Difference between pages "SIM Cards" and "Data copy king"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (SIM Forensics)
 
m (make this page clear with more information)
 
Line 1: Line 1:
[[Image:Simpic.jpg|thumb|A typical SIM card.]]
+
Data Copy King is one disk image hardware,DoD data wipe hardware and also used as one professional forensic disk image tool.  
  
== SIM-Subscriber Identity Module ==
+
Data Copy King has build-in IDE and SATA ports and supports USB data copy with adapters, it is one 1:1 hard drive duplicator. The top features of DCK is its claimed disk image speed at 7GB/min and data wipe speed at 8GB/min and its ability to copy bad sectors/unstable drives.
  
The UICC (Universal Integrated Circuit Card) is a smart card which contains account information and memory that is used to enable GSM cellular telephones.  One of the applications running on the smart card is the SIM, or Subscriber Identity Module. In common parlance the term "UICC" is not used an the phrase "SIM" is used to describe the smart card itself.
 
  
Because the SIM is just one of several applications running on the smart card, a given card could, in theory, contain multiple SIMs. This would allow multiple phone numbers or accounts to be accessed by a single UICC. In practice, though, this never happens.
+
[[Image:Hard_drive_duplicator_data_copy_king.jpg|frame|Data Copy King package]]
  
Early versions of the UICC used full-size smart cards (85mm x 54mm).  The card has since been shrunk to the standard size of 25mm x 15mm.
+
== Universal hard drive duplicator ==
  
 +
1, 'Universal' indicates the storage medias from hard drives to flash drives, from good storage medias to storage medias with defects such as a lot of bad sectors, unstable heads or motor after head or platter swap, clicking drives but still detected in the bios or other kind of logical failure with detected status;
  
Although UICC cards traditionally held just 16 to 64KB of memory, the recent trend has been to produce SIM cards with larger storage capacities, ranging from 512MB up to [http://www.m-systems.com/site/en-US/ M-Systems'] 1GB SIM Card slated for release in late 2006.
+
2, 'Universal' suggests a combination of multiple Data Copy related solutions such as drive health checking, data clean or data destruction;
  
== SIM Security ==
+
3, 'Universal' means the wide use among different fields like data recovery field, IT after sale field, Education and training field, Government and miliary field, computer forensics field, Financial department field etc;
  
Information inside the UICC can be protected with a PIN and a PUK.
+
4, One important thing to mention about the 'Universal' here is the green concept used, no backdoor design, physical read only, 0 training required, friendly and nice interface, Energy-saving, cost effective, etc.
 
+
The PIN (Personal Identification Number) is a code that locks access to the SIM. Not all SIMs have PINs; if a SIM has a PIN, the PIN must be entered to unlock the SIM.
+
PUK (Personal Unlocking Code) codes are provided by the network provider to unlock a code.
+
 
+
 
+
 
+
== SIM Forensics ==
+
 
+
The data that a SIM card can provide the forensics examiner can be invaluable to an investigation. Acquiring a SIM card allows a large amount of information that the suspect has dealt with over the phone to be investigated.
+
 
+
In general, some of this data can help an investigator determine:
+
* Phone numbers of calls made/received
+
* Contacts
+
* [[SMS]] details (time/date, recipient, etc.)
+
* SMS text (the message itself)
+
 
+
There are many software solutions that can help the examiner to acquire the information from the SIM card. Several products include 3GForensics SIMIS [http://www.3gforensics.co.uk/products.htm], Inside Out's [http://simcon.no/ SIMCon], or SIM Content Controller, and Paraben Forensics' [http://www.paraben-forensics.com/catalog/product_info.php?products_id=289 SIM Card Seizure].
+
 
