MOBILE FORENSICS

Android eSIM Forensics

eSIM technology is increasingly replacing traditional SIM cards. As part of an IT forensic investigation, eSIM-related artefacts can provide clues about mobile network profiles that have been set up, device configurations and technical processes.

eUICC information
Installed eSIM profiles
Activation and provisioning information
Multiple mobile network profiles
Network operator and profile data
System logs
Timestamps and metadata
Features specific to the manufacturer and Android version

TECHNICAL BACKGROUND

Technical Fundamentals

Android supports eSIMs via an integrated eUICC (Embedded Universal Integrated Circuit Card). Depending on the device and manufacturer, different system features may be available.

Areas of forensic relevance include, amongst others:

  • •eUICC information
  • •Installed eSIM profiles
  • •Activation and provisioning information
  • •Multiple mobile network profiles
  • •Network operator and profile data
  • •System logs
  • •Timestamps and metadata
  • •Features specific to the manufacturer and Android version

The type and scope of the information available depend on the hardware, Android version and device configuration.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, eSIM-related system artefacts, configuration files and logs are examined using recognised IT forensic tools and manual analysis. The results are correlated with timestamps, SIM artefacts, call logs and other technical data. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which eSIM profiles had been set up?
  • ✔Which mobile network operators were used?
  • ✔Can changes to a profile be traced?
  • ✔What system artefacts are present?
  • ✔How reliable is the available data?

LIMITATIONS & CONCLUSION

What you should know

Not all eSIM operations are stored permanently. Depending on the manufacturer, Android version and security mechanisms, certain information may not be available, or may only be available to a limited extent.

eSIM forensics complements the analysis of traditional mobile communications artefacts and provides additional technical information on device configuration. A comprehensive evaluation of all available artefacts is always required to draw reliable conclusions.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have eSIM artefacts from an Android device examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What is an eSIM?
A SIM solution that is permanently integrated into the device and manages mobile network profiles digitally.
What does eUICC stand for?
The eUICC is the hardware component used to manage eSIM profiles.
Can multiple eSIM profiles be examined?
Yes. Provided that the relevant artefacts are available, the profiles that have been set up can be analysed.
Do eSIM devices differ depending on the manufacturer?
Yes. Storage locations and data structures vary depending on the device and Android version.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.