Mobile Telephone Evidence

7F10:6F44

For those of you who have attended the TrewMTE GSM Mobile Telephone SIM forensic Card training courses will know the user content elementary file (EF LND) Last Number Dialled. We know from the GSM SIM Standard that this EF is optional, but once allocated and activated in SIM, has a number of mandatory features. The EF stores the number dialled by the user. In the words of the academic authors Redl, Weber & Oliphant "The last number dialed (EFLND) contains a list of the last numbers that were dialed using the SIM." Historically, the numbers found in EFLND have consistently shown to have been stored following selection of numbers from other EFs in the SIM and not numbers dialled on the handset keys or from a handset's phonebook. It has been noted recently that certain SonyEricsson handsets that have dialled numbers are being recorded into this particular elementary file (EFLND). I thought this info was worth passing on - to avoid or reduce confusion during examination.