MS to network with IMSI and ICCID
It is theoretically possible to send ICCID to network, whether networks call for the serial number maybe operator/switch specific. The GSM Standards do not call for the transmission, mandatory or otherwise, of ICCID.
I asked back in 1998 whether transmission of ICCID was possible most UK operator said they did not do it. Mind you in those days masked ROM was used for SIM, but as new SIMs/USIMs use flash and the way in which the new sillicon has been adapted OTA (over the air) updates are possible and there is more flexibility to fetch ICCID for transmission. Indeed with OTA capability it is possible, if an opeartor implements the technology, to update an IMSI OTA saving the customer the need to get a new USIM and re-recording Phonebook etc.
trew, my mistake I meant actually just IMSI this is what happens when the industry that one is in is teaching you one thing and your own research is actually telling you something else
trew, my mistake I meant actually just IMSI this is what happens when the industry that one is in is teaching you one thing and your own research is actually telling you something else
bigjon, I knew you are aware of how the process worked, but I didn't want to edit your post, I wasn't sure when you had time in your busy schedule to get back and make corrections, so I added my comments to help those forum members who are new to mobile forensics and evidence.
Thanks for updating.
Playing devil's advocate, the PIN (password) issue raised by mc02 is another good observation. Here again though, in the UK we do have work arounds
- PIN/PUK
- SIM/USIM level security access
- handset engineer release codes
- manufacturer access codes
- work-arounds using handset PIN rigs
- removing flash memory chips
- etc===========
Handset engineer release codes, manufacturer access codes, work-a-rounds using handset PIN rigs …. All these are great! Is there a website/forums/whitepapers with these type of information i can look at?
Wonderful discussion.
Mc02
Using isolation containment is all well and good as long as the time between seizure and analysis does not exceed battery life. If the device is kept on a charger, no worries. But, this is impractical for an evidence vault that might have a few hundred active exhibits on any given day.
I have to note that each and every mobile exhibit I have analyzed has needed a battery charge. I'm wondering if, as mentioned in someone's earlier post, the best method is, indeed, to snap a picture of or manually record the screen data and remove power and the battery at time of seizure. Then, when analysis time comes, use PIN/PUK, other tools, etc. to unlock, if possible.
I can see using isolation containers for those cases in which time from seizure to analysis is short or where devices can be continuously powered/charged. Otherwise, I don't see the point in faraday bagging. (Of course, one would use containment or "airplane" mode during analysis.)
Thanks for all the interesting information and perspective. I enjoy and learn so much from this discourse.
Playing devil's advocate, the PIN (password) issue raised by mc02 is another good observation. Here again though, in the UK we do have work arounds
- PIN/PUK
- SIM/USIM level security access
- handset engineer release codes
- manufacturer access codes
- work-arounds using handset PIN rigs
- removing flash memory chips
- etc===========
Handset engineer release codes, manufacturer access codes, work-a-rounds using handset PIN rigs …. All these are great! Is there a website/forums/whitepapers with these type of information i can look at?
Wonderful discussion.
Mc02
Handset engineer codes - direct from manufacturer/service repair agents
Manufacturer access codes - direct from handset manufacturer
Handset PIN Rigs - from the hacking forums Nokiafree, IPMart, XDA-developers etc
I get the impression from this thread that we are well on our way to creating a procedure for one aspect of seizure procedure.
Using isolation containment is all well and good as long as the time between seizure and analysis does not exceed battery life. If the device is kept on a charger, no worries. But, this is impractical for an evidence vault that might have a few hundred active exhibits on any given day.
csericks,
if mobile seized and the need to keep the power on then OK, I can see some officers working ports airports etc would need the power kept on as PUK may be impossible from other countries (although notes of exactly where you seized it need to be sorted as you will lose your LAC ironically even if your bag doesn't work correctly you will still lose this particular LAC as you will update all the way back to the lab)
NO this is not the issue-
There are some who are receiving the handset into the lab switched off and when they get around to examination (say two days later) then the handsets are being switched on in the cage to record the time date??
bigjon wrote
NO this is not the issue-
There are some who are receiving the handset into the lab switched off and when they get around to examination (say two days later) then the handsets are being switched on in the cage to record the time date??
Thanks for your comment. Please, forgive me. I'm a little confused. Would you be so kind as to re-phrase/re-state?
(BTW, I would be shocked to receive a device within two days of seizure, here. ) )
CSERICKS,
people have stated that they would put the handset into a Faraday so they could keep the handset on but not allow it to contact the networks, and I thought that was where you were coming from (ie you dont think that its such a bad idea) my point was that we have some examiners that are receiving the handset,switched off (in this state there is potentially a lot of valuable-AUTOMATED-data ) then they would switch on the handset,within the Faraday,just to record the time and data stamp.
Ifg the SIM was done first all the automated data is collected (at the risk sometimes of losing the time date??)
of course every case has its own quirks but secureing location based automated real evidence should,except in certain bespoke cases,always be the consideration over the time which can be altered either maliciously or by some owner with a penchant for just "playing" with his/her phone (i have lost count of the amount of videos I have seen on handsets that are just the living rooms of individuals pointing at the TV or one of their pals watching TV, and its this, almost compulsion with some people that has them constantly messing with the handset)