SIM Card Data Decoder - Digital Forensics Tool

Overview

Professional tool for analyzing ICCID and IMSI numbers in digital forensics examinations. This tool breaks down SIM card identifiers into their component parts for educational and investigative purposes.

Current Status - Complete SIM Forensics Tool ✅

Implemented Features

Core Infrastructure

• ✅ Professional class-based architecture with SIMCardDecoder class
• ✅ Comprehensive logging system with timestamped audit files
• ✅ Session management with unique session IDs
• ✅ Command-line argument parsing for multiple operation modes
• ✅ Robust error handling and input validation

ICCID Analysis Engine 🔬

• ✅ Complete ICCID component breakdown:
  • Major Industry Identifier (MII) parsing and validation
  • Country Code recognition (20+ countries supported)
  • Issuer Identifier parsing with operator databases
  • Individual Account Identification extraction
  • Luhn algorithm checksum validation
• ✅ Comprehensive operator databases:
  • UK operators (O2, EE, Three, Vodafone, regional carriers)
  • International operators (US, Germany, France, Japan)
  • Operator type classification (MNO, Regional)
• ✅ Professional forensic reporting:
  • Detailed component analysis
  • Confidence scoring (HIGH/MEDIUM/LOW)
  • Validation notes and warnings
  • Forensic recommendations
• ✅ Geographic identification:
  • Country and region determination
  • Cross-border investigation support

IMSI Analysis Engine 📱

• ✅ Complete IMSI component breakdown:
  • Mobile Country Code (MCC) parsing with ITU-T E.212 compliance
  • Mobile Network Code (MNC) with 2-3 digit support
  • Mobile Subscriber Identification Number (MSIN) extraction
  • Variable length MNC handling for different countries
• ✅ Comprehensive operator databases:
  • 40+ countries with MCC mappings
  • UK operators (O2, EE, Three, Vodafone, regional carriers)
  • US operators (AT&T, Verizon, T-Mobile, Sprint)
  • International operators (Germany, France, Japan, etc.)
• ✅ MVNO identification and analysis:
  • Distinguishes MVNOs from primary network operators
  • Parent network relationship mapping
  • Corporate and global MVNO detection
• ✅ Test IMSI detection:
  • ITU-T test network identification (MCC 001)
  • Suspicious pattern detection
  • Authentication assessment
• ✅ Professional forensic reporting:
  • Educational context (IMSI vs phone number)
  • Network routing significance
  • Investigation recommendations
  • Confidence scoring with detailed rationale

Input Validation

• ✅ ICCID format validation (19-20 digits, telecommunications prefix checking)
• ✅ ICCID structural validation (MII, country code, checksum)
• ✅ IMSI format validation (14-15 digits)
• ✅ IMSI structural validation (MCC, MNC, MSIN length)
• ✅ Test pattern detection and forensic flagging
• ✅ Comprehensive error logging for invalid inputs

CLI Interface

• ✅ --iccid - Analyze single ICCID number
• ✅ --imsi - Analyze single IMSI number
• ✅ --batch - Batch processing mode (framework ready)
• ✅ --quiet - Suppress non-essential output
• ✅ --log-level - Configurable logging levels
• ✅ --interactive - Interactive mode (framework ready)

Forensic Features

• ✅ Professional disclaimer display
• ✅ Audit trail logging for all operations
• ✅ Session tracking and summary reporting
• ✅ Educational warnings about validation requirements

Usage Examples

# Analyze a single ICCID with full forensic breakdown
python sim_card_decoder.py --iccid 8944020111185107200

# UK ICCID analysis (O2, EE, Three, Vodafone supported)
python sim_card_decoder.py --iccid 8944030111185107201

# US ICCID analysis
python sim_card_decoder.py --iccid 89014103211118510720

# IMSI analysis - UK O2 network
python sim_card_decoder.py --imsi 234101234567890

# IMSI analysis - US T-Mobile network  
python sim_card_decoder.py --imsi 310260123456789

# IMSI analysis - UK EE network
python sim_card_decoder.py --imsi 234301234567890

# Test IMSI detection
python sim_card_decoder.py --imsi 001011234567890

# Quiet mode for batch processing
python sim_card_decoder.py --iccid 8944020111185107200 --quiet

# Debug mode with detailed validation logging
python sim_card_decoder.py --imsi 234101234567890 --log-level DEBUG

# View help and available options
python sim_card_decoder.py --help

Architecture

File Structure

sim_decoder/
├── sim_card_decoder.py    # Main tool implementation
├── requirements.txt       # Dependencies (currently only stdlib)
├── logs/                 # Timestamped audit logs
│   └── sim_decoder_*.log
└── README.md             # This documentation

Key Classes

• SIMCardDecoder - Main analysis engine with forensic logging
• Session management with UUID tracking
• Professional CLI argument parsing

Forensic Compliance

Audit Trail

• All operations logged with timestamps and session IDs
• Input validation failures recorded
• Session summaries for forensic reporting

Disclaimers

• Educational use warnings displayed
• Validation requirements emphasized
• Official channel verification reminders

Next Development Phases

Phase 2: ICCID Analysis Engine ✅ COMPLETE

• ✅ Detailed component breakdown (Industry ID, Country Code, Issuer ID)
• ✅ Carrier identification and geographic mapping
• ✅ Luhn algorithm checksum validation
• ✅ Professional forensic reporting
• ✅ UK and international operator databases

Phase 3: IMSI Analysis Engine ✅ COMPLETE

• ✅ MCC (Mobile Country Code) extraction and lookup (40+ countries)
• ✅ MNC (Mobile Network Code) identification with variable length support
• ✅ MSIN (Mobile Station ID) analysis and validation
• ✅ MVNO detection and parent network identification
• ✅ Test IMSI detection and suspicious pattern analysis
• ✅ Educational context and forensic significance

Phase 4: Advanced Features (Future)

• Batch processing implementation
• Interactive analysis mode
• Report generation and export
• Database integration for carrier lookups

Feature Comparison

Feature	ICCID Analysis	IMSI Analysis
Component Parsing	✅ MII, Country, Issuer, Account, Check Digit	✅ MCC, MNC, MSIN
Country Recognition	✅ 20+ countries	✅ 40+ countries (ITU-T E.212)
Operator Databases	✅ UK + International	✅ UK + US + International
Validation	✅ Luhn Algorithm	✅ Structure + Test Pattern Detection
MVNO Support	❌	✅ Full MVNO identification
Test Detection	❌	✅ ITU-T test networks + suspicious patterns
Educational Context	✅ Component explanations	✅ IMSI vs Phone Number, Network Routing
Confidence Scoring	✅ HIGH/MEDIUM/LOW	✅ HIGH/MEDIUM/LOW with detailed rationale
Professional Reports	✅ Forensic format	✅ Investigation significance + recommendations

Technical Specifications

Database Coverage

• Countries: 40+ with ISO codes and regional grouping
• UK Operators: O2, EE, Three, Vodafone, Regional carriers, MVNOs, Emergency services
• US Operators: AT&T, Verizon, T-Mobile, Sprint, Dish Network
• International: Germany, France, Japan, China, Australia, and more
• Network Technologies: GSM, UMTS, LTE, CDMA, TETRA

Forensic Capabilities

• Session Tracking: UUID-based audit trail
• Logging: Comprehensive DEBUG/INFO/WARNING/ERROR levels
• Validation: Multi-layer validation with confidence assessment
• Educational: Professional explanations for each component
• Compliance: ITU-T E.212 standard compliance for IMSI

Dependencies

• Python 3.7+ (uses standard library only)
• No external packages required for foundation

License

Educational Use - Digital Forensics Tool