U.S. Department of Justice 

Office of Justice Programs 

National Institute of Justice 

Special REPORT

Test Results for Mobile Device Acquisition Tool: 

Susteen DataPilot Secure View 1.8.0 

OCT. 08 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov

www.ojp.usdoj.gov/nij 
U.S. Department of Justice 

Office of Justice Programs 

810 Seventh Street N.W. 

Washington, DC 20531 

Michael B. Mukasey 

Attorney General 

Jeffrey L. Sedgwick 

Acting Assistant Attorney General 

David W. Hagy 

Director, National Institute of Justice 

This and other publications and products of the National Institute 

of Justice can be found at: 

National Institute of Justice 

www.ojp.usdoj.gov/nij 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov 
OCT. 08 

Test Results for Mobile Device Acquisition Tool: 

Susteen DataPilot Secure View 1.8.0 

NCJ 223997 
David W. Hagy 

Director, National Institute of Justice 

This report was prepared for the National Institute of Justice, U.S. Department of Justice, by the 

Office of Law Enforcement Standards of the National Institute of Standards and Technology 

under Interagency Agreement 2003–IJ–R–029. 

The National Institute of Justice is a component of the Office of Justice Programs, which also 

includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of 

Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. 
 

 June 2008 

Test Results for Mobile Device Acquisition Tool: 

Susteen DataPilot Secure View 1.8.0 
October 2008 ii Results of Secure View V1.8.0 6/2008 
Contents 

1 Results Summary .................................................................................................................... 2 

2 Test Case Selection ................................................................................................................. 3 

3 Results by Test Assertion........................................................................................................ 5 

3.1 Acquisition of MSISDN ............................................................................................... 10 

3.2 EMS Messages .............................................................................................................. 10 

3.3 Connectivity Disruption ................................................................................................ 10 

3.4 Subscriber Information ................................................................................................. 11 

3.5 Foreign Character Display ............................................................................................ 11 

3.6 Acquisition Reports ...................................................................................................... 11 

4 Testing Environment ............................................................................................................. 12 

4.1 Test Computers ............................................................................................................. 12 

5 Test Results ........................................................................................................................... 13 

5.1 Test Results Report Key ............................................................................................... 13 

5.2 Test Details ................................................................................................................... 14 

5.2.1 CFT-IM-01 (Nokia 6101) ..................................................................................... 14 

5.2.2 CFT-IM-02 (Nokia 6101) ..................................................................................... 16 

5.2.3 CFT-IM-03 (Nokia 6101) ..................................................................................... 18 

5.2.4 CFT-IM-04 (Nokia 6101) ..................................................................................... 20 

5.2.5 CFT-IM-05 (Nokia 6101) ..................................................................................... 22 

5.2.6 CFT-IM-06 (Nokia 6101) ..................................................................................... 24 

5.2.7 CFT-IM-07 (Nokia 6101) ..................................................................................... 26 

5.2.8 CFT-IM-08 (Nokia 6101) ..................................................................................... 28 

5.2.9 CFT-IM-10 (Nokia 6101) ..................................................................................... 30 

5.2.10 CFT-IMO-01 (Nokia 6101) .................................................................................. 32 

5.2.11 CFT-IMO-09 (Nokia 6101) .................................................................................. 34 

5.2.12 CFT-IMO-11 (Nokia 6101) .................................................................................. 36 

5.2.13 CFT-SIM-01 (T-Mobile SIM) .............................................................................. 38 

5.2.14 CFT-SIM-02 (T-Mobile SIM) .............................................................................. 39 

5.2.15 CFT-SIM-03 (T-Mobile SIM) .............................................................................. 40 

5.2.16 CFT-SIM-04 (T-Mobile SIM) .............................................................................. 41 

5.2.17 CFT-SIM-05 (T-Mobile SIM) .............................................................................. 42 

5.2.18 CFT-SIM-06 (T-Mobile SIM) .............................................................................. 43 

5.2.19 CFT-SIM-07 (T-Mobile SIM) .............................................................................. 45 

5.2.20 CFT-SIM-08 (T-Mobile SIM) .............................................................................. 46 

5.2.21 CFT-SIM-09 (T-Mobile SIM) .............................................................................. 47 

5.2.22 CFT-SIM-10 (T-Mobile SIM) .............................................................................. 48 

5.2.23 CFT-SIMO-01 (T-Mobile SIM) ........................................................................... 49 

5.2.24 CFT-SIMO-05 (T-Mobile SIM) ........................................................................... 50 

5.2.25 CFT-SIMO-07 (T-Mobile SIM) ........................................................................... 51 

5.2.26 CFT-SIMO-08 (T-Mobile SIM) ........................................................................... 53 

5.2.27 CFT-SIMO-09 (T-Mobile SIM) ........................................................................... 54 

5.2.28 CFT-SIMO-11 (T-Mobile SIM) ........................................................................... 55 

5.2.29 CFT-IM-01 (Motorola RAZR V3)........................................................................ 56 

October 2008 iii Results of Secure View V1.8.0 6/2008 
5.2.30 CFT-IM-02 (Motorola RAZR V3)........................................................................ 58 

5.2.31 CFT-IM-03 (Motorola RAZR V3)........................................................................ 60 

5.2.32 CFT-IM-04 (Motorola RAZR V3)........................................................................ 62 

5.2.33 CFT-IM-05 (Motorola RAZR V3)........................................................................ 64 

5.2.34 CFT-IM-06 (Motorola RAZR V3)........................................................................ 66 

5.2.35 CFT-IM-07 (Motorola RAZR V3)........................................................................ 68 

5.2.36 CFT-IM-08 (Motorola RAZR V3)........................................................................ 70 

5.2.37 CFT-IM-10 (Motorola RAZR V3)........................................................................ 72 

5.2.38 CFT-IMO-01 (Motorola RAZR V3) ..................................................................... 74 

5.2.39 CFT-IMO-09 (Motorola RAZR V3) ..................................................................... 76 

5.2.40 CFT-IMO-11 (Motorola RAZR V3) ..................................................................... 78 

5.2.41 CFT-SIM-01 (AT&T SIM).................................................................................. 80 

5.2.42 CFT-SIM-02 (AT&T SIM).................................................................................. 81 

5.2.43 CFT-SIM-03 (AT&T SIM).................................................................................. 82 

5.2.44 CFT-SIM-04 (AT&T SIM).................................................................................. 83 

5.2.45 CFT-SIM-05 (AT&T SIM).................................................................................. 84 

5.2.46 CFT-SIM-06 (AT&T SIM).................................................................................. 85 

5.2.47 CFT-SIM-07 (AT&T SIM).................................................................................. 87 

5.2.48 CFT-SIM-08 (AT&T SIM).................................................................................. 88 

5.2.49 CFT-SIM-09 (AT&T SIM).................................................................................. 89 

5.2.50 CFT-SIM-10 (AT&T SIM).................................................................................. 91 

5.2.51 CFT-SIMO-01 (AT&T SIM)................................................................................ 92 

5.2.52 CFT-SIMO-05 (AT&T SIM)................................................................................ 93 

5.2.53 CFT-SIMO-07 (AT&T SIM)................................................................................ 95 

5.2.54 CFT-SIMO-08 (AT&T SIM)................................................................................ 97 

5.2.55 CFT-SIMO-09 (AT&T SIM)................................................................................ 98 

5.2.56 CFT-SIMO-11 (AT&T SIM)................................................................................ 99 

October 2008 iv Results of Secure View V1.8.0 6/2008 
October 2008 v Results of Secure View V1.8.0 6/2008 
 

Introduction 

The Computer Forensics Tool Testing (CFTT) program is a joint project of the National 

Institute of Justice (NIJ), the research and development organization of the U.S. 

Department of Justice, and the National Institute of Standards and Technology’s (NIST’s) 

Office of Law Enforcement Standards and Information Technology Laboratory. CFTT is 

supported by other organizations, including the Federal Bureau of Investigation, the U.S. 

Department of Defense Cyber Crime Center, U.S. Internal Revenue Service Criminal 

Investigation Division Electronic Crimes Program, and the U.S. Department of 

Homeland Security’s Bureau of Immigration and Customs Enforcement, U.S. Customs 

and Border Protection and U.S. Secret Service. The objective of the CFTT program is to 

provide measurable assurance to practitioners, researchers, and other applicable users that 

the tools used in computer forensics investigations provide accurate results. 

Accomplishing this requires the development of specifications and test methods for 

computer forensics tools and subsequent testing of specific tools against those 

specifications. 

Test results provide the information necessary for developers to improve tools, users to 

make informed choices, and the legal community and others to understand the tools’ 

capabilities. This approach to testing computer forensic tools is based on well-recognized 

methodologies for conformance and quality testing. The specifications and test methods 

are posted on the CFTT Web site (http://www.cftt.nist.gov/) for review and comment by 

the computer forensics community. 

