Digital Evidence · Topic 4 of 8
Cellular Networks and SIM Evidence
Understand cellular network components, GSM, CDMA, LTE and 5G, cell site analysis, CDR contents and SIM identifiers and files for the CHFI v11 exam.
- 5 min
- MS, BTS, BSC, MSC, HLR, VLR, AuC, EIR are the GSM components.
- IMSI identifies the subscriber, IMEI identifies the handset, ICCID identifies the SIM card.
- Cell site analysis gives an area, not an exact location.
What it is
Cellular networks connect phones to base stations and a core network that tracks subscribers. Providers keep records of calls, texts, data sessions and the cells a phone used. The SIM card holds the subscriber identity and some user data.
The exam asks you to name network components, tell generations apart, read what a call detail record shows, and know the SIM identifiers.
How it works
Components of a GSM style network
| Component | Role |
|---|---|
| Mobile station (MS) | The phone plus its SIM |
| Base transceiver station (BTS) | The cell tower radio equipment |
| Base station controller (BSC) | Manages many BTS units and handovers |
| Mobile switching center (MSC) | Switches calls and connects to other networks |
| Home location register (HLR) | Master database of subscribers |
| Visitor location register (VLR) | Temporary record of subscribers in the MSC's area |
| Authentication center (AuC) | Holds keys used to authenticate subscribers |
| Equipment identity register (EIR) | Lists valid, stolen or blocked device IMEIs |
Later generations replace these with new names, but the roles persist: radio access, switching and routing, and subscriber databases.
Different cellular networks
| Generation | Technologies | Notes |
|---|---|---|
| 2G | GSM, CDMA (IS-95) | Digital voice and SMS. GSM uses TDMA and SIM cards. |
| 2.5G | GPRS, EDGE | Packet data added |
| 3G | UMTS (WCDMA), CDMA2000, HSPA | Mobile broadband |
| 4G | LTE | All IP network, voice over IP |
| 5G | 5G NR, 5G core | Higher speed, lower latency, network slicing |
GSM subscribers are tied to a SIM. CDMA phones traditionally were tied to the carrier's registration of the device, although most modern phones use both.
Cell site analysis
Cell site analysis uses provider data to show which towers a phone connected to and when. The records include the cell ID, the sector (the tower's antenna faces, typically three) and time stamps. Combined with tower locations it places the phone in an approximate area, not at an exact point.
Investigators request records through legal process. Analysts then map the towers, check sector directions, and may run a drive test to compare signal coverage with the claimed location. Timing advance data, where available, gives an approximate distance from the tower.
CDR contents
A call detail record (CDR) is a provider's billing and operations record. It typically contains:
- Calling and called numbers
- Date, time and duration
- Call or message type (voice, SMS, data)
- Cell ID of the serving tower, at the start and sometimes the end
- IMSI and IMEI of the subscriber and device
- Call outcome, such as completed or unanswered
A CDR does not contain the content of the call or message. Content requires a separate and stricter legal authority.
The SIM
The Subscriber Identity Module is a smart card with its own processor and memory.
| Identifier | Meaning |
|---|---|
| ICCID | Serial number of the SIM card, printed on it, typically 19 or 20 digits |
| IMSI | Subscriber identity: 3 digit MCC, 2 or 3 digit MNC, then the subscriber number. 15 digits at most. |
| IMEI | Identifies the handset, 15 digits. Not stored in the SIM. |
| Ki | Secret authentication key, never leaves the SIM or the AuC |
| PIN | Protects the SIM. Three wrong tries typically lock it. |
| PUK | Unlocks a blocked PIN. Ten wrong tries typically disable the SIM permanently. |
SIM data lives in a file hierarchy: a master file (MF), dedicated files (DF) and elementary files (EF). Elementary files store the phonebook, SMS, last dialed numbers, location information (such as the last location area and TMSI) and network data.
Acquire a SIM with a SIM reader and forensic software, with the phone isolated, and with the PIN known or obtained legally. Do not guess the PIN more than the allowed attempts.
A worked example
A CDR shows a call at 21:14 using cell 4821 sector 2. The tower is northeast of a store. The suspect says they were home, 8 km south.
The sector faces away from the suspect's claimed location, so the record is inconsistent with the account. The analyst still reports an area of coverage, not a precise spot, and checks other records for support.
How the exam asks about this
- "Which register holds the master subscriber database?" → The HLR.
- "How many wrong PUK attempts make a SIM permanently unusable?" → Ten.
- "Does a CDR contain the audio of a call?" → No. It holds metadata only.
What to remember for the exam
- MS, BTS, BSC, MSC, HLR, VLR, AuC, EIR are the GSM components.
- IMSI identifies the subscriber, IMEI identifies the handset, ICCID identifies the SIM card.
- Cell site analysis gives an area, not an exact location.
- A CDR holds metadata, not content.
- SIM PIN locks after three wrong tries, PUK after ten.
IMEI is a device identifier and is not stored on the SIM. A question that asks which identifier survives a SIM swap points to the IMEI.
Common mistakes
Reading cell data as precise. A tower covers an area, so a cell record supports a region, not a street address.
Confusing IMSI and IMEI. IMSI is the subscriber on the SIM. IMEI is the phone.
Expecting the SIM to hold every message. Capacity is small. Most messages are on the phone or in apps.
Check yourself
What does the VLR store?
Temporary subscriber records for users currently in the area served by one MSC.
Which identifier is printed on the SIM card itself?
The ICCID.
What does a CDR leave out?
The content of calls and messages. It records only metadata such as numbers, times, duration and cell ID.
Topic 4 of 8 in Digital Evidence
Test yourself on Digital Evidence
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.