Lost Call Registers - what standard?

It is part of the GSM standards to wipe/restrict the call register to a particular SIM. Some handsets do not adhere to this though.

I don't know the specific reference as I thought it was in 11.11 but I can not find it in there (Greg probably could help you if you need the specific doc). If you do need to know the particular wording of the standard give me a shout and I will see if I can find it.

Kind regards

Take a look at GSM 02.17.

5.5 Subscriber data stored in ME.

I believe this may shed some light on the matter.

I agree with Coligulus. I would have identified GSM 02.17 (but also 3GPP 47017) too as KVS379 hasn't stated the make/model of handset and whether he is dealing with SIM/USIM

I would have also suggested to bear in mind GSM0207

B.3.6 Last Numbers Dialled (LND)
The mobile station may store the Last "N" Numbers dialled in the SIM and/or the ME. "N" may take the value up to 10 in the SIM. It may be any value in the ME. The method of presentation of these to the user for setting up a call is the responsibility of the MS but if these numbers are stored in both the SIM and the ME, those from the SIM shall take precedence. The security for handling this is defined in GSM 02.17 [6].

The natural presumption is to think all call history has been wiped. The case below is from a Nokia 2110 manufactured in 1996 (14 years ago). The fact that a SIM Card List is prepared can mean the resurrection of call history where the appropriate SIM Card is inserted.

The methods that a handset manufacturer may follow is to prevent unauthorised disclosure by failing to meet the security requirement, the security requirements in the Standard never stated that call history etc was critical data for permanent deletion.

The problem with cloning a test (U)SIM and the appearance of lost data can be due to numerous matters. KVS379 decription above provides insufficient information.

It may not be appropriate though to attribute loss of call history to the Standards simply because it has a requirement for a security mechanism to exist when handling personal data.

Thank you Coligulus and trewmte for providing the reference. A most interesting read. It's interesting that effectively the security implementation (and most importantly the classification of the security level of some of the data) is left to the handset manufacturer. Hence, you sometimes get handsets (such as Sony Ericssons) that also delete/restrict the SMS messages too. Although, inversely you get Windows mobiles which erm, don't restrict any user accessible data!

There are some modern handsets that implement the ability to restrict data to certain SIM cards and in inputting a previous SIM's details would allow acccess to the previous respective call information on the handset. I have encountered at least one recently but unfortunately my brain fails me in remembering what it was. It could provide a very useful source of evidence for examiners to consider (especially since we often encounter people using multiple SIMs).

Kind regards

It's an interesting point.

I have always wondered why some handset's maintain a list of more than one SIM cards details within their memory. I have noticed this on various handsets, particularly on Nokia's. When you think of it, I know if I used multiple SIMs in the same handset I wouldn't want to be losing data each time I swapped them.

Now I wonder whether this has anything to do with why some SIM cards hold the IMEI specifics of various handset's? I know this happens on some O2 SIM cards but am sure this is not exclusive.

It's also an interesting observation which you make Sam about allowing access to previously restricted data when a SIM is swapped and then the previous SIM is returned back to the handset. I wonder if this would still occur if data was written to the respective memory of the handset using the swapped SIM prior to returning the original SIM?

If you happen to remember the handset where you observed this I would be most interested to learn the make and model?

Hi all,

Many thanks for your informative responses. Unfortunately there is no specific make and model of handset or SIM/USIM that I am referring to. It was rather a general question but can appreciate that perhaps each situation is unique.

Coligulus thanks for identifying GSM 02.17 and to Greg for your detailed response. I will be referring to the aforementioned standards for further reading.

Sam, you mentioned that certain SE handsets delete/restrict SMS Messages. Do you mean that when an unknown SIM is inserted, the handset will restrict/delete SMS Messages? Would you happen to know off the top of your head which model this would pertain to?

Cheers,

Kyle

Kyle, IIRC Sony Ericcsons such as the T68i restrict/delete the call info as well as the SMS messages when a new SIM is inserted. Someone else I am sure will be able to comment more about this – when clones were not so prevalent and ‘test’ SIMs were used to prevent a connection which could change the data on a handset (which in itself changed the data!) I am sure there have been a few shocks along the way! Luckily I found out through playing around with handsets that not only the call info was at risk but also the SMS messages too. I am having recollections of some Siemens (horrible c series) handsets doing this too.

Windows mobiles prior to 5 were also a nice shock they were just a little problematic if their battery drained/was removed for more than a few minutes (ie. You wanted to put another SIM in there) as they would hard reset and the data would go bye bye! Probably why a lot of police forces in the UK came up with the policy of leaving handsets/PDAs on charge when in storage!

With respect to Coligulus' question, if the handset were to implement overwriting of one call info with another then it would be gone if it shared the memory location. The same memory location can only store one ‘section’ of data. The handset would have to effectively compartmentalise call information memory for each SIM for it to be achievable or at least have some method to store this effectively (for example, if a HS were to store the IMSI with each of the call information entries). I would have to sit and research this further (which will be added to a very long list of things I’d like to know more about ) ) I am sure the HEX dump gurus who like looking at the raw data will know more about this…..

Samr
I have just inserted a different SIM Card, but for the same network (Orange), into an SE K600i. The new SIM removed the call history but gave complete access to all SMS text messages in the handset (even draft text messages), photos etc and much of the manufacturer and user profiling of the handset for the original SIM Card.

When the original SIM Card was re-inserted part of the call history (answered and missed) had been removed and those name/numbers relating to the contact originating from the original SIM. However, numbers dialled on the handset were still in the Dialled list but the date/timestamp had been removed. I should point out that those numbers in the handset dialled list were unsaved.

Hi everyone.

Does anyone know for how long do Symbian phones keep their Call Logs ? I checked a mobile that was kept as evidence in a police station, and after being switched off for 8 months, it had all its call logs disappear.

Thank you all in advance