This document reports the results from testing Susteen’s Secure View, version 1.8.0, 

against the GSM Mobile Device and Associated Media Tool Specification and Test Plan 

Version 1.1, available at the CFTT Web site (http://www.cftt.nist.gov/GSM-MobileDevice-and-Associated-Media-Tool-Specification-and-Test-Plan.pdf). Collected data 

packets (sent and received data transmissions) for mobile device internal memory 

acquisitions and SIM internal memory acquisitions, captured via a port monitoring utility, 

are posted at www.cftt.nist.gov/mobile_devices.htm. 

Test results from other software packages and the CFTT tool methodology can be found 

on NIJ’s computer forensics tool testing Web 

page, http://www.ojp.usdoj.gov/nij/topics/technology/electronic-crime/cftt.htm.
 

 

 

Test Results for Mobile Device Data Acquisition Tool 

Tool Tested: Susteen Data Pilot Secure View for Forensics 

Version: 1.8.0 

Run Environments: Windows XP Service Pack 2 

Supplier: Susteen, Inc. 

Address: 8001 Irvine Center Dr. Suite 1500 

Irvine, CA 92618 

Tel: 949–341–0007 

Fax: 949–341–0008 

WWW: http://www.mobileforensics.com 

1 Results Summary 

Except for the following test cases (CFT–IM–05, CFT–IM–08, CFT–IMO–09, CFT– 

SIM–03, CFT–SIM–06, CFT–SIM–09, CFT–SIMO–01, CFT–SIMO–05), the tested tool 

acquired all supported data objects completely and accurately from the selected test 

mobile devices and associated media (i.e., Nokia 6101, T-Mobile SIM, Motorola RAZR 

V3, AT&T SIM). The exceptions are the following: 

1. The MSISDN was not acquired from the Nokia 6101. (CFT–IM–05) 

2. EMS messages (messages over 160 characters) are not reported in their entirety. 

Messages are truncated after the 160th character. (CFT–IM–08) 

3. Address book entries (i.e., Device Internal Memory-contacts) containing foreign 

characters (i.e., Chinese) are not displayed. Foreign text messages (i.e., French, 

Chinese) present in the device internal memory are either partially acquired but 

not properly displayed, or not reported (i.e., Chinese text messages – Motorola 

RAZR). (CFT–IMO–09) 

4. No warning messages are displayed to the examiner of SIM connectivity issues 

during acquisition, if the SIM is pulled from the reader. (CFT–SIM–03) 

5. The Service Provider Name (SPN) is not reported from the SIM acquisitions. 

(CFT–SIM–06) 

6. EMS messages present on the AT&T SIM, with the status of Unread were 

acquired but not properly presented (i.e., the text characters were not consistent 

with the pre-defined data set. The reported characters were random ASCII 

characters and symbols. (CFT–SIM–09) 

7. Complete representation of known data contained on the internal memory of the 

AT&T SIM presented via generated reports was not consistent with the predefined dataset. (CFT–SIMO–01) 

8. Deleted EMS messages present on the AT&T SIM were partially acquired but not 

properly presented. (CFT–SIMO–05) 

October 2008 2 of 99 Results of Secure View V1.8.0 6/2008 
2 Test Case Selection 

Not all test cases or test assertions are appropriate for all tools. In addition to the base test 

cases, each remaining test case is linked to optional tool features needed for the test case. 

If a given tool implements a given feature then the test cases linked to that feature are 

run. Table 1 lists the features available in Susteen’s Secure View and the linked test 

cases. Table 2 lists the features not available in Susteen’s Secure View and the linked test 

cases. 

Table 1 Selected Test Cases 

Supported Optional Feature Cases selected for execution 

Base Cases CFT–IM–(01–08, 10), CFT–SIM–(01– 

10) 

Acquire mobile device internal memory and 

review data via supported generated report 

formats 

CFT–IMO–01 

Acquire mobile device internal memory and 

review data containing foreign language 

characters 

CFT–IMO–09 

Acquire mobile device internal memory and 

review hash values for vendor supported data 

objects 

CFT–IMO–11 

Acquire SIM internal memory and review 

acquired data via supported generated report 

formats 

CFT–SIMO–01 

Acquire SIM internal memory and review 

reports for recoverable deleted data 

CFT–SIMO–05 

Acquire SIM internal memory and review data 

containing foreign language characters 

CFT–SIMO–07 

Begin acquisition on a PIN protected SIM to 

determine if the tool provides an accurate 

count of the remaining number of PIN 

attempts and if the PIN attempts are 

decremented when entering an incorrect value 

CFT–SIMO–08 

Begin acquisition on a SIM whose PIN 

attempts have been exhausted to determine if 

the tool provides an accurate count of the 

remaining number of PUK attempts and if the 

PUK attempts are decremented when entering 

an incorrect value. 

CFT–SIMO–09 

Acquire SIM internal memory and review the 

overall case file hash. 

CFT–SIMO–11 

October 2008 3 of 99 Results of Secure View V1.8.0 6/2008 
Table 2 Omitted Test Cases 

Unsupported Optional Feature Cases omitted (not executed) 

Acquire mobile device internal memory and 

review reported MMS multimedia related data 

(i.e., text, audio, graphics, video) 

CFT–IM–09 

Acquire mobile device internal memory and 

review reported data via the preview pane 

CFT–IMO–02 

Acquire mobile device internal memory and 

compare reported data via the preview pane and 

supported generated report formats 

CFT–IMO–03 

After a successful mobile device internal 

memory acquisition, alter the case file via third 

party means and attempt to re-open the case 

CFT–IMO–04 

Perform a physical acquisition and review data 

output for readability 

CFT–IMO–05 

Perform a physical acquisition and review 

reports for recoverable deleted data 

CFT–IMO–06 

Create a SIM access card via vendor 

documentation 

CFT–IMO–07 

Acquire mobile device internal memory and 

review generated log files 

CFT–IMO–08 

Perform a stand-alone mobile device internal 

memory acquisition and review the status flags 

for text messages present on the SIM 

CFT–IMO–10 

Acquire mobile device internal memory and 

review the overall case file hash 

CFT–IMO–12 

Acquire SIM internal memory and review 

acquired data via the preview-pane 

CFT–SIMO–02 

Acquire SIM internal memory and compare 

acquired data via the preview pane and 

supported generated reports 

CFT–SIMO–03 

After a successful SIM internal memory 

acquisition, alter the case file via third party 

means and attempt to re-open the case 

CFT–SIMO–04 

Acquire SIM internal memory and review 

generated log files 

CFT–SIMO–06 

Acquire SIM internal memory and review hash 

values for vendor supported data objects 

CFT–SIMO–10 

October 2008 4 of 99 Results of Secure View V1.8.0 6/2008 
 

3 Results by Test Assertion 

Table 3 summarizes the test results by assertion. The column labeled Assertion gives the 

text of each assertion. The column labeled Tests gives the number of test cases that use 

the given assertion. The column labeled Anomaly gives the section number in this report 

where the anomaly is discussed. 

Table 3 Assertions Tested 

Assertions Tested Tests Anomaly 

A_IM–01 If a cellular forensic tool provides support for connectivity of 

the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

9 

A_IM–02 If a cellular forensic tool attempts to connect to a nonsupported device then the tool shall have the ability to identify that the 

device is not supported. 

1 

A_IM–03 If a cellular forensic tool encounters disengagement between 

the device and application then the application shall notify the user that 

connectivity has been disrupted. 

1 

A_IM–04 If a cellular forensic tool successfully completes acquisition 

of the target device then the tool shall have the ability to present 

acquired data elements in a human-readable format via either a preview 

pane or generated report. 

7 

A_IM–05 If a cellular forensic tool successfully completes acquisition 

of the target device then subscriber related information shall be 

presented in a human-readable format without modification. 

1 3.1 

A_IM–06 If a cellular forensic tool successfully completes acquisition 

of the target device then equipment related information shall be 

presented in a human-readable format without modification. 

1 

A_IM–07 If a cellular forensic tool successfully completes acquisition 

of the target device then all known address book entries shall be 

presented in a human-readable format without modification. 

1 

A_IM–08 If a cellular forensic tool successfully completes acquisition 

of the target device then all known maximum length address book 

entries shall be presented in a human-readable format without 

modification. 

1 

A_IM–09 If a cellular forensic tool successfully completes acquisition 

of the target device then all known address book entries containing 

special characters shall be presented in a human-readable format 

without modification. 

1 

A_IM–10 If a cellular forensic tool successfully completes acquisition 

of the target device then all known address book entries containing 

blank names shall be presented in a human-readable format without 

modification. 

