 GNQ01 GNQ
62801 Libertis GA
62802 GAB TeleCel
62803 CelTel GA
62901 CelTel CD
62910 Libertis CD
63002 CelTel RC
63004 CellCo GSM RC
63089 OASIS
63102 Unitel AGO
63301 Seychelles Cellular Services Seychelles
63310 AIRTEL Seychelles
63401 Mobile Telephone Company Sudan
63510 Rwandacell Rwanda
63601 Ethiopian Telecoms Auth. Ethiopia
63701 Barakaat SOM
63782 Telsom SOM
63902 Safaricom KE
63903 KenCell KE
64001 Tritel Tanzania
64002 Mobitel Tanzania
64003 Zantel Tanzania
64005 CelTel Tanzania
64101 Celtel Cellular Uganda
64110 MTN Uganda Uganda
64111 UTL Telecel Uganda
64201 Spacetel BI
64202 Busafa BI
64301 mCel MOZ
64501 Celtel Zambia
64601 Madacom Madagascar
64602 SMM Antaris Madagascar
64603 Sacel Madagascar
64700 Orange
64702 OMT
64710 Societe Reunionnaise SRR Reunion
64801 NET*ONE Zimbabwe
64803 Telecel Zimbabwe
64804 Econet Zimbabwe
64901 MTC Namibia
65001 Telekom Network Callpoint Malawi
65010 CelTel Malawi
65101 VCL Comms Lesotho
65102 Ezi Cel Lesothp
65201 Mascom Wireless Botswana
65202 Vista Botswana
65310 Swazi MTN SZ
65501 Vodacom South Africa
65507 Cell C South Africa
65510 MTN South Africa
71201 ICE CRI
72235 Port Hable ARG
72402,03,04 TIM Brazil
72431 Oi Brazil
732101 Comcel Columbia
73401 Infonet Venezuela
73402 Digitel Venezuela
74601 ICMS SR
74602 TeleG SR

Mobile Telephone Evidence

Code and Data go hand in hand

Examiners are familiar with the fact that from time to time found appended to SMS text messages there appears unintelligible code that cannot be read in context with the user's message itself. Such code as @@@ or /./@@ and so on may raise the notion that the SIM reader has not decoded the message correctly. On the contrary, the SIM reader is most likely to have done its job. The assignment of code being added to the data is so that the mobile telephone knows what to do with a message next time it reads it. The cause behind this is fairly straightforward. Phase 2+ handsets (GSM Release 98 onwards) adopted UCS2 (Universal Character Set 2) that allowed highlights to be added to or with data. For instance, italics or colours and so on. Most GSM SIMs' are programmed with GSM Default Alphabet and not UCS2. To corroborate finding code with data, following a SIM read, may require viewing the message through the handset.

Mobile Telephone Evidence

7F10:6F44

For those of you who have attended the TrewMTE GSM Mobile Telephone SIM forensic Card training courses will know the user content elementary file (EF LND) Last Number Dialled. We know from the GSM SIM Standard that this EF is optional, but once allocated and activated in SIM, has a number of mandatory features. The EF stores the number dialled by the user. In the words of the academic authors Redl, Weber & Oliphant "The last number dialed (EFLND) contains a list of the last numbers that were dialed using the SIM." Historically, the numbers found in EFLND have consistently shown to have been stored following selection of numbers from other EFs in the SIM and not numbers dialled on the handset keys or from a handset's phonebook. It has been noted recently that certain SonyEricsson handsets that have dialled numbers are being recorded into this particular elementary file (EFLND). I thought this info was worth passing on - to avoid or reduce confusion during examination.