SIM card identifiers are pretty cut and dry.
These have been the same since the beginning of time.
We have our ICCID, which is the integrated circuit card
identification.
Think of this as the serial number for that SIM card.
Now, one thing that's confusing is,
you will hear the term SIM thrown around a lot.
You will have e-SIM, digital SIM,
you'll have physical SIMs that actually go into the device.
You could have a CDMA phone like I have,
which is Verizon network, that has a digital SIM.
It may have two SIMs depending on the technology.
I can roam all around the world using my CDMA device because
of the digital SIM capability on my 13 Pro iPhone.
All of these devices want to be the one that is used
and support you worldwide.
Some phones are restricted to specific areas or networks,
but most people want the availability to roam.
We travel.
We do things.
And these devices will help you identify where in the world
someone was when something occurred.
In these labs, I roamed worldwide.
Lee roamed everywhere.
You will see a lot of the location in the labs
are based upon locations where we taught SANS events.
The SIM card information will help
you put a person at a location.
We start with the ICCID.
And we could search an entire handset extraction
to see what type of SIM cards were ever
placed in that device.
Think of this like, if you plug a USB into a computer,
you know that those logs, that handshake, takes place.
We want to essentially find that handshake.
When a SIM card that can only be used in France
is placed in my iPhone, that's a huge indication
that user was in France when an artifact was
created on that device.
The IMSI, as previously explained in the last slide,
is the international mobile subscriber identity.
This is how the network says, this is Heather Mahalik.
She is using the Verizon network.
She is paid up on her bill, or my prepaid minutes
are good on my T-Mobile one I use on my test devices.
That is how you are identified.
If you attempt-- if my test phone,
if I bring it out right now and I try to make a call,
my T-Mobile is going to tell me I'm out of minutes.
You will then see these artifacts
of me upgrading my minutes, getting access, getting
these text messages back and forth
before I can successfully connect to that network.
Now, we have two partitions, if you will, on these SIM cards.
We have a system partition and a data partition.
The data can be locked by the user with a puck.
You have a puck and a PIN.
The user sets a PIN.
If you guess that PIN incorrectly three times,
you puck that device.
So you want to make sure you're very careful with that.
All SIM cards will have contacts, call logs, and SMS.
Now, I say "all" very cautiously,
because you will have--
Apple devices are not going to store user created data
to the SIM, e-SIM, or digital SIM.
Android devices will.
So make sure you are very aware that you are acquiring SIM card
information.
Most of us leverage the system partition.
We want to know that serial number, the ICCID.
We want to know the IMSI, the subscriber information.
Because certain subscribers only work
in certain places of the world.
That's helpful to us.
The phone number from the previous slide, MSISDN.
You will find that on the SIM card for GSM in the system.
And then that network service provider will be listed again.
Key location artifacts can be recovered from SIM cards.
Do not overlook this information.
SIM card and SD cards, which is coming up,
they are the most forgotten pieces or components
of smartphones that store massive amounts of information
that can be relevant to your investigation.
What if your one thing that's missing from your report
is, what is the phone number on this device?
And I'm testifying against you, and I say,
I know what it is because I acquired the SIM card.
If you can't answer that simple question,
is someone going to believe all of the advanced location
artifacts and applications that you passed when you
can't answer that simple thing?
Do not forget to acquire your SIM cards.