1 

A_IM–11 If a cellular forensic tool successfully completes acquisition 

of the target device then all known email addresses associated with 

1 

October 2008 5 of 99 Results of Secure View V1.8.0 6/2008 
address book entries shall be presented in a human-readable format 

without modification. 

A_IM–12 If a cellular forensic tool successfully completes acquisition 

of the target device then all known graphics associated with address 

book entries shall be presented in a human-readable format without 

modification. 

1 

A_IM–13 If a cellular forensic tool successfully completes acquisition 

of the target device then all known datebook, calendar, and note entries 

shall be presented in a human-readable format without modification. 

1 

A_IM–14 If a cellular forensic tool successfully completes acquisition 

of the target device then all maximum length datebook, calendar, and 

note entries shall be presented in a human readable format without 

modification. 

1 

A_IM–15 If a cellular forensic tool successfully completes acquisition 

of the target device then all call logs (incoming/outgoing) shall be 

presented in a human-readable format without modification. 

1 

A_IM–16 If a cellular forensic tool successfully completes acquisition 

of the target device then all text messages (i.e., SMS, EMS) messages 

shall be presented in a human-readable format without modification. 

1 3.2 

A_IM–20 If a cellular forensic tool successfully completes acquisition 

of the target device then all stand-alone audio files shall be playable via 

either an internal application or suggested third-party application 

without modification. 

1 

A_IM–21 If a cellular forensic tool successfully completes acquisition 

of the target device then all stand-alone image files shall be viewable via 

either an internal application or suggested third-party application 

without modification. 

1 

A_IM–22 If a cellular forensic tool successfully completes acquisition 

of the target device then all stand-alone video files shall be viewable via 

either an internal application or suggested third-party application 

without modification. 

1 

A_SIM–23 If a cellular forensic tool provides support for connectivity 

of the target SIM then the tool shall successfully recognize the target 

SIM via all vendor supported interfaces (e.g., PC/SC reader, proprietary 

reader). 

9 

A_SIM–24 If a cellular forensic tool attempts to connect to a nonsupported SIM then the tool shall have the ability to identify that the 

SIM is not supported. 

1 

A_SIM–25 If a cellular forensic tool encounters disengagement 

between the SIM reader and application then the application shall notify 

the user that connectivity has been disrupted. 

1 3.3 

A_SIM–26 If the SIM is password-protected then the cellular forensic 

tool shall provide the examiner with the opportunity to input the PIN 

before acquisition. 

1 

A_SIM–27 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the tool shall have the ability to present acquired 

6 

October 2008 6 of 99 Results of Secure View V1.8.0 6/2008 
data in a human-readable format via either preview pane or generated 

report. 

A_SIM–28 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the SPN shall be presented in a human-readable 

format without modification. 

1 3.4 

A_SIM–29 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the ICCID shall be presented in a human-readable 

format without modification. 

1 

A_SIM–30 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the IMSI shall be presented in a human-readable 

format without modification. 

1 

A_SIM–31 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the MSISDN shall be presented in a humanreadable format without modification. 

1 

A_SIM–32 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all Abbreviated Dialing Numbers (ADN) shall be 

presented in a human-readable format without modification. 

1 

A_SIM–33 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all Last Numbers Dialed (LND) shall be 

presented in a human-readable format without modification. 

1 

A_SIM–34 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all SMS text messages shall be presented in a 

human-readable format without modification. 

1 

A_SIM–35 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all EMS text messages shall be presented in a 

human-readable format without modification. 

1 3.2 

A_SIM–36 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all location related data (i.e., LOCI) shall be 

presented in a human-readable format without modification. 

1 

A_SIM–37 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all location related data (i.e., GRPSLOCI) shall 

be presented in a human-readable format without modification. 

1 

A_IMO–38 If a cellular forensic tool successfully completes acquisition 

of the target device then the tool shall present the acquired data without 

modification via supported generated report formats. 

8 

A_IMO–39 If a cellular forensic tool successfully completes acquisition 

of the target device then the tool shall present the acquired data without 

modification in a preview-pane view. 

8 

A_IMO–53 If the cellular forensic tool supports proper display of 

foreign language character sets then the application should present 

address book entries containing foreign language characters in their 

native format without modification. 

1 3.5 

A_IMO–54 If the cellular forensic tool supports proper display of 

foreign language character sets then the application should present text 

messages containing foreign language characters in their native format 

without modification. 

1 3.5 

October 2008 7 of 99 Results of Secure View V1.8.0 6/2008 
A_IMO–56 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

1 

A_SIMO–58 If a cellular forensic tool successfully completes 

acquisition of the target media (i.e., SIM) then the tool shall present the 

acquired data in a human-readable format without modification via 

supported generated report formats. 

6 3.6 

A_SIMO–59 If a cellular forensic tool successfully completes 

acquisition of the SIM then the tool shall present the acquired data in a 

human-readable format without modification in a preview-pane view. 

6 

A_SIMO–60 If a cellular forensic tool provides a preview-pane view 

and a generated report of the acquired data then the reports shall 

maintain consistency of all reported data elements. 

1 

A_SIMO–61 If modification is attempted to the case file or individual 

data elements via third-party means then the tool shall provide 

protection mechanisms disallowing or reporting data modification. 

1 

A_SIMO–62 If the cellular forensic tool successfully completes 

acquisition of the target SIM and recoverable deleted SMS messages 

exist then the tool shall present recoverable deleted data in a humanreadable format without modification. 

1 

A_SIMO–63 If the cellular forensic tool successfully completes 

acquisition of the target SIM and recoverable deleted EMS messages 

exist then the tool shall present recoverable deleted data in a humanreadable format without modification. 

1 3.2 

A_SIMO–65 If the cellular forensic tool supports proper display of 

foreign language character sets then the application should present 

abbreviated dialing numbers (ADNs) containing foreign language 

characters in their native format without modification. 

1 

A_SIMO–66 If the cellular forensic tool supports proper display of 

foreign language character sets then the application should present text 

messages containing foreign language characters in their native format 

without modification. 

1 

A_SIMO–67 If a cellular forensic tool provides the examiner with the 

remaining number of authentication attempts then the application should 

provide an accurate count of the remaining PIN attempts. 

1 

A_SIMO–68 If a cellular forensic tool provides the examiner with the 

remaining number of PUK attempts then the application should provide 

an accurate count of the remaining PUK attempts. 

1 

A_SIMO–70 If the cellular forensic tool supports hashing for the 

overall case file then the tool shall present the user with one hash value 

representative of the entire case data. 

1 

October 2008 8 of 99 Results of Secure View V1.8.0 6/2008 
Table 4 lists the assertions that were not tested, usually due to the tool not supporting an 

optional feature. 

Table 4 Assertions Not Tested 

Assertions not Tested 

A_IM–17 If a cellular forensic tool successfully completes acquisition of the target 

device then all MMS messages and associated audio shall be presented properly without 

modification. 

A_IM–18 If a cellular forensic tool successfully completes acquisition of the target 

device then all MMS messages and associated images shall be presented properly without 

modification. 

A_IM–19 If a cellular forensic tool successfully completes acquisition of the target 

device then all MMS messages and associated video shall be presented properly without 

modification. 

A_IMO–40 If a cellular forensic tool provides a preview-pane view and a generated 

report of the acquired data then the reports shall maintain consistency of all reported data 

elements. 

A_IMO–41 If modification is attempted to the case file or individual data elements via 

third-party means then the tool shall provide protection mechanisms disallowing or 

reporting data modification. 

A_IMO–42 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall successfully complete the acquisition and present the data in a 

human-readable format. 

A_IMO–43 If the cellular forensic tool supports a physical acquisition of address book 

entries present on the target device then the tool shall report recoverable deleted data or 

address book data remnants in a human-readable format. 

A_IMO–44 If the cellular forensic tool supports a physical acquisition of calendar, tasks, 

or notes present on the target device then the tool shall report recoverable deleted 

calendar, tasks, or note data remnants in a human-readable format. 

A_IMO–45 If the cellular forensic tool supports a physical acquisition of call logs 

present on the target device then the tool shall report recoverable deleted call or call log 

data remnants in a human-readable format. 

A_IMO–46 If the cellular forensic tool supports a physical acquisition of SMS messages 

present on the target device then the tool shall report recoverable deleted SMS messages 

or SMS message data remnants in a human-readable format. 

A_IMO–47 If the cellular forensic tool supports a physical acquisition of EMS messages 

present on the target device then the tool shall report recoverable deleted EMS messages 

or EMS message data remnants in a human-readable format. 

A_IMO–48 If the cellular forensic tool supports a physical acquisition of audio files 

present on the target device then the tool shall report recoverable deleted audio data or 

audio file data remnants in a human-readable format. 

A_IMO–49 If the cellular forensic tool supports a physical acquisition of graphic files 

present on the target device then the tool shall report recoverable deleted graphic file data 

or graphic file data remnants in a human-readable format. 

