Sample Forensics Report
When the objectives of the investigation have been achieved, Disklabs Forensic Services will prepare a full Investigation Report. The report will identify the continuity of information and describe all the procedures utilised during our investigation, with a concise summary of conclusions, observations and all appropriate recommendations. All facts referred to in the report will be added to an appendix to support our analysis or findings - see example below:
Date & Time
Friday, October 01, 2004 at 16:24:10
General Information
| Reference No. | 990001 |
| Operator | Paul Allen |
| Operation Name | Sample Report |
| Case Reference No. | 990001 |
Phone Information
| Phone Make | Sony Ericsson |
| Phone Type | K700i |
| Phone Software Version | |
| Welcome note | Hello sexy |
| IMEI from back of phone | XXXXXXXXXXXXX |
| IMEI from typing *#06# | XXXXXXXXXXXXX |
Notes
Forensic SIM Information
| Card Type | Defense |
| Batch Date | 21/06/04 |
| Serial Number | 0000000256 |
| Card Version | 1 |
| Control Card Id | 3B6600FF4A434F503230FFFFFFFFFFFF |
| Control Card User Id | 0005 |
| Acquisition Hardware Type | Desktop (MCT5000) |
| Acquisition Software Version | 1.0.0.5 |
| Card Write Start Time | 19/08/04 12:05.22 |
| Card Write End Time | 19/08/04 12:05.26 |
| Number of bytes copied | 4915 |
| Hash Type | MD5 |
| Hash Code | 56AB9535889895A409DCAF121BFF07EA |
Subscriber/User Related Files
Mobile Station Numbers (MSISDN)
The Mobile Station ISDN (MSISDN) is the Subscriber Identity Number for that SIM card. This facility is not always held on the SIM card and can be edited by the user. It is possible for a SIM card to hold more than one MSISDN, dependent on the subscriber's account type. It is advisable to obtain a subscriber check against the SIM and MSISDN number to determine its accuracy.
| This SIM can store | 5 | MSISDN(s) |
Nr |
Name |
Telephone Number |
Type of number |
Numbering Plan |
Extension Id |
| 1 | 0786XXXXXXX | None | ISDN/Telephony | None | |
| 2 | Reserved | Reserved | None | ||
| 3 | Reserved | Reserved | None | ||
| 4 | Reserved | Reserved | None | ||
| 5 | Reserved | Reserved | None |
International Mobile Subscriber Identity (IMSI)
IMSI |
| 23433XXXXXX6682 |
Service Provider Name (SPN)
Provider Display Status |
Provider Name |
| Not Displayed | Blank |
Phone Number Related Files
Abbreviated Dialled Numbers
This section represents the list of Names and Telephone Numbers stored on the SIM Card. A SIM Card can store between 90 and 200 Names and Telephone Numbers.
| This SIM has an Abbreviated Dialled Number storage capacity of | 90 |
Nr |
Name |
Telephone Number |
Type of number |
Numbering Plan |
Extension Id |
| 1 | Jason | 4478XXXXX014 | International | ISDN/Telephony | None |
| 2 | Griggs | 0154XXXXX8 | None | ISDN/Telephony | None |
| 3 | Phils Garage | 0128XXXXX2 | None | ISDN/Telephony | None |
| 4 | Phils Garag1 | 0128XXXXX2 | None | ISDN/Telephony | None |
| 5 | Cherly | 4478XXXXX939 | International | ISDN/Telephony | None |
| 6 | Richy Day | 0796XXXXX9 | None | ISDN/Telephony | None |
| 7 | Cheryl Home | 01543XXXXX2 | None | ISDN/Telephony | None |
| 8 | Ryan Rich | 0776XXXXX2 | None | ISDN/Telephony | None |
| 9 | Nicky | 078XXXXX6 | None | ISDN/Telephony | None |
| 10 | Gary Telluri | 0154XXXXX9 | None | ISDN/Telephony | None |
| 11 | Gary Tellur1 | 0793XXXXX5 | None | ISDN/Telephony | None |
| 12 | Steggs Diskl | 44797XXXXX5 | International | ISDN/Telephony | None |
