SIM and USIM filesystem
Antonio Savoldi, Paolo Gubian · 2007
The main purpose of this paper is to describe the real filesystem of SIM and USIM cards, enlightening what the official standard reference does not say. By analyzing the full filesystem of such embedded devices, it is possible to find a lot of undocumented files usable to conceal sensitive and arbitrary information that are unrecoverable with the standard tools normally used in a forensic field. In order to understand how it is possible to use a SIM/USIM for data hiding purposes, the paper will present a tool capable of extracting the entire observable memory of these devices together with the effective filesystem structure. Further, some practical examples regarding the data hiding procedure as a proof of concept will be analyzed and discussed.