A_IMO–50 If the cellular forensic tool supports a physical acquisition of video files 

October 2008 9 of 99 Results of Secure View V1.8.0 6/2008 
present on the target device then the tool shall report recoverable deleted video file data 

or video file data remnants in a human-readable format. 

A_IMO–51 If the cellular forensic tool supports SIM access card creation then the card 

creation shall be completed without errors via manufacturer suggested protocols. 

A_IMO–52 If the cellular forensic tool supports log creation then the application should 

present the log files outlining the acquisition process in a human-readable format. 

A_IMO–55 If the cellular forensic tool supports stand-alone acquisition of internal 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

A_IMO–57 If the cellular forensic tool supports hashing the overall case file then the 

tool shall present the user with one hash value representing the entire case data. 

A_SIMO–60 If a cellular forensic tool provides a preview-pane view and a generated 

report of the acquired data then the reports shall maintain consistency of all reported data 

elements. 

A_SIMO–61 If modification is attempted to the case file or individual data elements via 

third-party means then the tool shall provide protection mechanisms disallowing or 

reporting data modification. 

A_SIMO–64 If a cellular forensic tool supports the creation of log files then the 

application should present the log files in a human-readable format outlining the 

acquisition process. 

A_SIMO–69 If the cellular forensic tool supports hashing for individual data objects then 

the tool shall present the user with a hash value for each supported data object 

3.1 Acquisition of MSISDN 

Secure View does not report the MSISDN when performing an internal memory 

acquisition on the Nokia 6101. However, the MSISDN is acquired and reported when 

performing an internal memory acquisition on the Motorola RAZR V3. 

3.2 EMS Messages 

EMS messages (i.e., messages over 160 characters) present on the internal memory of the 

Nokia 6101 and Motorola RAZR V3 were truncated and a maximum of 160 characters 

were reported. 

EMS messages present on the internal memory of the AT&T SIM where messages 

contained a status of UNREAD and DELETED were partially acquired but not properly 

presented i.e., the data reported was not consistent with the predefined dataset. The 

reported characters were random ASCII characters and symbols. 

3.3 Connectivity Disruption 

When disengaging the Subscriber Identity Module (SIM) from the USB reader during an 

acquisition, Secure View does not provide the examiner with a warning message of 

media connectivity issues. The acquisition finishes normally displaying data acquired up 

to the point of media disruption. 

October 2008 10 of 99 Results of Secure View V1.8.0 6/2008 
3.4 Subscriber Information 

The Service Provider Name (SPN) present on both the T-Mobile and AT&T SIM was not 

acquired or reported. 

3.5 Foreign Character Display 

Contacts containing foreign characters (i.e., Chinese) residing on the device internal 

memory of both the Nokia 6101 and Motorola RAZR V3 were not displayed. 

Text messages residing on the internal memory of the Nokia 6101 containing foreign 

characters (i.e., French, Chinese) were partially acquired but not properly displayed. 

Text messages residing on the internal memory of the Motorola RAZR V3 containing 

foreign characters (i.e., French) were partially acquired but not properly displayed. 

Chinese text messages on the Motorola RAZR V3 were not displayed (i.e., the textual 

portion was blank). 

Note: All supporting fonts and language packs are installed. SIM acquisitions displayed 

foreign characters without error. 

3.6 Acquisition Reports 

Complete representation of known data present on the AT&T SIM via Secure View’s 

generated reports was unsuccessful in presenting a consistent report with the known 

dataset for UNREAD and DELETED EMS messages. 

October 2008 11 of 99 Results of Secure View V1.8.0 6/2008 
4 Testing Environment 

The tests were run in the NIST CFTT lab. This section describes the test computers 

available for testing. 

4.1 Test Computers 

One test computers was used. 

Morrisy has the following configuration: 

Intel® D975XBX2 Motherboard 

BIOS Version BX97520J.86A.2674.2007.0315.1546 

Intel® CoreTM2 Duo CPU 6700 @ 2.66Ghz 

3.25 GB RAM 

1.44 MB floppy drive 

LITE-ON CD H LH52N1P 

LITE-ON DVDRW LH–20A1P 

2 slots for removable SATA hard disk drive 

8 USB 2.0 slots 

2 IEEE 1394 ports 

3 IEEE 1394 ports (mini) 

October 2008 12 of 99 Results of Secure View V1.8.0 6/2008 
5 Test Results 

The main item of interest for interpreting the test results is determining the conformance 

of the device with the test assertions. Conformance with each assertion tested by a given 

test case is evaluated by examining Log File Highlights box of the test report summary. 

5.1 Test Results Report Key 

A summary of the actual test results is presented in this report. The following table 

presents a description of each section of the test report summary. 

Table 5 Test Results Report Key 

Heading Description 

First Line: Test case ID, name, and version of tool tested. 

Case Summary: Test case summary from GSM Mobile Device and 

Associated Media Tool Specification and Test Plan Version 

1.1. 

Assertions: The test assertions applicable to the test case, selected from 

GSM Mobile Device and Associated Media Tool 

Specification and Test Plan Version 1.1. 

Tester Name: Name or initials of person executing test procedure. 

Test Host: Host computer executing the test. 

Test Date: Time and date that test was started. 

Device: Source mobile device, media (i.e., SIM). 

Source Setup: Outline of data object types populated on the device or 

associated media (i.e., SIM). 

Log Highlights: Information extracted from various log files to illustrate 

conformance or non-conformance to the test assertions. 

Results Expected and actual results for each assertion tested. 

Analysis Whether or not the expected results were achieved. 

October 2008 13 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2 Test Details 

5.2.1 CFT-IM-01 (Nokia 6101) 

Test Case CFT-IM-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IM-01 Acquire mobile device internal memory over supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu May 22 13:15:58 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: USB, IrDA

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 14 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IM-01 Susteen Secure View Version 1.8.0 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Thu May 22 13:15:58 EDT 2008

Acquisition finished: Thu May 22 13:46:30 EDT 2008 

Device connectivity was established via supported (i.e., cable) interface 

Notes: 

IrDA acquisition not supported. 

Results: 

Assertion & Expected Result Actual Result 

A_IM-01 Device connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 15 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.2 CFT-IM-02 (Nokia 6101) 

Test Case CFT-IM-02 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IM-02 Attempt internal memory acquisition of a non-supported mobile

device. 

Assertions: A_IM-02 If a cellular forensic tool attempts to connect to a non-supported

device then the tool shall have the ability to identify that the device is

not supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri May 23 08:45:06 EDT 2008

Device: non-supported mobile device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0 

October 2008 16 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IM-02 Susteen Secure View Version 1.8.0 

Highlights: Acquisition started: Fri May 23 08:45:06 EDT 2008

Acquisition finished: Fri May 23 08:46:29 EDT 2008 

Identification of non-supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

A_IM-02 Identification of non-supported devices. as expected 

Analysis: Expected results achieved 

October 2008 17 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.3 CFT-IM-03 (Nokia 6101) 

Test Case CFT-IM-03 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IM-03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-03 If a cellular forensic tool encounters disengagement between the

device and application then the application shall notify the user that

connectivity has been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri May 23 08:48:56 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 18 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IM-03 Susteen Secure View Version 1.8.0 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Fri May 23 08:48:56 EDT 2008

Acquisition finished: Fri May 23 08:51:26 EDT 2008 

Device connectivity was established via supported interface

Device acquisition disruption notification was successful 

Notes: 

Connectivity Error Message Displayed: Communication Error. 

Results: 

Assertion & Expected Result Actual Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-03 Notification of device acquisition disruption. as expected 

Analysis: Expected results achieved 

October 2008 19 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

5.2.4 CFT-IM-04 (Nokia 6101) 

Test Case CFT-IM-04 Susteen Secure View Version 1.8.0 

Case CFT-IM-04 Acquire mobile device internal memory and review reported data

Summary: via the preview-pane or generated reports for readability.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 09:23:35 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 20 of 99 Results of Secure View V1.8.0 6/2008 
 

 

Test Case CFT-IM-04 Susteen Secure View Version 1.8.0 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Fri May 23 09:23:35 EDT 2008

Acquisition finished: Fri May 23 09:32:47 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result 

A_IM-01 Device connectivity via supported interfaces.

A_IM-04 Readability and completeness of acquired data via

supported reports. 

Actual 

Result 

as expected

as expected 

Analysis: Expected results achieved 

October 2008 21 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.5 CFT-IM-05 (Nokia 6101) 

Test Case CFT-IM-05 Susteen Secure View Version 1.8.0 

Case CFT-IM-05 Acquire mobile device internal memory and review reported

Summary: subscriber and equipment related information (i.e., IMEI, MSISDN).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-05 If a cellular forensic tool successfully completes acquisition of

the target device then subscriber related information shall be presented in

a human-readable format without modification. 