| 13 | Phil Mob | 0771XXXXX0 | None | ISDN/Telephony | None |
| 14 | Lappy | 0797XXXXX8 | None | ISDN/Telephony | None |
| 15 | Ade | 0796XXXXX7 | None | ISDN/Telephony | None |
| 16 | Suzanne | 0773XXXXX2 | None | ISDN/Telephony | None |
| 17 | Gem New | 0798XXXXX6 | None | ISDN/Telephony | None |
| 18 | Kevs Work | 0182XXXXX5 | None | ISDN/Telephony | None |
| 19 | Stevie | 0796XXXXX0 | None | ISDN/Telephony | None |
| 20 | Katie Work | 0789XXXXX7 | None | ISDN/Telephony | None |
| 21 | Maz Work | 0797XXXXX6 | None | ISDN/Telephony | None |
| 22 | Caroline Wor | 0776XXXXX3 | None | ISDN/Telephony | None |
| 23 | Dave Harris | 0182XXXXX9 | None | ISDN/Telephony | None |
| 24 | Matt Work | 07899XXXXX4 | None | ISDN/Telephony | None |
| 25 | Alex Cheese | 01234XXXXX0 | None | ISDN/Telephony | None |
| 26 | Chris Burns | 07800XXXXX9 | None | ISDN/Telephony | None |
| 27 | Katie Work 2 | 07749XXXXX6 | None | ISDN/Telephony | None |
| 28 | Rich Lichfie | 07989XXXXX0 | None | ISDN/Telephony | None |
| 29 | Mark Work | 0789XXXXX3 | None | ISDN/Telephony | None |
| 30 | Katie Work N | 07834XXXXX5 | None | ISDN/Telephony | None |
| 31 | Milly | XXXXX | None | ISDN/Telephony | None |
| 32 | Newcastle St | 01782XXXXX3 | None | ISDN/Telephony | None |
| 33 | Minty | 07834XXXXX0 | None | ISDN/Telephony | None |
| 34 | York | 07779XXXXX8 | None | ISDN/Telephony | None |
| 35 | Miggy | 07968XXXXX9 | None | ISDN/Telephony | None |
| 36 | Alex Cheese | 07733XXXXX0 | None | ISDN/Telephony | None |
| 37 | Joe | 07989XXXXX0 | None | ISDN/Telephony | None |
| 38 | Matty Wash | 07890XXXXX5 | None | ISDN/Telephony | None |
| 39 | Emma | 07966XXXXX6 | None | ISDN/Telephony | None |
| 40 | Reserved | Reserved | None | ||
| 41 | Reserved | Reserved | None | ||
| 42 | Reserved | Reserved | None | ||
| 43 | Reserved | Reserved | None | ||
| 44 | Reserved | Reserved | None | ||
| 45 | Reserved | Reserved | None | ||
| 46 | Reserved | Reserved | None | ||
| 47 | Reserved | Reserved | None | ||
| 48 | Reserved | Reserved | None | ||
| 49 | Reserved | Reserved | None | ||
| 50 | Reserved | Reserved | None | ||
| 51 | Reserved | Reserved | None | ||
| 52 | Reserved | Reserved | None | ||
| 53 | Reserved | Reserved | None | ||
| 54 | Reserved | Reserved | None | ||
| 55 | Reserved | Reserved | None | ||
| 56 | Reserved | Reserved | None | ||
| 57 | Reserved | Reserved | None | ||
| 58 | Reserved | Reserved | None | ||
| 59 | Reserved | Reserved | None | ||
| 60 | Reserved | Reserved | None | ||
| 61 | Reserved | Reserved | None | ||
| 62 | Reserved | Reserved | None | ||
| 63 | Reserved | Reserved | None | ||
| 64 | Reserved | Reserved | None | ||
| 65 | Reserved | Reserved | None | ||
| 66 | Reserved | Reserved | None | ||
| 67 | Reserved | Reserved | None | ||
| 68 | Reserved | Reserved | None | ||
| 69 | Reserved | Reserved | None | ||
| 70 | Reserved | Reserved | None | ||
| 71 | Reserved | Reserved | None | ||
| 72 | Reserved | Reserved | None | ||
| 73 | Reserved | Reserved | None | ||
| 74 | Reserved | Reserved | None | ||
| 75 | Reserved | Reserved | None | ||
| 76 | Reserved | Reserved | None | ||
| 77 | Reserved | Reserved | None | ||
| 78 | Phil | 0780XXXXX5 | None | ISDN/Telephony | None |
| 79 | Reserved | Reserved | None | ||
| 80 | Reserved | Reserved | None | ||
| 81 | Dave Harris | 07890XXXXX7 | None | ISDN/Telephony | None |
| 82 | Reserved | Reserved | None | ||
| 83 | Reserved | Reserved | None | ||
| 84 | Reserved | Reserved | None | ||
