IMSI
Definition
International Mobile Subscriber Identity. A 15-digit number stored in EF_IMSI on the SIM that uniquely identifies the subscriber account on the mobile network. The first three digits are the Mobile Country Code, the next two or three are the Mobile Network Code, and the remainder is the subscriber number within that network.
- Digits
- 15 total: 3 MCC + 2-3 MNC + remaining MSIN
- Storage location
- Embedded on the SIM card
- Function
- Authenticates subscriber to the mobile network and links to network operator records
Common questions
What exactly is an IMSI and why do forensic examiners care about it?+
IMSI (International Mobile Subscriber Identity) is the 15-digit unique identifier stored on a SIM card that identifies a subscriber to the mobile network. In forensics, it is crucial because it links a phone to a specific network account and subscriber records, helping establish device ownership and the timeline of activities.
How is the IMSI structured?+
IMSI has three parts: the first 3 digits are the MCC (Mobile Country Code), the next 2-3 digits are the MNC (Mobile Network Code identifying the carrier), and the remaining digits form the MSIN (Mobile Subscriber Identification Number). In India, the MCC is 404 or 405.
Can you extract IMSI during mobile phone forensics?+
Yes. IMSI is stored on the SIM card and can be extracted during mobile forensic acquisition and examination. Investigators use it to cross-reference network operator records for call logs and billing data, linking the SIM to a specific subscriber account.
Related terms
- ICCID
- Integrated Circuit Card Identifier. The serial number of the physical SIM card itself, stored in EF_ICCID. It identifies the card as a...
- IMEI
- International Mobile Equipment Identity, a 15-digit identifier of the handset hardware. Format is 8-digit TAC + 6-digit serial + 1-digit Luhn check....
- APDU
- Application Protocol Data Unit. The command and response message format used to communicate with a smart card over the ISO 7816 interface....
- CDR
- Call Detail Record. Telco-side log of A-party, B-party, start time, duration, IMEI, IMSI and serving cell ID. Lawful-intercept output under the IT...
- Chip-Off
- NIST SP 800-101 R1 Level 5 acquisition. Desoldering the NAND or eMMC chip from the PCB and reading it directly with a...
- EF_SMS
- Elementary File for Short Message Service. A fixed-size record file on the SIM that stores SMS messages. Each record has a status...
- EPC / 5GC
- Evolved Packet Core (LTE) and 5G Core (5G NR), the all-IP packet cores that replaced the circuit-switched GSM core. 5GC is service-based,...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- FDE
- Full Disk Encryption. Default on modern Android (file-based encryption since Nougat) and iOS. Encryption keys are tied to the user passcode and...
- Ki
- The 128-bit secret authentication key stored on the SIM and in the operator's Authentication Centre (AuC). Never leaves either party in cleartext...
- LOCI
- Location Information file (EF_LOCI on SIM, EF_LOCI and EF_EPSLOCI on USIM). Stores the Location Area Identity (LAI) last received from the network...
- MSC
- Mobile Switching Centre, the GSM core node that routes calls and SMS between the cellular network and the PSTN, and queries the...
Explained in these topics
- Mobile Phone Forensics: Acquisition and ExaminationInternational Mobile Subscriber Identity. 15-digit subscriber identifier stored on the SIM (first 3 MCC, next 2-3 MNC, rest MSIN). Authenticates the subscriber...
- Mobile Technologies: 2G to 5G, GSM/CDMA, SIM and IMEIInternational Mobile Subscriber Identity, a 15-digit identifier stored on the SIM that names the subscriber on the network. Format is MCC (3 digits) + MNC (2 o...
- SIM Card ForensicsInternational Mobile Subscriber Identity. A 15-digit number stored in EF_IMSI on the SIM that uniquely identifies the subscriber account on the mobile network....