Current Version: 2.0.0.13
SIMIS is capable of forensically extracting data from a SIM card and providing that data in an easy to read HTML report.
SIMIS 2 is targeted for forensic interrogation of Phase 2 GSM SIM Cards, now commonly referred to as 2G. If you wish to extract data from 3G/USIM cards, please see SIMIS 3G
SIM Card Forensic Overview
Information taken from the SIM Card, coupled with information collected from the associated mobile equipment, can provide valuable evidence to validate a line of enquiry, prove an association or provide vital intelligence. In today’s fast moving high-tech society, it is rare to find any activity that does not involve some aspect relating to mobile telephony. If GSM telephony is involved, a trail of information is waiting to be retrieved from the SIM Card.
What is SIMIS?
SIMIS is able to extract a range of information from the SIM
SIMIS automates the process of forensic SIM data recovery. By interrogating the SIM card, SIMIS provides a detailed report in easily viewable HTML format and user-definable printed format for every SIM interrogated.
Unicode support for SMS & phonebook files with alphanumeric elements allows foreign characters and scripts from any international language to be decoded and displayed.
Forensically Safe
In accordance with ACPO guidelines SIMIS ensures that no data on the SIM is modified during the read process. The resulting reports are digitally signed with both MD5 and SHA hashes to ensure integrity. A full audit trail data is included in the analysis detailing important aspects from the acquisition process such as:
- Operator identity
- Start / End time and date stamp for each process carried out during the SIM interrogation
- MD5 and SHA checksum of acquired data
The Pedigree of SIMIS
SIMIS (SIM card Interrogation System) was originally commissioned by Metropolitan Police (London) in 1998. The system facilitates the recovery of information from SIM cards and plugs, used in mobile subscriber equipment (mobile telephones).
SIMIS is a development of Crownhill's popular EdSIM SIM card editor application, that has proved to be popular with both Network Operators and major resellers. SIMIS draws on the expertise gained by Crownhill in the development of it's GSM SIM cards and SIMIS is continually evolving and improving under guidance from many of the UK, US and European Police Technical support units.
Feature Overview
- Forensically safe - no facility for the modification of system or user data held on the SIM card.
- Correctly handles PIN and PUK entry under controlled conditions.
- Builds a database with unique file references for each SIM Card.
- Searchable database with appropriate index categories.
- Facility to read data from the SIMIS Mobile card interrogation unit.
- Presents data in a printable format for reports.
- Provides commented RAW data in a standard format for use in third party applications.
The Search Engine
The SIMIS database search engine, allows comprehensive searches to be made across all SIM cards data that have been interrogated. Searches can be carried out across the entire database, or can be narrowed down to things like a specific case reference, or a specific mobile number.
A typical search would allow you to enter a mobile phone number and identify if that number was held in the ADN of any card previously interrogated - potentially opening up new lines of enquiry in investigations, or linking suspected criminals and networks together.
What you get
The SIMIS package is flexible, with a range of options available to suit your needs. Typically a SIMIS package consists of:
- PC based software application
- PC/SC Smart Card Reader (USB or Serial)
- Mini-Sim Adapter
- USB License Key
There is also the option to use a PC Card (PCMCIA) Reader for laptops and notebooks.
ETSI Conformity
SIMIS adheres to the technical specifications laid down in the ETSI document GSM11.11 and other related ETSI documents. The present document defines the interface between the Subscriber Identity Module (SIM) and the Mobile Equipment (ME) for use during the network operation phase of GSM as well as those aspects of the internal organization of the SIM which are related to the network operation phase.
In the creation of our SIM Interrogation System, we utilised the information from GSM11.11 and related documents to identify:
- Security features
- Interface functions
- Commands
- Contents of the files used in GSM applications
- The application protocol
We used this knowledge to identify what data may be present in the SIM card, how raw data should be retrieved from the SIM, and how to correctly interpret and display the raw data.