| 85 | Reserved | Reserved | None | ||
| 86 | Reserved | Reserved | None | ||
| 87 | Reserved | Reserved | None | ||
| 88 | Reserved | Reserved | None | ||
| 89 | Reserved | Reserved | None | ||
| 90 | Reserved | Reserved | None |
Fixed Dialled Numbers
This section contains the list of Fixed Numbers stored on the SIM Card. These numbers can be enabled by the user to limit which numbers may be dialled.
| This SIM has a Fixed Dialled Number storage capacity of | 10 |
Nr |
Name |
Telephone Number |
Type of number |
Numbering Plan |
Extension Id |
| 1 | Reserved | Reserved | None | ||
| 2 | Reserved | Reserved | None | ||
| 3 | Reserved | Reserved | None | ||
| 4 | Reserved | Reserved | None | ||
| 5 | Reserved | Reserved | None | ||
| 6 | Reserved | Reserved | None | ||
| 7 | Reserved | Reserved | None | ||
| 8 | Reserved | Reserved | None | ||
| 9 | Reserved | Reserved | None | ||
| 10 | Reserved | Reserved | None |
Service Dialling Numbers
File not present.
Barred Dialling Numbers
File not present.
Last Number Dialled
Dialled numbers generally represent the users intended actions in making an outgoing call. However it does not necessarily mean that a dialled call was successful or that a conversation took place.
| This SIM can store | 5 | numbers |
Nr |
Name |
Telephone Number |
Type of number |
Numbering Plan |
Extension Id |
| 1 | 0774XXXXX1 | None | ISDN/Telephony | None | |
| 2 | 0773XXXXX0 | None | ISDN/Telephony | None | |
| 3 | 44796XXXXX6 | International | ISDN/Telephony | None | |
| 4 | 44796XXXXX6 | International | ISDN/Telephony | None | |
| 5 | 44796XXXXX6 | International | ISDN/Telephony | None |
Extension 1
This section represents further ADN information that would not fit into the ADN File.
Record |
Record Type |
Extension Data |
Next Record containing Extension Data |
| 1 | No further extension data | ||
| 2 | No further extension data | ||
| 3 | No further extension data | ||
| 4 | No further extension data | ||
| 5 | No further extension data |
Extension 2
This section represents further FDN information that would not fit into the FDN File.
Record |
Record Type |
Extension Data |
Next Record containing Extension Data |
| 1 | No further extension data | ||
| 2 | No further extension data |
Extension 3
This section represents further SDN information that would not fit into the SDN File.
File not present.
Extension 4
This section represents further BDN information that would not fit into the BDN File.
File not present.
Group Identifier Level 1
Nr |
SIM Group Identifier |
| 1 | 00 |
| 2 | 00 |
Group Identifier Level 2
Nr |
SIM Group Identifier |
| 1 | FF |
| 2 | FF |
Short Message Service (SMS) Related Files
Short Message Usage
Short Message Services (SMS) is a form of textual conversation permitted by a network provider. The service allows a user to send and receive textual messages direct to their handsets. The storage capacity is dependant on the SIM card. The date and time of the SMS Message is derived from the network service provider and not the date and time settings on the handset. The originating address refers to the sender's telephone number. The SIM card can store deleted SMS messages still held on the SIM card, the number stored is dependant on the memory allocation and usage. Deleted SMS messages are usually not available to the user. The more modern handsets now allow users to store/archive SMS within the handsets internal memory. The capacity is dependant on the total memory used/allowed.
