The recovery of the LOCI file system is a piece of crucial evidence in the field of mobile device forensics. There is a lot of important information in the SIM Location Information (LOCI) file system that is going to discuss in this post.
What is LOCI in SIM?
LOCI in SIM stands for Location Information.
LOC is a substitute of Location and “I” stands for Information.
- LOCI is a type of SIM Elementary File, a part of the Dedicated File (DF) structure for GSM (DF_GSm).
- Its file size usually 11 bytes.
- Forensic Importance: It can be a piece of crucial evidence in the field of SIM Forensic analysis as it stores the data related to geographical location (tower) or area where the device is last switched off.
Function and Working of LOCI
A forensic analysis of LOCI in SIM doesn’t point the actual location of the mobile device. But in gross, it saves information of last access geographical location to which the mobile device was registered to a network.
LOCI not only serves to keep data but also help the mobile device to connect to the network quickly.
It should be noted that the mobile device only saves location when the mobile device is successful (proper) shut-down or power off.
In the event that the device battery is abruptly removed, or it is broken prior to powering off, all (even one) may be the cause of the unavailability of LOCI file or it may provide incorrect data.
Related Article:
1. Mobile Device Forensic: Ultimate Guide for Collection
2. Mobile Forensic Data Acquisition Methods and Tools
Valuable Information from LOCI SIM
The LOCI comprises the following listed valuable information:
- The TMSI (Temporary Mobile Subscriber Identity). TMSI is a temporary random ID that is assigned to every mobile device in an area by the means of VLR (Visitor Locator Register) to the subscriber. This number is local to an area, so it changes with the change in the geographical area.
- LAI (Location Area Information). The LAI broadcast signal in a specific location through Broadcast Control Channel (BCCH). A mobile device recognizes these broadcasted LAI signals and saves it in the respective SIM card.
- TMSI Time. As per the name, it saves data relating to time and updates TMSI ID. This information is being updated as the mobile device user moves to a new location.
- The location update status. It demonstrated whether the location is updated successfully or not.
In case the mobile device is moving and also the LAI changes, then, in this case, the mobile system will request to update new LAI, by informing the SIM providers to update its new LAI.
This enables the SIM provider to locate the new mobile station (or device) in case of incoming data such as mobile calls.
Forensic SIM Analysis OF LOCI
Informational Data from SIM analysis of LOCI:
1. Retention of Data: The stored data in non-volatile form i.e. even if the mobile devices are powered down the information remains intact.
2. Data Size of LOCI: The file size is usually 11 bytes
Distribution of Information of LOCI SIM Elementary file
- Length (Bytes) :11 bytes
- Bytes distribution :
- 1-4 bytes = Temporary Mobile Subscriber Identity (TMSI)
- 5-9 bytes = Location Area Information (LAI)
- 10 bytes = TMSI Time
- 11 bytes = Location update status
Example of FILE distribution in LOCI from a forensic solution tool.
- TMSI : 3103832D
- LAI: 76FOO100C6
- TMSI_TIME: 00
- Location Update Status: 00
Analysis of LAI (MCC, MNC, AND LAC)
The Location Area Information (LAI) incorporates the important file MCC (Mobile Country Code), the MNC (Mobile Network Code), and the LAC (Location Area Code).
After extracting the data from these files the examiner can consult with the website called www.mcc-mnc.com, with the help of this the examiner can at least identify the country and carrier to contact and obtain possible subscriber’s information.
Summary
LOCI is one of many files that are stored in a dedicated file system in a SIM and one of the important files that need to be extracted and analyzed to identify the specific geographical location.
The LOCI file contains data, the examiner can use this key to identify the geographic location by contacting the carrier of record with the key information.
If you like this concise post on “SIM file system of LOCI “, then share your love in the comment box, we love to hear from your side. At last, if you find this concise article on the SIM file system of LOCI then don’t be harsh please share this post.
Related Article:
1. Mobile Device Forensic: Ultimate Guide for Collection
2. FPLMN (SIM): A detailed Explanation | UPLMN, OPLMN, EPLMN, HPLMN, IPLMN, VPLMN
FR Author Group at ForensicReader is a team of Forensic experts and scholars having B.Sc, M.Sc, or Doctorate( Ph.D.) degrees in Forensic Science. We published on topics on fingerprints, questioned documents, forensic medicine, toxicology, physical evidence, and related case studies. Know More.
