3g ForensicsWill SIMIS recover deleted short messages?
YES!
SIMIS will enable the examiner to view the all files stored within the sim / usim. SIMIS will extract raw data from the SIM card, including the headers that determine how that data should be interpreted.
Short message services files can be marked as deleted by the mobile user or by mobile applications. In most cases these messages are not overwritten immediately.
- SIMIS will recover all data and display it as the relevant specification denotes.
- SIMIS will also display the data as if it were NOT marked as deleted.
Background
SIM cards are smart cards with highly customised operating systems to meet stringent specifications. Traditionally SIM cards have been limited in memory, typically 32 & 64 are common memory sizes for SIM cards. This limited memory availability forces the developer of the SIM operating system to be very economical with memory.
For the most part, the SIM specifications do not determine what the developer should do with files and data when they are deleted. The developers make their own provision for the deletion of files and re use of the memory utilised by those files.
SMS files are an exception to that rule, the specification makes provision for marking the file as deleted, allowing the mobile to determine where to store future incoming messages, overwriting any residual data only if the file is marked as deleted. Fore reasons of code economy and speed of execution, most developers do not go to the extreme of deleting (overwriting) SMS data when it is marked as deleted. Thus it is possible to extract the data and view it as if it were not marked as deleted.
If carried out correctly this process has no effect on the recovered data, it is simply an alternative way of viewing the data. Other markers in the stored SMS data denote whether the message was stored ready to send, was sent, was received and unread or received and read.
Further information and links to the specifications can be found in the client support forum, freely accessible by users of the SIMTools products.
Site Navigation