SIM Card SMS Memory Usage
| This SIM has an SMS storage capacity of | 10 |
Status |
Count |
| Not used, no further data found | 2 |
| Not used, but some deleted data found | 1 |
| Read | 3 |
| Not read | 3 |
| Message waiting to be sent | 0 |
| Message has been sent | 1 |
| Status not recognized | 0 |
SMS Message
| Status | Read |
| Originating Address | +44797XXXXX0 |
| Service Centre Address | +44797XXXXX3 |
| Service Centre Timestamp | 18-08-04 20:04:26 |
| Data Coding Scheme | Default alphabet |
| User Data | How did u win 50? We r fine. Dad stabbed himself & has had 2 stitches in his hand! |
SMS Message
| Status | Read |
| Originating Address | +44796XXXXX6 |
| Service Centre Address | +4479XXXXX3 |
| Service Centre Timestamp | 18-08-04 12:44:41 |
| Data Coding Scheme | Default alphabet |
| User Data | Dunno. We could just go to the pub. Should have photos and such like printed by then. |
SMS Message
| Status | Read |
| Originating Address | +44773XXXXX10 |
| Service Centre Address | +447802XXXXX2 |
| Service Centre Timestamp | 17-08-04 20:01:41 |
| Data Coding Scheme | Default alphabet |
| User Data | Suits me dude. |
SMS Message
| Status | Read |
| Originating Address | +44773XXXXX0 |
| Service Centre Address | +44780XXXXX2 |
| Service Centre Timestamp | 17-08-04 19:32:58 |
| Data Coding Scheme | Default alphabet |
| User Data | Probably yeah. Not heard off emma then? |
SMS Message
| Status | Read |
| Originating Address | +447966XXXXX6 |
| Service Centre Address | +44797XXXXX3 |
| Service Centre Timestamp | 17-08-04 14:16:58 |
| Data Coding Scheme | Default alphabet |
| User Data | Am at airport in cuxhaven. Really don't want to be here. I want to be back on the ship. Am doing it next year! Already decided! Time has flown! Hugs |
SMS Message
| Status | Read |
| Originating Address | +44796XXXXX9 |
| Service Centre Address | +44797XXXXX3 |
| Service Centre Timestamp | 16-08-04 18:45:12 |
| Data Coding Scheme | Default alphabet |
| User Data | No problems |
SMS Message
| Status | Read |
| Originating Address | +44776XXXXX4 |
| Service Centre Address | +44778XXXXX5 |
| Service Centre Timestamp | 16-08-04 15:48:26 |
| Data Coding Scheme | Default alphabet |
| User Data | I'm sooo lucky, belgium this week, ipswich next week and back to belgium the week after argh! |
SMS Message
| Status | Read |
| Originating Address | +44797XXXXX5 |
| Service Centre Address | +44793XXXXX3 |
| Service Centre Timestamp | 19-08-04 11:31:23 |
| Data Coding Scheme | Default alphabet |
| User Data | I cant believe she did that to you. Do you really think they were twins? |
SMS Message
| Status | Not used, no further data found |
SMS Message
| Status | Not used, no further data found |
Short Message Service Parameters
| This SIM can store | 1 | set(s) of SMS Parameters |
Nr |
Alpha Identifier |
Destination Address |
Service Centre Address |
Data Coding Scheme |
| 1 | +447973XXXXX3 | Default alphabet |
Short Message Status Reports
File not present.
Short Message Status
Message Reference Parameter of Last SMS |
"Memory capacity exceeded" Notification Flag |
| 236 | Flag unset; memory capacity available |
Network Related Files
Location Information (LOCI)
| Temporary Mobile Subscriber Identity (TMSI) | 9E16AA62 |
| Location Area Information (LAI) | United Kingdom: Orange, LAC: 0553 |
| TMSI Time | Not used |
| Location Update Status | Updated |
GPRS Location Information (LOCIGPRS)
File not present.
