MSAB XRY - SIM Card Extraction

Source: Metelev, Andrey(2020)

All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means whatsoever without express written
permission from the author.
Lecture Topics

Forensic Challenges with SIM cards

SIM Extraction with XRY

SIM Cloning with XRY

Forensic
Challenges
Call Log Deletion
The SIM card allows users to change Phone
phones by removing the SIM card from one Number:
cell phone and inserting it into another 999-867-
mobile device 5309

If the handset detects that the SIM has

Phone
changed (based on IMSI, ICCID or both), it
Number:
could potentially delete the call logs
999-867-
5309
Multiple Associations
One SIM card may end up being identified to
multiple IMEI numbers

Multiple SIMs may end up being identified to one

IMEI number(s)
SIM Card(s?)
Dual SIM - device can be connected to
two networks at the same time (or the
same network twice)

Multi SIM - device can be connected to

only one network at a time, but can
change networks when necessary
SIM Cards in Smartphones

Most smartphones use the SIM

card for the telephony aspect and
rarely store user-generated data

Most smartphones do not require

a SIM card to be present in the
phone for extraction.
PIN Protected
Some SIMs are protected by a PIN.

Do not attempt to guess it.

• Too many attempts can wipe the data.
• May trigger a PUK (Personal Unblocking Key)

Most users don’t know their PUK and if it is

guessed too many times, it will wipe the SIM.
E-SIM
The new standard being pushed by the GSMA
(association that represent network providers
worldwide)

Embedded SIM
• Cannot be removed
• Reprogrammable

Newer phones are coming with them

• May still have a SIM card slot for second SIM
information
Different Sizes
Not all SIM cards are the same size.

Full SIM Micro SIM Nano SIM