SIMbrush: an open source tool for GSM and UMTS forensics analysis

The aim of this paper is to describe a new open source tool, usable on Windows and Linux platform, for digital evidence extraction from SIMs and USIMs card. Nowadays, closed-source or confidential tools are used for this purpose and this is contrary to Daubert's test, because, it is not possible to gain the high degree of acceptability from scientific community required by the test itself. This tool is being proposed, therefore, as a platform for the exchange of ideas, to constitute, free from the logic of copyright, a wide agreement. Security features of SIMs hamper in many ways the possibility to dump a bit for bit internal memory image. As a consequence, this tool interfaces itself to SIM cards in the standard way. Data is acquired in raw format (binary data) and represents digital evidence; interpretation of these raw data at a higher level of abstraction could be the purpose of an extension of this tool aimed at examination of the digital evidence.