What is Observable memory

This chapter is aimed at introducing SIM and USIM card forensics, which pertains to the Small Scale Digital Device Forensics (SSDDF) (Harril, & Mislan, 2007) field. Particularly, we would like to pinpoint what follows. First, we will introduce the smart card world, giving a sufficiently detailed description regarding the main physical and logical main building blocks. Then we will give a general overview on the extraction of the standard part of the file system. Moreover, we will present an effective methodology to acquire all the observable memory content, that is, the whole set of files which represent the full file system of such devices. Finally, we will discuss some potential cases of data hiding at the file system level, presenting at the same time a detailed and useful procedure used by forensics practitioners to deal with such a problem.