A_IM-06 If a cellular forensic tool successfully completes acquisition of

the target device then equipment related information shall be presented in

a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 09:33:46 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

October 2008 22 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IM-05 Susteen Secure View Version 1.8.0 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Fri May 23 09:33:46 EDT 2008

Acquisition finished: Fri May 23 09:41:01 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

MSISDN was not acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-05 Acquisition of MSISDN. Not as 

expected

A_IM-06 Acquisition of IMEI. as expected 

Analysis: Partial expected results achieved 

October 2008 23 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.6 CFT-IM-06 (Nokia 6101) 

Test Case CFT-IM-06 Susteen Secure View Version 1.8.0 

Case CFT-IM-06 Acquire mobile device internal memory and review reported PIM

Summary: related data. 

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-07 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries shall be presented in

a human-readable format without modification. 

A_IM-08 If a cellular forensic tool successfully completes acquisition of

the target device then all known maximum length address book entries shall

be presented in a human-readable format without modification.

A_IM-09 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing special

characters shall be presented in a human-readable format without

modification. 

A_IM-10 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing blank

names shall be presented in a human-readable format without modification.

A_IM-11 If a cellular forensic tool successfully completes acquisition of

the target device then all known email addresses associated with address

book entries shall be presented in a human-readable format without

modification. 

A_IM-12 If a cellular forensic tool successfully completes acquisition of

the target device then all known graphics associated with address book

entries shall be presented in a human-readable format without modification.

A_IM-13 If a cellular forensic tool successfully completes acquisition of

the target device then all known datebook, calendar, note entries shall be

presented in a human-readable format without modification.

A_IM-14 If a cellular forensic tool successfully completes acquisition of

the target device then all maximum length datebook, calendar, note entries

shall be presented in a human readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 09:43:07 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

October 2008 24 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IM-06 Susteen Secure View Version 1.8.0 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Fri May 23 09:43:07 EDT 2008

Acquisition finished: Fri May 23 09:49:24 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All address book entries were successfully acquired

ALL PIM related data was acquired 

Results: 

Analysis: Expected results achieved 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-07 Acquisition of address book entries. as expected

A_IM-08 Acquisition of maximum length address book

entries. 

as expected 

A_IM-09 Acquisition of address book entries containing

special characters. 

as expected 

A_IM-10 Acquisition of address book entries containing a

blank name entry. 

as expected 

A_IM-11 Acquisition of embedded email addresses within

address book entries. 

as expected 

A_IM-12 Acquisition of embedded graphics within address

book entries. 

as expected 

A_IM-13 Acquisition of PIM data (i.e., datebook/calendar,

notes). 

as expected 

A_IM-14 Acquisition of maximum length PIM data. as expected 

October 2008 25 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.7 CFT-IM-07 (Nokia 6101) 

Test Case CFT-IM-07 Susteen Secure View Version 1.8.0 

Case CFT-IM-07 Acquire mobile device internal memory and review reported call

Summary: logs.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-15 If a cellular forensic tool successfully completes acquisition of

the target device then all call logs (incoming/outgoing) shall be presented

in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 09:52:14 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 26 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

Test Case CFT-IM-07 Susteen Secure View Version 1.8.0 

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Fri May 23 09:52:14 EDT 2008

Acquisition finished: Fri May 23 09:55:59 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All Call Logs (incoming, outgoing) were acquired 

Results: 

Analysis: Expected results achieved 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-15 Acquisition of call logs. as expected 

October 2008 27 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.8 CFT-IM-08 (Nokia 6101) 

Test Case CFT-IM-08 Susteen Secure View Version 1.8.0 

Case CFT-IM-08 Acquire mobile device internal memory and review reported text

Summary: messages.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-16 If a cellular forensic tool successfully completes acquisition of

the target device then all text messages (i.e., SMS, EMS) messages shall be

presented in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 09:56:34 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 28 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

Test Case CFT-IM-08 Susteen Secure View Version 1.8.0 

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Fri May 23 09:56:34 EDT 2008

Acquisition finished: Fri May 23 10:02:45 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

Partial Text messages were acquired 

Notes: 

The first 160 characters of EMS messages are only reported.

Text messages that contain foreign language characters are not reported or

displayed in their native language format. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-16 Acquisition of text messages. Partial 

Analysis: Partial expected results achieved 

October 2008 29 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.9 CFT-IM-10 (Nokia 6101) 

Test Case CFT-IM-10 Susteen Secure View Version 1.8.0 

Case CFT-IM-10 Acquire mobile device internal memory and review reported standSummary: alone multi-media data (i.e., audio, graphics, video).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-20 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone audio files shall be playable via

either an internal application or suggested third-party application without

modification. 

A_IM-21 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone image files shall be viewable via

either an internal application or suggested third-party application without

modification. 

A_IM-22 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone video files shall be viewable via

either an internal application or suggested third-party application without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 10:08:11 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio 

October 2008 30 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IM-10 Susteen Secure View Version 1.8.0 

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Fri May 23 10:08:11 EDT 2008

Acquisition finished: Fri May 23 10:12:01 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL stand-alone data files (Audio, Image, Video) were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-20 Acquisition of stand-alone audio files. as expected

A_IM-21 Acquisition of stand-alone graphic files. as expected

A_IM-22 Acquisition of stand-alone video files. as expected 

Analysis: Expected results achieved 

October 2008 31 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.10 CFT-IMO-01 (Nokia 6101) 

Test Case CFT-IMO-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IMO-01 Acquire mobile device internal memory and review reported data

via supported generated report formats.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri May 23 10:13:17 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0 

October 2008 32 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IMO-01 Susteen Secure View Version 1.8.0 

Highlights: Acquisition started: Fri May 23 10:13:17 EDT 2008

Acquisition finished: Fri May 23 10:24:28 EDT 2008

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 33 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.11 CFT-IMO-09 (Nokia 6101) 

Test Case CFT-IMO-09 Susteen Secure View Version 1.8.0 

Case CFT-IMO-09 Acquire mobile device internal memory and review data containing

Summary: foreign language characters.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-53 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present address book

entries containing foreign language characters in their native format

without modification. 

A_IMO-54 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present text messages

containing foreign language characters in their native format without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri May 23 10:25:00 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video 

October 2008 34 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IMO-09 Susteen Secure View Version 1.8.0 

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Fri May 23 10:25:00 EDT 2008

Acquisition finished: Fri May 23 10:35:22 EDT 2008 

Complete representation of known data via generated reports was successful

Partial foreign character Address book entries were acquired

Partial foreign character text messages were acquired but not properly

displayed 

Notes: 

Contacts containing foreign characters (i.e., Chinese) were not displayed.

Text messages containing foreign characters (i.e., French, Chinese) were

partially acquired but not properly displayed. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-53 Acquisition of address book entries containing

foreign language characters. 

Partial 

A_IMO-54 Acquisition of outgoing text messages containing

foreign language characters. 

Not as 

expected 

Analysis: Expected results Not achieved 

October 2008 35 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

5.2.12 CFT-IMO-11 (Nokia 6101) 

Test Case CFT-IMO-11 Susteen Secure View Version 1.8.0 

Case CFT-IMO-11 Acquire mobile device internal memory and review hash values for

Summary: vendor supported data objects.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-56 If the cellular forensic tool supports hashing for individual data

objects then the tool shall present the user with a hash value for each

supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri May 23 10:57:18 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 36 of 99 Results of Secure View V1.8.0 6/2008 
 

 

Test Case CFT-IMO-11 Susteen Secure View Version 1.8.0 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Fri May 23 10:57:18 EDT 2008

Acquisition finished: Fri May 23 11:03:00 EDT 2008

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Device hash reporting for individual acquired data elements was successful 

Notes: 

MD5 hashes supported for individually acquired files (e.g., Images, Video,

Music, Ringtones, etc.) 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-56 Device hash reporting for individual acquired

data objects. 

as expected 

Analysis: Expected results achieved 

October 2008 37 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.13 CFT-SIM-01 (T-Mobile SIM) 

Test Case CFT-SIM-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-01 Acquire SIM over supported interfaces (e.g., PC/SC reader,

proprietary reader).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 08:38:54 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 08:38:54 EDT 2008

Acquisition finished: Tue May 20 08:48:10 EDT 2008 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 38 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.14 CFT-SIM-02 (T-Mobile SIM) 

Test Case CFT-SIM-02 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-02 Attempt acquisition of a non-supported SIM. 

