EF_SMS
Definition
Elementary File for Short Message Service. A fixed-size record file on the SIM that stores SMS messages. Each record has a status byte (read, unread, sent, or free) and a message body. Records marked free after deletion often retain the original message content until the slot is overwritten.
- Full name
- Elementary File for Short Message Service
- File type
- Fixed-size linear record file
- Location
- SIM/USIM filesystem, under DF_TELECOM
- Key field
- Status byte per record
Common questions
Why can deleted SMS often still be recovered from EF_SMS?+
Deletion only flips the status byte from used to free, it does not erase the message body. The record's bytes stay in place until the SIM writes a new message into that same slot, so a forensic reader can still parse the old text if the slot has not been reused.
How does an examiner know a recovered message was deleted rather than read?+
The status byte encodes several states, not just used or free: read, unread, sent, and free. An examiner checks this byte to distinguish an intact unread or sent message from a record marked free that still carries leftover content.
Related terms
- APDU
- Application Protocol Data Unit. The command and response message format used to communicate with a smart card over the ISO 7816 interface....
- ICCID
- Integrated Circuit Card Identifier. The serial number of the physical SIM card itself, stored in EF_ICCID. It identifies the card as a...
- IMSI
- International Mobile Subscriber Identity. A 15-digit number stored in EF_IMSI on the SIM that uniquely identifies the subscriber account on the mobile...
- LOCI
- Location Information file (EF_LOCI on SIM, EF_LOCI and EF_EPSLOCI on USIM). Stores the Location Area Identity (LAI) last received from the network...
- UICC
- Universal Integrated Circuit Card. The physical hardware platform for modern SIM cards. A UICC can host multiple card applications simultaneously: a SIM...