Investigating Android Last SIM
22/09/2023 Friday
SIM stands for "Subscriber Identity Module." It is a small, removable card used in mobile phones and other cellular devices to identify and authenticate the user on a mobile network. Each SIM card has a unique ICCID (Integrated Circuit Card Identifier) and IMSI (International Mobile Subscriber Identity).
Digital Forensics Value of Android Last SIM
Collecting information related with the SIM card, such as ICCID and IMSI, can help in identifying the owner of the mobile device and associate it with a particular user. This artifact also reveals information about authenticated user accounts which can be used in retrieving more information about the mobile device owner and tracking his activities.
Location of Android Last SIM Artifacts
Android Last SIM artifacts can be found at the following location:
data/com.google.android.gms/shared_prefs/Checkin.xml
Analyzing Android Last SIM Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Last SIM artifact from Android device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Last SIM artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Last SIM artifact in ArtiFast.
Android Device Last SIM
- ICCID: The Phone Integrated Circuit Card Identification Number.
- IMSI: The Phone International Mobile Subscriber Identity Number.
- Last Check-in Success Date/Time: The last check-in success date/time.
- Android ID: The Android Device ID.
- Last SIM Operator: The last SIM operator.
- Accounts Received by Server: The accounts information which have been registered to the server.
For more information or suggestions please contact: [email protected]