Assertions: A_SIM-24 If a cellular forensic tool attempts to connect to a non-supported

SIM then the tool shall have the ability to identify that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 08:49:48 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 08:49:48 EDT 2008

Acquisition finished: Tue May 20 08:50:34 EDT 2008 

Identification of non-supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-24 Identification of non-supported SIMs. as expected 

Analysis: Expected results achieved 

October 2008 39 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.15 CFT-SIM-03 (T-Mobile SIM) 

Test Case CFT-SIM-03 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-03 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-25 If a cellular forensic tool encounters disengagement between the

SIM reader and application then the application shall notify the user that

connectivity has been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 08:51:37 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 08:51:37 EDT 2008

Acquisition finished: Tue May 20 08:53:38 EDT 2008

Media connectivity was established via supported interface

Media acquisition disruption notification was not successful 

Notes: 

No warning messages are displayed to the examiner of media connectivity

issues. The acquisition finishes normally displaying data acquired up to

the point of media disruption. 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-25 Notification of SIM acquisition disruption. Not as expected 

Analysis: Expected results Not achieved 

October 2008 40 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.16 CFT-SIM-04 (T-Mobile SIM) 

Test Case CFT-SIM-04 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-04 Attempt acquisition on a password-protected SIM. 

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-26 If the SIM is password-protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 09:40:39 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 09:40:39 EDT 2008

Acquisition finished: Tue May 20 09:50:16 EDT 2008 

Media connectivity was established via supported interface

Ability to enter PIN on protected media before acquisition was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-26 Password entry before acquisition for protected

SIMs. 

as expected 

Analysis: Expected results achieved 

October 2008 41 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.17 CFT-SIM-05 (T-Mobile SIM) 

Test Case CFT-SIM-05 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-05 Acquire SIM internal memory and review reported data via the

preview-pane or generated reports for readability.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 09:51:33 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 09:51:33 EDT 2008

Acquisition finished: Tue May 20 10:00:15 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

Analysis: Expected results achieved 

October 2008 42 of 99 Results of Secure View V1.8.0 6/2008 
 

5.2.18 CFT-SIM-06 (T-Mobile SIM) 

Test Case CFT-SIM-06 Susteen Secure View Version 1.8.0 

Case CFT-SIM-06 Acquire SIM internal memory and review reported subscriber and

Summary: equipment related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-28 If a cellular forensic tool successfully completes acquisition of

the target SIM then the SPN shall be presented in a human-readable format

without modification. 

A_SIM-29 If a cellular forensic tool successfully completes acquisition of

the target SIM then the ICCID shall be presented in a human-readable format

without modification. 

A_SIM-30 If a cellular forensic tool successfully completes acquisition of

the target SIM then the IMSI shall be presented in a human-readable format

without modification. 

A_SIM-31 If a cellular forensic tool successfully completes acquisition of

the target SIM then the MSISDN shall be presented in a human-readable

format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 10:10:51 EDT 2008

Device: TMOBILE_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Tue May 20 10:10:51 EDT 2008

Acquisition finished: Tue May 20 10:16:43 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

SPN was not acquired

ICCID was acquired

IMSI was acquired

MSISDN was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via as expected

supported reports. 

October 2008 43 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-SIM-06 Susteen Secure View Version 1.8.0 

A_SIM-28 Acquisition of SPN. Not as 

expected

A_SIM-29 Acquisition of ICCID. as expected

A_SIM-30 Acquisition of IMSI. as expected

A_SIM-31 Acquisition of MSISDN. as expected 

Analysis: Partial expected results achieved 

October 2008 44 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.19 CFT-SIM-07 (T-Mobile SIM) 

Test Case CFT-SIM-07 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-07 Acquire SIM internal memory and review reported Abbreviated

Dialing Numbers (ADN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-32 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Abbreviated Dialing Numbers (ADN) shall be

presented in a human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 10:26:55 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 10:26:55 EDT 2008

Acquisition finished: Tue May 20 10:38:54 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

All ADNs were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-32 Acquisition of ADNs. as expected 

Analysis: Expected results achieved 

October 2008 45 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.20 CFT-SIM-08 (T-Mobile SIM) 

Test Case CFT-SIM-08 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-08 Acquire SIM internal memory and review reported Last Numbers

Dialed (LND).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-33 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Last Numbers Dialed (LND) shall be presented in a

human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 11:55:14 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 11:55:14 EDT 2008

Acquisition finished: Tue May 20 12:02:21 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

LNDs were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-33 Acquisition of LNDs. as expected 

Analysis: Expected results achieved 

October 2008 46 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.21 CFT-SIM-09 (T-Mobile SIM) 

Test Case CFT-SIM-09 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-09 Acquire SIM internal memory and review reported text messages

(i.e., SMS, EMS).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-34 If a cellular forensic tool successfully completes acquisition of

the target SIM then all SMS text messages shall be presented in a humanreadable format without modification. 

A_SIM-35 If a cellular forensic tool successfully completes acquisition of

the target SIM then all EMS text messages shall be presented in a humanreadable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 12:03:26 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 12:03:26 EDT 2008

Acquisition finished: Tue May 20 12:08:54 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL text messages (SMS, EMS) were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-34 Acquisition of SMS messages. as expected

A_SIM-35 Acquisition of EMS messages. as expected 

Analysis: Expected results achieved 

October 2008 47 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.22 CFT-SIM-10 (T-Mobile SIM) 

Test Case CFT-SIM-10 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-10 Acquire SIM internal memory and review reported location related

data (i.e., LOCI, GPRSLOCI).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-36 If a cellular forensic tool successfully completes acquisition of

the target SIM then all location related data (i.e., LOCI) shall be

presented in a human-readable format without modification.

A_SIM-37 If a cellular forensic tool successfully completes acquisition of

the target SIM then all location related data (i.e., GRPSLOCI) shall be

presented in a human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 12:30:54 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 12:30:54 EDT 2008

Acquisition finished: Tue May 20 12:45:45 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

LOCI data was acquired

GPRSLOCI data was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-36 Acquisition of LOCI information. as expected

A_SIM-37 Acquisition of GPRSLOCI information. as expected 

Analysis: Expected results achieved 

October 2008 48 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.23 CFT-SIMO-01 (T-Mobile SIM) 

Test Case CFT-SIMO-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-01 Acquire SIM internal memory and review acquired data via

suported generated report formats.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 10:30:34 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 10:30:34 EDT 2008

Acquisition finished: Wed May 21 10:36:58 EDT 2008 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 49 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.24 CFT-SIMO-05 (T-Mobile SIM) 

Test Case CFT-SIMO-05 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-05 Acquire SIM internal memory and review reports for recoverable

deleted data. 

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-62 If the cellular forensic tool successfully completes acquisition

of the target SIM and recoverable deleted SMS messages exist then the tool

shall present recoverable deleted data in a human-readable format without

modification. 

A_SIMO-63 If the cellular forensic tool successfully completes acquisition

of the target SIM and recoverable deleted EMS messages exist then the tool

shall present recoverable deleted data in a human-readable format without

modification. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 10:38:52 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 10:38:52 EDT 2008

Acquisition finished: Wed May 21 10:46:02 EDT 2008 

Complete representation of known data via generated reports was successful

Deleted SMS data was recovered 

Deleted EMS data was recovered 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-62 Recovery of deleted SMS messages. as expected

A_SIMO-63 Recovery of deleted EMS messages. as expected 

Analysis: Expected results achieved 

October 2008 50 of 99 Results of Secure View V1.8.0 6/2008 
 

5.2.25 CFT-SIMO-07 (T-Mobile SIM) 

Test Case CFT-SIMO-07 Susteen Secure View Version 1.8.0 

Case CFT-SIMO-07 Acquire SIM internal memory and review data containing foreign

Summary: language characters.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-65 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present abbreviated

dialing numbers (ADN) containing foreign language characters in their

native format without modification. 

A_SIMO-66 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present text messages

containing foreign language characters in their native format without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Wed May 21 10:48:09 EDT 2008

Device: TMOBILE_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Wed May 21 10:48:09 EDT 2008

Acquisition finished: Wed May 21 10:55:12 EDT 2008 

Complete representation of known data via generated reports was successful

ADNs containing foreign characters were acquired and properly displayed

Text messages containing foreign characters were acquired and properly

displayed 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via as expected

generated reports.

A_SIMO-59 Comparison of known SIM data elements via as expected

preview-pane.

A_SIMO-65 Acquisition of ADNs containing foreign language as expected

characters. 

A_SIMO-66 Acquisition of text messages containing foreign as expected

language characters. 

October 2008 51 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-SIMO-07 Susteen Secure View Version 1.8.0 

Analysis: Expected results achieved 

October 2008 52 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.26 CFT-SIMO-08 (T-Mobile SIM) 

Test Case CFT-SIMO-08 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-08 Begin acquisition on a PIN protected SIM to determine if the

tool provides an accurate count of the remaining number of PIN attempts and

if the PIN attempts are decremented when entering an incorrect value.

