SIM card acquisition and analysis with MOBILedit Forensics

MOBILedit Forensic is a commercial forensic software by the company Compelson. It is updated regularly. This program can extract data from phones, smartphones, and SIM cards. As the program developers state, MOBILedit Forensic is a program that allows us to extract data from a phone or SIM card with a minimum number of steps. Also, this program has a unique function on which we will focus in another chapter.

Getting ready

On the MOBILedit download page (http://www.mobiledit.com/download-list/mobiledit-forensic), click on DOWNLOAD. When the downloading process is finished, double-click on the downloaded file of the program and install it. After the first run of the program, you need to enter the license key. If the license key is not entered, the program will work in the trial mode for 7 days.

How to do it...

There are two ways of extracting data from SIM cards with MOBILedit Forensic:

1. Extracting data through wizard
2. Extracting data through the main window of the MOBILedit Forensic program

In this book, we will focus on the data extraction from SIM card via the main window of the MOBILedit Forensic program.

When you run the program, the information about the connected card reader will appear in the upper left corner of the main window of the MOBILedit Forensic program.

A fragment of the main window

If you click on Connect, the MOBILedit Forensic Wizard will start, through which you can extract data from mobile devices and SIM cards. Let's now see how to extract the data:

1. Click on the image of the card reader. The information about Answer on Reset(ART) and ICCID of the SIM card will be displayed. If this SIM card is locked, you will be asked to enter the PIN or PUK code.

Fragment of the main window with information about the SIM card

2. After entering the PIN or PUK codes, the SIM card will be unlocked and the Report Wizard option will appear on the main window. The fact that the examined SIM card was unlocked is indicated by the displayed International Code (IMSI), access to which is possible only after entering the correct PIN code.

 A fragment of the main window with information about the SIM card

3. Click on the Report Wizard; it will open the MOBILedit Forensic Wizard window, which will extract data from the SIM card and generate a report.

4. Fill in the fields Device Label, Device Name, Device Evidence Number, Owner Phone Number, Owner Name, and Phone Notes . Then click on the Next button.

Window MOBILedit Forensic Wizard

5. The data will be extracted. The extraction status will be displayed in the MOBILedit Forensic Wizard window.

6. When the extraction is finished, click on the Next button. After that, MOBILedit Forensic Wizard will display the following window:

The MOBILedit Forensic Wizard window

7. Click on New Case. In the opened window, fill in the Label, Number, Name, E-mail, Phone Number, and Notes fields, and then click on the Next button.

The MOBILedit Forensic Wizard window   

8. In the next window of MOBILedit Forensic Wizard, select the format in which the report will be generated and click on the Finish button.

Final window of MOBILedit Forensic Wizard

A forensic report about the extraction will be generated in the selected format.

How it works...

MOBILedit Forensics extracts data from the SIM card installed in the card reader that is connected to the expert's computer and generates the report, taking the minimum number of steps. It is useful if there are a lot of mobile devices or SIM cards that have to be investigated, as it speeds up the process of data extraction.

See also

• The MOBILedit Forensics website at http://www.mobiledit.com.
• The MOBILedit Forensics download page at http://www.mobiledit.com/download-list/mobiledit-forensic.