Ciphering Key (Kc)
| Ciphering Key Kc | EE44EC7AF0C02400 |
| Key Sequence Number | 2 |
GPRS Ciphering Key (KcGPRS)
File not present.
Allowed Networks (PLMNsel)
The Allowed Network List shows the networks allowed by the SIM card.
| Number of allowed networks | 8 |
Nr |
Network |
| 1 | Spain: Telefonica Spain |
| 2 | France: France Telecom |
| 3 | Netherlands: Dutchtone |
| 4 | Belgium: Mobistar |
| 5 | Portugal: Optimus Telecom |
| 6 | Denmark: Mobilix |
| 7 | Switzerland: Orange |
| 8 | Thailand: TA Orange C |
Forbidden Network List (FPLMN)
The Forbidden Network List shows the networks forbidden by the SIM card.
| Number of forbidden networks | 4 |
Nr |
Network |
| 1 | United Kingdom: O2 |
| 2 | United Kingdom: Vodafone |
| 3 | United Kingdom: T-Mobile |
| 4 | Not used |
Home PLMN Search Period (HPLMN)
HPLMN |
| 30 minutes |
Cell Broadcast Message ID Selection (CBMI)
Nr |
CB Message ID |
| 1 | Unused |
| 2 | Unused |
| 3 | Unused |
| 4 | Unused |
| 5 | Unused |
| 6 | Unused |
| 7 | Unused |
| 8 | Unused |
Cell Broadcast Message Identifier for Data Download (CBMID)
File not present.
Cell Broadcast Message Identifier Range Selection (CBMIR)
File not present.
Co-operative Network List (CNL)
File not present.
Network's Indication of Alerting (NIA)
File not present.
Broadcast Control Channels (BCCH)
| BCCH Information | 9B6AA0D35D9C4C23CC6F84229A000000 |
Access Control Class (ACC)
Access Control Class |
Allocation Status |
| 1 | Not allocated |
| 2 | Not allocated |
| 3 | Not allocated |
| 4 | Not allocated |
| 5 | Not allocated |
| 6 | Not allocated |
| 7 | Not allocated |
| 8 | Not allocated |
| 9 | Not allocated |
| 10 | Not allocated |
| 11 | Allocated |
| 12 | Not allocated |
| 13 | Not allocated |
| 14 | Not allocated |
| 15 | Not allocated |
| 16 | Not allocated |
Voice Group Call Service (VGCS)
File not present.
Voice Group Call Service Status (VGCSS)
File not present.
Voice Broadcast Service (VBS)
File not present.
Voice Broadcast Service Status (VBSS)
File not present.
General SIM Information
ICCID
ICCID |
| 894XXXXXXXXX7866822 |
SIM Service Table (SST)
| PIN1 Deactivation | Service allocated, activated |
| Abbreviated Dialed Numbers | Service allocated, activated |
| Fixed Dialed Numbers | Service allocated, activated |
| Short Messages | Service allocated, activated |
| Advice of Charge | Service not allocated, not activated |
| Capability Config Params | Service allocated, activated |
| PLMN Selector | Service allocated, activated |
| MSISDN | Service allocated, activated |
| Extension 1 | Service allocated, activated |
| Extension 2 | Service allocated, activated |
| SMS Parameters | Service allocated, activated |
Administrative Data (AD)
| MS Operation Mode | Normal operation |
| Additional Information | None |
Phase
Phase |
| 2+ |
Language Preference (LP)
Priority |
Language Code |
| 1 | GSM 03.41 Language Code 1 |
| 2 | Not used |
Extended Language Preference (ELP)
File not present.
Emergency Call Codes (ECC)
File not present.
Accumulated Call Meter (ACM)
File not present.
ACM Maximum Value (ACMmax)
File not present.
enhanced Multi Level Pre-emption and Priority (eMLPP)
File not present.
Automatic Answer for eMLPP Service (AAeM)
File not present.
Price per Unit and Currency Table (PUCT)
File not present.
