Forensics

Recovering deleted SMS from the SIM card

Some time ago I wanted to recover the deleted SMS from a friend's SIM card and I tried to find some programs to do it. After some time searching the web I found SIMCon and SIMEditor which made well the job, showing all the SMS slots, deleted and not, with the help of a SIM reader, of course. I was curious about the raw process of these programs so I search the web again ;)

First of all we'll need some software to send commands to the SIM card. I'm a Linux user so I used scriptor, contained in the pcsc-tools package. We need to know what to send and what the SIM card structure is. For this we have the GSM specification, a brief resume of the commands we must send and we can receive, and some information about the directories within a SIM card. These commands are called Application Protocol Data Units (APDU). After reading this links we know that we have to send the following commands:

  • VERIFY CHV (20): PIN authentication.
  • SELECT (A4): selection of the file we want to work with.
  • GET RESPONSE (C0): read the response data.
  • READ RECORD (B2): read the specified record.

Distribuir contenido