+
=== Data Acquisition ===
+
 
+
These software titles can extract such technical data from the SIM card as:
+
 
+
* '''International Mobile Subscriber Identity (IMSI)''': A unique identifying number that identifies the phone/subscription to the [[GSM]] network
+
* '''Mobile Country Code (MCC)''': A three-digit code that represents the SIM card's country of origin
+
* '''Mobile Network Code (MNC)''': A two-digit code that represents the SIM card's home network
+
* '''Mobile Subscriber Identification Number (MSIN)''': A unique ten-digit identifying number that identifies the specific subscriber to the GSM network
+
* '''Mobile Subscriber International ISDN Number (MSISDN)''': A number that identifies the phone number used by the headset
+
* '''Abbreviated Dialing Numbers (ADN)''':Telephone numbers stored in sims memory
+
* '''Last Dialed Numbers (LDN)'''
+
* '''Short Message Service (SMS)''':Text Messages
+
* '''Public Land Mobile Network (PLMN) selector'''
+
* '''Forbidden PLMNs, Location Information (LOCI)'''
+
* '''General Packet Radio Service (GPRS) location'''
+
* '''Integrated Circuit Card Identifier (ICCID)'''
+
* '''Service Provider Name (SPN)'''
+
* '''Phase Identification'''
+
* '''SIM Service Table (SST)'''
+
* '''Language Preference (LP)'''
+
* '''Card Holder Verification (CHV1) and (CHV2)'''
+
* '''Broadcast Control Channels (BCCH)'''
+
* '''Ciphering Key (Kc)'''
+
* '''Ciphering Key Sequence Number'''
+
* '''Emergency Call Code'''
+
* '''Fixed Dialing Numbers (FDN)'''
+
* '''Forbidden PLMNs'''
+
* '''Local Area Identitity (LAI)'''
+
* '''Own Dialing Number'''
+
* '''Temporary Mobile Subscriber Identity (TMSI)'''
+
* '''Routing Area Identifier (RIA) netowrk code'''
+
* '''Service Dialing Numbers (SDNs)'''
+
* '''Service Provider Name'''
+
* '''Depersonalizatoin Keys'''
+
 
+
This information can be used to contact the service provider to obtain even more information than is stored on the SIM card.
+
 
+
== Service Provider Data ==
+
 
+
Some additional information the service provider might store:
+
 
+
* A customer database
+
* [[Call Detail Record]]s (CDR)
+
* [[Home Location Register]] (HLR)
+
 
+
== Sim Card Text Encoding ==
+
 
+
Originally the middle-European [[GSM]] network used only a 7-bit code derived from the basic [[ASCII]] code. However as GSM spread worldwide it was concluded that more characters, such as the major characters of all living languages, should be able to be represented on GSM phones. Thus, there was a movement towards a 16-bit code known as [[UCS-2]] which is now the standard in GSM text encoding. This change in encoding can make it more difficult to accurately obtain data form [[SIM cards]] of the older generation which use the 7-bit encoding. This encoding is used to compress the hexadecimal size of certain elements of the SIMs data, particularly in [[SMS]] and [[Abbreviated Dialing Numbers]].
+
 
+
== References ==
+
 
+
* [http://www.simcon.no/ SIMCon]
+
* [http://www.sectorforensics.co.uk/sim-examination.shtml Sector Forensics]
+
* [http://www.utica.edu/academic/institutes/ecii/ijde/articles.cfm?action=issue&id=5  IJDE Spring 2003 Volume 2, Issue 1 ]: [http://www.utica.edu/academic/institutes/ecii/publications/articles/A0658858-BFF6-C537-7CF86A78D6DE746D.pdf Forensics and the GSM Mobile Telephone System] (PDF)
+

Revision as of 22:52, 6 April 2010

Data Copy King is one disk image hardware,DoD data wipe hardware and also used as one professional forensic disk image tool.

Data Copy King has build-in IDE and SATA ports and supports USB data copy with adapters, it is one 1:1 hard drive duplicator. The top features of DCK is its claimed disk image speed at 7GB/min and data wipe speed at 8GB/min and its ability to copy bad sectors/unstable drives.


Data Copy King package

Universal hard drive duplicator

1, 'Universal' indicates the storage medias from hard drives to flash drives, from good storage medias to storage medias with defects such as a lot of bad sectors, unstable heads or motor after head or platter swap, clicking drives but still detected in the bios or other kind of logical failure with detected status;

2, 'Universal' suggests a combination of multiple Data Copy related solutions such as drive health checking, data clean or data destruction;

3, 'Universal' means the wide use among different fields like data recovery field, IT after sale field, Education and training field, Government and miliary field, computer forensics field, Financial department field etc;

4, One important thing to mention about the 'Universal' here is the green concept used, no backdoor design, physical read only, 0 training required, friendly and nice interface, Energy-saving, cost effective, etc.