Mobile Technologies: 2G to 5G, GSM/CDMA, SIM and IMEI

Cellular generations are families of radio and service architecture, not one globally simultaneous launch or retirement schedule. Legacy evidence can remain relevant after a commercial network shuts down.

GSM combines frequency and time allocation and supports circuit-switched services with packet extensions such as GPRS/EDGE. UMTS uses different radio/core developments, while LTE uses an evolved packet architecture.

5G NR can operate with different deployment arrangements. Non-standalone systems can rely on LTE/EPC components; standalone systems use 5G Core functions. A “5G” status icon does not establish every part of the signalling path.

AMF, SMF and UPF describe 5G Core roles distinct from historical MSC/HLR architecture. Logs and identifiers depend on service, roaming and implementation.

Peak data-rate marketing is not a measurement of an observed transfer. Radio conditions, spectrum, scheduling, service configuration and application overhead affect actual throughput.

For evidence requests, identify the service, generation where known, operator and relevant interval. Do not assume all calls, messaging applications or data sessions are recorded in one traditional CDR table.

In a simplified GSM model, the mobile station combines equipment and subscriber functionality; BTS and BSC components provide radio access/control, while MSC and associated registers support relevant circuit-switched operations.

HLR/VLR, authentication and equipment-register functions have different purposes. A current register response is not a historical transcript of every location or action.

Operators can retain call/session, subscriber, provisioning and network records under different systems and policies. Field availability and meanings must come from the actual provider schema and response.

Cell or tracking-area observations describe network service under their technical conditions. They do not supply an exact geographic point or prove continuous presence at a tower.

IMS, LTE and 5G records can involve different functions and service paths from a GSM voice example. Preserve the provider’s explanation of identifiers, time basis, coverage and any transformations.

FDMA separates frequency allocations, TDMA separates time use, CDMA uses spreading codes and OFDMA allocates orthogonal subcarriers. Real systems combine mechanisms and apply them differently to uplink/downlink.

For example, LTE downlink and uplink do not use an identical waveform description, and 5G NR supports defined waveform options. “Generation equals one multiplexing scheme” is a useful simplification only when its limits are explicit.

Historical GSM and CDMA-family devices differ in subscription/equipment provisioning. Some CDMA systems used removable subscriber modules, so identity was not universally baked into equipment firmware.

Authentication algorithms and implementation protections evolve. Historical COMP128 weaknesses do not justify a guarantee that every newer card is impossible to extract or clone. Ordinary standards-based file access is different from a specialist attack.

5G introduces permanent/concealed identifier concepts such as SUPI and SUCI. Actual protection depends on deployment, including the selected concealment scheme; it is not a universal absence of observable identifiers.

Legacy WAP and similar services can explain old handset stores, but a protocol’s historical label does not identify all application content on a modern device.

Physical UICC cards can host SIM/USIM applications, while eSIM uses provisioned profiles on an embedded UICC. Card, application and subscription are related but distinct concepts.

Historical SIM files use master/dedicated/elementary structures; USIM applications and current standards add application-specific organisation and access conditions. One three-level legacy tree is not an exhaustive model.

Read supported data using a compatible method and record access conditions. Not every reader supports the contact card, eSIM or application, and repeated PIN attempts can change state or block access.

Hash acquired outputs and document card/profile identity, commands, tool/version and errors. Do not claim an examination never changes state merely because no deliberate file-write command was issued.

A commonly displayed IMEI has an eight-digit Type Allocation Code, six-digit serial component and one check digit. Network or software-version representations can differ; preserve the original representation and source.

For the displayed fifteen-digit value, Luhn checking doubles alternating payload digits beginning with the rightmost of the fourteen payload digits, sums resulting decimal digits and selects the final digit to make the total divisible by ten. The teaching example 490154203237518 passes.

A failed check can reflect transcription, truncation, representation or alteration. It does not prove tampering or justify destructive acquisition by itself. A passing check likewise does not prove authenticity.

TAC lookup can support model assessment, subject to database quality, allocation and device history. Compare independent identifiers and hardware rather than infer a swap solely from an unofficial lookup.

Dual-SIM equipment may expose multiple IMEIs without having separate radios for every identity. Record each actual identity and configuration. Equipment blocking is an operational/legal process, not a requirement for reading local forensic data.

Blocking and unblocking procedures vary by operator and jurisdiction. Do not unblock or reconnect an evidence phone merely because it was recovered; access and remote-change risks require a separate collection decision.

SIM replacement fraud and number-porting abuse can redirect a number through different provisioning events. They are distinct from extracting a secret to clone a card or intercepting radio traffic.

Build a timeline from original and replacement identifiers, provider provisioning events, authentication changes and relevant service/transaction records. Loss of service alone has many possible causes.

Cooling-off periods, message restrictions and disclosure requirements vary by jurisdiction and operator. Do not apply one country’s rule to every replacement or claim a universal voice-and-SMS ban.

Bank statements ordinarily describe transactions rather than every OTP delivery. Obtain the relevant authentication/delivery records where available and interpret timestamps under their actual schema.

Cellular impersonation feasibility depends on device policy, authentication, generation and coverage. Strongest signal alone does not guarantee a handset trusts a rogue station, and a 2G connection in a modern coverage area is not conclusive evidence of an interceptor.

Preserve available handset radio/network records and independent provider information. Detection apps have hardware, permission and interpretation limits; an alert does not automatically identify a transmitter or prove intercepted content.