Assertions: A_SIMO-67 If a cellular forensic tool provides the examiner with the

remaining number of authentication attempts then the application should

provide an accurate count of the remaining PIN attempts. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed May 21 11:05:54 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 11:05:54 EDT 2008

Acquisition finished: Wed May 21 11:06:56 EDT 2008 

Remaining number of PIN attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-67 Display of remaining number of PIN attempts. as expected 

Analysis: Expected results achieved 

October 2008 53 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.27 CFT-SIMO-09 (T-Mobile SIM) 

Test Case CFT-SIMO-09 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-09 Begin acquisition on a SIM whose PIN attempts have been

exhausted to determine if the tool provides an accurate count of the

remaining number of PUK attempts and if the PUK attempts are decremented

when entering an incorrect value.

Assertions: A_SIMO-68 If a cellular forensic tool provides the examiner with the

remaining number of PUK attempts then the application should provide an

accurate count of the remaining PUK attempts. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 11:08:19 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 11:08:19 EDT 2008

Acquisition finished: Wed May 21 11:09:43 EDT 2008 

Remaining number of PUK attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-68 Display of remaining number of PUK attempts. as expected 

Analysis: Expected results achieved 

October 2008 54 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.28 CFT-SIMO-11 (T-Mobile SIM) 

Test Case CFT-SIMO-11 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-11 Acquire SIM internal memory and review the overall case file

hash. 

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-70 If the cellular forensic tool supports hashing for the overall

case file then the tool shall present the user with one hash value

representative of the entire case data. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 11:10:42 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 11:10:42 EDT 2008

Acquisition finished: Wed May 21 11:16:15 EDT 2008 

Complete representation of known data via generated reports was successful

Device hash reporting for overall case file was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-70 SIM hash reporting for overall case file. as expected 

Analysis: Expected results achieved 

October 2008 55 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.29 CFT-IM-01 (Motorola RAZR V3) 

Test Case CFT-IM-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IM-01 Acquire mobile device internal memory over supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed May 21 14:38:13 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0 

October 2008 56 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IM-01 Susteen Secure View Version 1.8.0 

Highlights: Acquisition started: Wed May 21 14:38:13 EDT 2008

Acquisition finished: Wed May 21 14:46:28 EDT 2008 

Device connectivity was established via supported interface 

Notes: 

IrDA acquisition not supported.

Bluetooth acquisition successful. 

Results: 

Assertion & Expected Result Actual Result 

A_IM-01 Device connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 57 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.30 CFT-IM-02 (Motorola RAZR V3) 

Test Case CFT-IM-02 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IM-02 Attempt internal memory acquisition of a non-supported mobile

device. 

Assertions: A_IM-02 If a cellular forensic tool attempts to connect to a non-supported

device then the tool shall have the ability to identify that the device is

not supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed May 21 15:04:00 EDT 2008

Device: non-supported mobile device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0 

October 2008 58 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IM-02 Susteen Secure View Version 1.8.0 

Highlights: Acquisition started: Wed May 21 15:04:00 EDT 2008

Acquisition finished: Wed May 21 15:06:09 EDT 2008 

Identification of non-supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

A_IM-02 Identification of non-supported devices. as expected 

Analysis: Expected results achieved 

October 2008 59 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.31 CFT-IM-03 (Motorola RAZR V3) 

Test Case CFT-IM-03 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IM-03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-03 If a cellular forensic tool encounters disengagement between the

device and application then the application shall notify the user that

connectivity has been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed May 21 15:06:53 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 60 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IM-03 Susteen Secure View Version 1.8.0 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 15:06:53 EDT 2008

Acquisition finished: Wed May 21 15:08:09 EDT 2008 

Device connectivity was established via supported interface

Device acquisition disruption notification was successful 

Notes: 

Connectivity Error Message Displayed: There was an error communicating with

your phone while reading the list of files from it. Please re-start your

phone and then redetect your phone and try this option once again. 

Results: 

Assertion & Expected Result Actual Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-03 Notification of device acquisition disruption. as expected 

Analysis: Expected results achieved 

October 2008 61 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

5.2.32 CFT-IM-04 (Motorola RAZR V3) 

Test Case CFT-IM-04 Susteen Secure View Version 1.8.0 

Case CFT-IM-04 Acquire mobile device internal memory and review reported data

Summary: via the preview-pane or generated reports for readability.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Wed May 21 15:10:33 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 62 of 99 Results of Secure View V1.8.0 6/2008 
 

 

Test Case CFT-IM-04 Susteen Secure View Version 1.8.0 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 15:10:33 EDT 2008

Acquisition finished: Wed May 21 15:15:58 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

Analysis: Expected results achieved 

October 2008 63 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.33 CFT-IM-05 (Motorola RAZR V3) 

Test Case CFT-IM-05 Susteen Secure View Version 1.8.0 

Stand-alone data files 

Case 

Summary:

Assertions: 

CFT-IM-05 Acquire mobile device internal memory and review reported

subscriber and equipment related information (i.e., IMEI, MSISDN).

A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-05 If a cellular forensic tool successfully completes acquisition of

the target device then subscriber related information shall be presented in

a human-readable format without modification. 

A_IM-06 If a cellular forensic tool successfully completes acquisition of

the target device then equipment related information shall be presented in

a human-readable format without modification. 

Tester 

Name: 

rpa 

Test Host: 

Test Date: 

Device: 

Morrisy

Wed May 21 15:17:48 EDT 2008

Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

PIM Data 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry 

Call Logs 

Maximum Length

Regular Length

Deleted Entry

Special Character 

Missed 

Missed - Deleted 

Text Messages 

MMS Messages 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video 

October 2008 64 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IM-05 Susteen Secure View Version 1.8.0 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 15:17:48 EDT 2008

Acquisition finished: Wed May 21 15:22:38 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

Subscriber and Equipment related data (i.e., MSISDN, IMEI) were acquired 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-05 Acquisition of MSISDN. as expected

A_IM-06 Acquisition of IMEI. as expected 

Analysis: Expected results achieved 

October 2008 65 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.34 CFT-IM-06 (Motorola RAZR V3) 

Test Case CFT-IM-06 Susteen Secure View Version 1.8.0 

Case CFT-IM-06 Acquire mobile device internal memory and review reported PIM

Summary: related data. 

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-07 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries shall be presented in

a human-readable format without modification. 

A_IM-08 If a cellular forensic tool successfully completes acquisition of

the target device then all known maximum length address book entries shall

be presented in a human-readable format without modification.

A_IM-09 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing special

characters shall be presented in a human-readable format without

modification. 

A_IM-10 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing blank

names shall be presented in a human-readable format without modification.

A_IM-11 If a cellular forensic tool successfully completes acquisition of

the target device then all known email addresses associated with address

book entries shall be presented in a human-readable format without

modification. 

A_IM-12 If a cellular forensic tool successfully completes acquisition of

the target device then all known graphics associated with address book

entries shall be presented in a human-readable format without modification.

A_IM-13 If a cellular forensic tool successfully completes acquisition of

the target device then all known datebook, calendar, note entries shall be

presented in a human-readable format without modification.

A_IM-14 If a cellular forensic tool successfully completes acquisition of

the target device then all maximum length datebook, calendar, note entries

shall be presented in a human readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Wed May 21 15:30:42 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

October 2008 66 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IM-06 Susteen Secure View Version 1.8.0 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Wed May 21 15:30:42 EDT 2008

Acquisition finished: Wed May 21 15:32:58 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All address book entries were successfully acquired

ALL PIM related data was acquired 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-07 Acquisition of address book entries. as expected

A_IM-08 Acquisition of maximum length address book

entries. 

as expected 

A_IM-09 Acquisition of address book entries containing

special characters. 

as expected 

A_IM-10 Acquisition of address book entries containing a

blank name entry. 

as expected 

A_IM-11 Acquisition of embedded email addresses within

address book entries. 

as expected 

A_IM-12 Acquisition of embedded graphics within address

book entries. 

as expected 

A_IM-13 Acquisition of PIM data (i.e., datebook/calendar,

notes). 

as expected 

A_IM-14 Acquisition of maximum length PIM data. as expected 

Analysis: Expected results achieved 

October 2008 67 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.35 CFT-IM-07 (Motorola RAZR V3) 

Test Case CFT-IM-07 Susteen Secure View Version 1.8.0 

Case 

Summary:

Assertions: 

CFT-IM-07 Acquire mobile device internal memory and review reported call

logs.

A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-15 If a cellular forensic tool successfully completes acquisition of

the target device then all call logs (incoming/outgoing) shall be presented

in a human-readable format without modification. 

