SIMCon is one of the best utilities for a forensic analysis of SIM cards. It had a low price and for government organizations, military, and police, it was provided free of charge. Besides its impressive functionality, SIMCon, from some SIM cards, can extract data protected by PIN code. For example, phonebook.
Despite the fact that the SIMCon project was closed several years ago, the program did not disappear. A new updated version of this program is called Sim Card Seizure. The distribution rights of the program belong to the company Paraben. Also, the functionality of SIMCon is implemented in another product from Paraben--E3: Electronic Evidence Examiner.
The SIMCon project does not have its own address on the internet now. However, the installation software can be found via search engines.You can also download a trial version of Sim Card Seizure from Paraben's website. The limitation of the trial version of Sim Card Seizure is that only the first 20 records of phonebook, calls, messages are displayed.
- Double-click on the program icon and connect the card reader with the SIM card. The program will open the
Enter PIN
information window as shown in the following screenshot:
- In this case, there is no need to enter the PIN code. Click on the
OK
button to start the data extraction process. The status of the extraction process will be shown in theReading SIM...
window:
- If the data is successfully extracted, you will be asked to fill in the
Investigator:
,Date / Time:
,Case:
,Evidence Number:
, andNotes:
fields in theAcquisition Notes
window. After filling in the fields, click on theOK
button:
- Unlike TULP2G and MOBILedit Forensic, SIMCon allows you not only to extract data and generate a report but also to view the extracted data. The following screenshot shows a fragment of the SIMCon window in which we can see SMS messages, including deleted ones, which were extracted from the SIM card:
The Acquisition Notes window
At the bottom of the SIMCon main window, there is a section that displays detailed information about the selected record:
A section of the SIMCon main window with the detailed information about the selected record
The SIMCon program allows viewing the contents of each file. The following screenshot shows the contents of the elementary file (EF_ICCID
):
SIMCon extracts data from the SIM card installed in the card reader that is connected to the expert's computer. After this, you can generate a forensic report or analyze the extracted data from the main window of this program.
- The Sim Card Seizure program's website: https://www.paraben-sticks.com/sim-card-seizure.html
- The E3: Electronic Evidence Examiner program's website: https://www.paraben.com/products/e3-universal