Examining a SIM card first requires establishing the source of the information being analysed. A number shown in a report, a card identifier and a message found on a phone answer different questions. A reliable opinion should show the path from source material to conclusion, instead of treating every report entry as the contents of a single storage medium.
SIM, phone, backup and operator documentation
MOBILedit documentation distinguishes contacts on the phone, SIM and in applications. Likewise, SIM messages are a separate category, available when such data can be acquired. A consolidated report may combine results from several sources. A ‘Contacts’ or ‘Messages’ section heading alone is therefore insufficient to determine an entry's origin. Contacts—manufacturer's documentation; messages—manufacturer's documentation.
| Material | What the description needs to explain |
|---|---|
| Physical SIM card | Which data was acquired from this particular card. |
| Phone memory | Which file, application or collection is the source of the finding. |
| iPhone backup | Whether the result concerns SIM/eSIM information stored in a backup. |
| Operator documentation | Whether it was provided as separate material. |
The manufacturer describes the ability to read SIM/eSIM information and card history from an encrypted iTunes backup. The presence of this metadata does not prove that an eSIM profile has been copied or activated. SIM data and information from an iOS backup.
What forensic SIM cloning means
In the MOBILedit manual, this function serves to isolate the phone from the cellular network, for example when an older handset requires a SIM to be inserted before it can start. The replacement card does not connect to the operator's network. If no PIN is entered during copying, identifiers such as IMSI and ICCID are transferred, but user data is not. This function should therefore not be described as taking over a number, copying a service or cracking the original card's PIN. Built-in SIM Cloning—scope and limitations.
Hypothetical example: the same identifier, different significance
Suppose a phone, a SIM card and a previously created iPhone backup are submitted for analysis. The backup contains a historical entry with an ICCID matching the marking on the submitted card. This match and the exact location of the entry can be described. The comparison alone does not establish who used the device, whether the card was active at the time of the incident or whether a particular message was stored on the SIM.
This is a methodological example, not an account of a completed case. Any further conclusion would require checking the time, context and independent material. If an element is missing, it should remain explicitly undetermined. Missing confirmation must not be replaced by an assumption simply because the identifiers look convincing.
Documentation that allows the result to be assessed
The examination description should distinguish the submitted material from the working medium. It is useful to record the initial condition, identifying markings, handover dates, scope of authorisation, reader used, and software and package versions. Each significant finding should be linked to its source, with any reading limitations specified. Readers should be able to distinguish what was observed directly, what was established by comparison and what was not checked.
Preserving output files, logs and their identifiers helps trace the work performed. However, the checksum of a particular file does not by itself prove that an entire running phone has remained unchanged. Failure to find content likewise does not establish that it never existed. These are principles of cautious interpretation, not software guarantees.
Equipment and limits of the service described
Preparing an isolation card and reading a SIM require a compatible reader, the appropriate working card and a function available in the software version used. Equipment selection is part of determining the method’s suitability. The manufacturer describes reader and forensic SIM cards in the Connection Kit; its use must be related to the material being examined.
The scope of analysis must be determined for the specific material and question. There is no basis here for promises to recover all correspondence, unlock any phone or obtain operator authentication. The initial enquiry need only describe the material, purpose and relevant period; PINs and full identifiers should not be disclosed publicly.
Manufacturer sources were checked on 1 November 2026. The article explains methodology and limitations; it does not present test results for a particular device.