SIMbrush: an open source tool for GSM and UMTS forensics analysis

The aim of this paper is to describe a new open source tool, usable on Windows and Linux platform, for digital evidence extraction from SIMs and USIMs card. Nowadays, closed-source or confidential tools are used for this purpose and this is contrary to Daubert´s test, because, it is not possible to gain the high degree of acceptability from scientific community required by the test itself. This tool is being proposed, therefore, as a platform for the exchange of ideas, to constitute, free from the logic of copyright, a wide agreement. Security features of SIMs hamper in many ways the possibility to dump a bit for bit internal memory image. As a consequence, this tool interfaces itself to SIM cards in the standard way. Data is acquired in raw format (binary data) and represents digital evidence; interpretation of these raw data at a higher level of abstraction could be the purpose of an extension of this tool aimed at examination of the digital evidence.