Deleted SMS

How to recover SIM card data. This arti­cle I found from Dekart Company:

How to recover a deleted SMS with SIM Manager

Recov­er­ing a deleted SMS is some­thing many of us need to do from time to time. This guide explains when undelet­ing an SMS is pos­si­ble, which tools are required and how the process works.One doesn’t need to be a foren­sic detec­tive, or a sus­pect­ing spouse in order to need such a fea­ture; you’ll be sur­prised to see that most com­pa­nies that offer SIM card recov­ery tools use sam­ple screen­shots with an undeleted SMS say­ing some­thing like “he is not com­ing back tonight, let’s do it again” or “last night was great”. Let’s give human­ity a chance.

Undelet­ing a SMS is what nor­mal peo­ple need too, from time to time you receive impor­tant data via SMS (an address, a phone num­ber) or write such data to one and save it in the out­box (ex: a pass­word, a PIN, etc) in order to retrieve it later – this is where a deleted SMS can be a prob­lem. A SIM card recov­ery tool is handy in such cases.

How SMS are deleted

In order to recover an SMS, we need to under­stand how they are deleted. The SIM card has a spe­cial file where the SMS are stored, the file has sev­eral “slots” in it, each slot holds a mes­sage. The num­ber of slots is finite, i.e. a SIM card can store 20 or 25 SMS (depend­ing on the capac­ity, newer cards have more slots). When all the slots are filled, you have to delete an old SMS before you can save a new one.

The struc­ture of one such slot is made of sev­eral fields, such as: the phone num­ber of the sender, the date and time the SMS was received, the text of the mes­sage itself. There are other fields which are not shown to us, one of them is the state of the cur­rent slot, which can be either “empty”, or “in use”.

Here is a pic­ture that illus­trates a SIM card with 4 SMS slots, all of which are in use.

Some phones will delete an SMS by set­ting the value in the “state” field to “free”, leav­ing the other fields intact. When a new SMS is received, the phone will ver­ify whether free slots exist, and if they do – they’ll be used to store the new SMS. Until a new SMS arrives and the “marked as free” space is not needed – the SMS can be recov­ered, by sim­ply chang­ing the “state” field back to “in use” using a tool such as SIM Man­ager and a SIM card reader. This is what the SMS file looks like when a mes­sage was “marked as deleted”

In con­trast, other phones will not only alter the “state” field, but they will also over­write the other fields with some default value, imme­di­ately after the mes­sage was deleted.

This is what the SMS file looks like when a mes­sage was “wiped”

How SMS are recovered

By now it should be clear that in order to recover a deleted SMS, all you have to do is change the state of the SMS to “in use”, and the phone will hap­pily dis­play that message.

SIM Man­ager will dis­play the mes­sages that were “marked as deleted” in red, to make sure that you see them, enable the “Show deleted SMS” option in OptionsSettings.

If you see one such SMS, right-click it and press “Undelete”. Alter­na­tively, you can press “Wipe” and make sure that it can­not be recovered.

Here is a screen­shot which shows a real life SIM card with 20 SMS slots, 4 of which con­tain mes­sages, but only the first two are in use, the last two are marked as deleted.

Below is another screen­shot, made with a foren­sic analy­sis tool called SIM Explorer, which illus­trates the raw data of the SIM card besides the inter­preted human-readable rep­re­sen­ta­tion; the tool is mostly used to gather elec­tronic evi­dence from SIM cards, but in our case we’ll use it to take a look at the guts of the card and under­stand how SIM card recov­ery works.

Note how the “00” in the begin­ning means “free”, while “07” means “in use”. The first two mes­sages will be shown by the phone, the fol­low­ing two mes­sages are not going to be shown by the mobile phone – but you can see that the actual con­tents of the mes­sage is still phys­i­cally on the card, there­fore the SMS can be recov­ered. The rest of the file are the empty slots. Note that they not only have “00” in the begin­ning, but the rest is filed with “FF FF” – which is the default value for a wiped message.

Finally, you need a SIM card reader, which acts as an inter­face between the SIM card recov­ery soft­ware and the SIM card itself. Here is en exam­ple of one such device.

When is it impos­si­ble to recover a deleted SMS?

Unfor­tu­nately things are not as sim­ple as get­ting a SIM card reader and a copy of SIM Man­ager, there is one more detail – does your phone delete the mes­sage, or does it only mark it as deleted?

The prob­lem is that dif­fer­ent mobile phone com­pa­nies do it their way, and you can’t know what your case is unless you actu­ally give it a try, because none of the com­pa­nies writes about this in the descrip­tion of their products.

Finally, there is another detail – many new phones have the habit of stor­ing the SMS in their own mem­ory, rather than on the SIM card. In that case, the solu­tion described here does not apply, because each phone man­u­fac­turer has it their way. There are cases in which the phone will use its own mem­ory for SMS stor­age, and when it gets full – the new SMS will be stored on the SIM card.

There is no cer­tain way of telling guess­ing how a phone behaves, there­fore you should study your phone’s habits and see your­self. It is also a good idea to develop the cus­tom to save the impor­tant mes­sage to the SIM – to max­i­mize the chance to recover the deleted SMS if things go wrong.

How many old SMSes can I recover?

This depends on how many slots there are. The gen­eral rule is that you should try to recover the SMS as soon as you know that it was deleted. If you don’t do that, the slot marked as empty can be over­writ­ten with a new mes­sage when you receive one – you don’t want that.

If you’re deal­ing with very impor­tant data, con­sider turn­ing the phone off – to exclude the pos­si­bil­ity that a new SMS will be received.