SIM Forensics

One of the challenges I have come across recently is being able to retrieve data from a cell phone SIM, whether it be a large phone-book list and there is not an existing PC interface you can make use of or if you are trying to recover deleted outgoing/incoming messages from the phone.

A SIM or Subscriber Identity Module (SIM) on a removable SIM Card securely stores the service-subscriber key (IMSI) used to identify a subscriber on mobile telephony devices (such as computers) and mobile phones. The SIM card allows users to change phones by simply removing the SIM card from one mobile phone and inserting it into another mobile phone or broadband telephony device.

You will need a SIM card reader, drivers and software to read the SIM card.

You can easily get the SIM card reader on eBay for under $5, and though they usually ship with a software CD, I have not found one that has the right drivers with it. What this has meant for me is prying open the plastic casing and looking at the chip-set manufacturer, subsequently diving into Google to find in the majority of cases a Taiwanese manufacturer hosting the drivers for the reader.

Then comes the software. I recommend Data Doctor Recovery Sim Card from Pro Data Doctor, it has a nice interface and works, which was also a challenge. This will set you back $69.

Once the SIM is in the reader and its connect to the USB port on your computer and working correctly after the drivers have been installed, you can start-up the program and click the magnifying glass icon. You will then be prompted to select the reader type, which in my case is Phoenix technology standard.

You will be asked to define the port, data baud and parity. To determine what port was assigned, I open up the Device Manager on Windows XP and look under modem to find the reader. The baud should remain at 9600 and the parity at even. Once this is done, the software will scan the SIM for data and display it on the screen were it can be viewed or save to a text file.