Hi all,
A handset was submitted for examination. (An Asian make with dual SIM capabilities)
Following standard procedures a clone SIM was created and reinserted into the correct/original SIM slot. The handset was then powered on and all applicable SMS' which pertained to the specified search criteria were transcribed. (Make was unsupported by forensic software and manual attempt to retrieve SMS via AT commands etc failed).
In brief the following was extracted/transcribed;
Handset
8 SMS from Inbox
2 SMS from Outbox
SIM (using USIM Detective standard read and APDU read) (.XRY)
6 SMS received
When the report was submitted to the client along with the handset, the client claimed that we had missed messages from the Inbox of the handset. One message in particular ( a concatenated one) was only HALF transcribed - according to the client.
Subsequently the handset was resubmitted and I did all of the above again only to find the 8 messages in the Inbox (including the concatenated one) and the 2 messages in the Outbox in the handset again. Puzzled by the clients claim of missing messages I turned the handset ON with the original SIM inserted (Faraday cage) and +/- 60 messages are sitting in the Inbox!
Does anyone know why this would be or of any GSM standards that this might relate to…
Cheers
Using the Cloned SIM Card - you basically can only clone the non-encrypted SIM information such as the IMSI, etc. The SMS you found on your 1st attempt were SMS mesgs stored on the handset only.
Using the original SIM - the SMS mesgs you now found were those messages stored on the actual SIM Card itelf.
Just a thought.
only 1 sim in the phone?
Hi
Only 1 SIM card was present - located in SIM slot 2
Thanks for your answer but I had already read the SIM card with both .XRY and USIM detective and only 6 SMS were located on the SIM
As .XRY does not clone the user data such as SMS messages it might be worth trying a RTL Aceso Cloned SIM card and seeing if the messages are present?
Can you say which handset you are working with? I would be surprised if it is not using the MTK Chipset which is prevalent in this style of handset.
Hi Doug,
To be honest I don't find .XRY's SIM read the best and that is why I use USIM Detective which I find to be far more comprehensive. With regards to the make of the handset it is a Finland Makes and does indeed use the MTK chipset.
As previously mentioned I cannot connect to the handset manually and therefore cannot verify the handsets different storage areas for SMS (via +CPMS=?)
.XRY offers support for generic MTK chipsets.
Have you tried running it as a generic MTK device?
My comment about the cloned SIM relates to experience of the RTL Aceso cloned SIM cards occasionally working better on some handsets that can be fussy when it comes to cloned SIM cards. It could be worth cloning the original SIM card on Aceso and turning the handset on with that Aceso SIM card in place. You might find that the messages appear. Worth a try if you have the equipment available.
.XRY offers support for generic MTK chipsets.
Have you tried running it as a generic MTK device?My comment about the cloned SIM relates to experience of the RTL Aceso cloned SIM cards occasionally working better on some handsets that can be fussy when it comes to cloned SIM cards. It could be worth cloning the original SIM card on Aceso and turning the handset on with that Aceso SIM card in place. You might find that the messages appear. Worth a try if you have the equipment available.
I agree with you on this Doug and the use of an RTL access card.
Sometimes handsets fall down when the indexing of the SMS messages is missing.
What I mean by this is if for example your Inbox messages are indexed 1-8 and the SIM card messages are 9-15 and then the additional messages carry on from 16 upwards. If 9-15 are missing as the SIM is not present the handset then falls down and omits the remaining messages.
The beauty of an RTL card in this situation is that it copies the SMS messages to the access card and as such any indexing issues are avoided.