Tester 

Name: 

rpa 

Test Host: 

Test Date: 

Device: 

Morrisy

Thu May 22 08:29:17 EDT 2008

Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

PIM Data 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry 

Call Logs 

Maximum Length

Regular Length

Deleted Entry

Special Character 

Missed 

Missed - Deleted 

Text Messages 

MMS Messages 

Stand-alone data files 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video 

Audio 

Audio - Deleted 

Image 

October 2008 68 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

Test Case CFT-IM-07 Susteen Secure View Version 1.8.0 

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Thu May 22 08:29:17 EDT 2008

Acquisition finished: Thu May 22 08:36:44 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All Call Logs (incoming, outgoing) were acquired 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-15 Acquisition of call logs. as expected 

Analysis: Expected results achieved 

October 2008 69 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.36 CFT-IM-08 (Motorola RAZR V3) 

Test Case CFT-IM-08 Susteen Secure View Version 1.8.0 

Case CFT-IM-08 Acquire mobile device internal memory and review reported text

Summary: messages.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-16 If a cellular forensic tool successfully completes acquisition of

the target device then all text messages (i.e., SMS, EMS) messages shall be

presented in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu May 22 08:37:44 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 70 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

Test Case CFT-IM-08 Susteen Secure View Version 1.8.0 

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Thu May 22 08:37:44 EDT 2008

Acquisition finished: Thu May 22 08:44:25 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

Partial Text messages were acquired 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition.

The first 160 characters of EMS messages are only reported.

Text messages that contain foreign language characters are not reported or

displayed in their native language format. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-16 Acquisition of text messages. Partial 

Analysis: Partial expected results achieved 

October 2008 71 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.37 CFT-IM-10 (Motorola RAZR V3) 

Test Case CFT-IM-10 Susteen Secure View Version 1.8.0 

Incoming Audio 

Case 

Summary:

Assertions: 

CFT-IM-10 Acquire mobile device internal memory and review reported standalone multi-media data (i.e., audio, graphics, video).

A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-20 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone audio files shall be playable via

either an internal application or suggested third-party application without

modification. 

A_IM-21 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone image files shall be viewable via

either an internal application or suggested third-party application without

modification. 

A_IM-22 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone video files shall be viewable via

either an internal application or suggested third-party application without

modification. 

Tester 

Name: 

rpa 

Test Host: 

Test Date: 

Device: 

Morrisy

Thu May 22 10:34:08 EDT 2008

Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

PIM Data 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry 

Call Logs 

Maximum Length

Regular Length

Deleted Entry

Special Character 

Missed 

Missed - Deleted 

Text Messages 

MMS Messages 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted 

October 2008 72 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IM-10 Susteen Secure View Version 1.8.0 

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Thu May 22 10:34:08 EDT 2008

Acquisition finished: Thu May 22 10:41:32 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL stand-alone data files (Audio, Image, Video) were acquired 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-20 Acquisition of stand-alone audio files. as expected

A_IM-21 Acquisition of stand-alone graphic files. as expected

A_IM-22 Acquisition of stand-alone video files. as expected 

Analysis: Expected results achieved 

October 2008 73 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

 

5.2.38 CFT-IMO-01 (Motorola RAZR V3) 

Test Case CFT-IMO-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-IMO-01 Acquire mobile device internal memory and review reported data

via supported generated report formats.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu May 22 10:45:51 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Secure View Version 1.8.0 

October 2008 74 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-IMO-01 Susteen Secure View Version 1.8.0 

Highlights: Acquisition started: Thu May 22 10:45:51 EDT 2008

Acquisition finished: Thu May 22 10:54:31 EDT 2008 

Complete representation of known data via generated reports was successful 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 75 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.39 CFT-IMO-09 (Motorola RAZR V3) 

Test Case CFT-IMO-09 Susteen Secure View Version 1.8.0 

Case 

Summary:

Assertions: 

CFT-IMO-09 Acquire mobile device internal memory and review data containing

foreign language characters.

A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-53 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present address book

entries containing foreign language characters in their native format

without modification. 

A_IMO-54 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present text messages

containing foreign language characters in their native format without

modification. 

Tester 

Name: 

rpa 

Test Host: 

Test Date: 

Device: 

Morrisy

Thu May 22 10:57:26 EDT 2008

Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable,Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video 

October 2008 76 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

Test Case CFT-IMO-09 Susteen Secure View Version 1.8.0 

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Thu May 22 10:57:26 EDT 2008

Acquisition finished: Thu May 22 11:11:42 EDT 2008 

Complete representation of known data via generated reports was successful

Partial foreign character Address book entries were acquired

Partial foreign character text messages were acquired but not properly

displayed 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition.

Contacts containing foreign characters (i.e., Chinese) were not displayed.

Text messages containing foreign characters (i.e., French) were partially

acquired but not properly displayed.

Text messages containing foreign characters (i.e., Chinese) were not

displayed. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-53 Acquisition of address book entries containing

foreign language characters. 

Not as 

expected

A_IMO-54 Acquisition of outgoing text messages containing

foreign language characters. 

Partial 

Analysis: Expected results Not achieved 

October 2008 77 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

 

5.2.40 CFT-IMO-11 (Motorola RAZR V3) 

Test Case CFT-IMO-11 Susteen Secure View Version 1.8.0 

Case CFT-IMO-11 Acquire mobile device internal memory and review hash values for

Summary: vendor supported data objects.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-56 If the cellular forensic tool supports hashing for individual data

objects then the tool shall present the user with a hash value for each

supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu May 22 11:49:22 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: cable, Bluetooth

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 78 of 99 Results of Secure View V1.8.0 6/2008 
 

 

Test Case CFT-IMO-11 Susteen Secure View Version 1.8.0 

Video - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Thu May 22 11:49:22 EDT 2008

Acquisition finished: Thu May 22 11:56:52 EDT 2008 

Complete representation of known data via generated reports was successful

Device hash reporting for individual acquired data elements was successful 

Notes: 

Test case performed over supported Bluetooth interface produced consistent

results with the cable acquisition.

MD5 hashes supported for individually acquired files (e.g., Images, Video,

Music, Ringtones, etc.) 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-56 Device hash reporting for individual acquired

data objects. 

as expected 

Analysis: Expected results achieved 

October 2008 79 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.41 CFT-SIM-01 (AT&T SIM) 

Test Case CFT-SIM-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-01 Acquire SIM over supported interfaces (e.g., PC/SC reader,

proprietary reader).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 12:47:37 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 12:47:37 EDT 2008

Acquisition finished: Tue May 20 12:55:37 EDT 2008 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 80 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.42 CFT-SIM-02 (AT&T SIM) 

Test Case CFT-SIM-02 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-02 Attempt acquisition of a non-supported SIM. 

Assertions: A_SIM-24 If a cellular forensic tool attempts to connect to a non-supported

SIM then the tool shall have the ability to identify that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 13:37:20 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 13:37:20 EDT 2008

Acquisition finished: Tue May 20 13:37:46 EDT 2008 

Identification of non-supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-24 Identification of non-supported SIMs. as expected 

Analysis: Expected results achieved 

October 2008 81 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.43 CFT-SIM-03 (AT&T SIM) 

Test Case CFT-SIM-03 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-03 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-25 If a cellular forensic tool encounters disengagement between the

SIM reader and application then the application shall notify the user that

connectivity has been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 13:38:10 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 13:38:10 EDT 2008 

Media connectivity was established via supported interface

Media acquisition disruption notification was not successful 

Notes: 

No warning messages are displayed to the examiner of media connectivity

issues. The acquisition finishes normally displaying data acquired up to

the point of media disruption. 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-25 Notification of SIM acquisition disruption. Not as expected 

Analysis: Expected results Not achieved 

October 2008 82 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.44 CFT-SIM-04 (AT&T SIM) 

Test Case CFT-SIM-04 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-04 Attempt acquisition on a password-protected SIM. 

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-26 If the SIM is password-protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 13:45:10 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 13:45:10 EDT 2008

Acquisition finished: Tue May 20 13:54:19 EDT 2008 

Media connectivity was established via supported interface

Ability to enter PIN on protected media before acquisition was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-26 Password entry before acquisition for protected

SIMs. 

as expected 

Analysis: Expected results achieved 

October 2008 83 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.45 CFT-SIM-05 (AT&T SIM) 

Test Case CFT-SIM-05 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-05 Acquire SIM internal memory and review reported data via the

preview-pane or generated reports for readability.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 14:06:35 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 14:06:35 EDT 2008

Acquisition finished: Tue May 20 14:14:31 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

Analysis: Expected results achieved 

October 2008 84 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.46 CFT-SIM-06 (AT&T SIM) 

Test Case CFT-SIM-06 Susteen Secure View Version 1.8.0 

Case CFT-SIM-06 Acquire SIM internal memory and review reported subscriber and

Summary: equipment related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-28 If a cellular forensic tool successfully completes acquisition of

the target SIM then the SPN shall be presented in a human-readable format

without modification. 

A_SIM-29 If a cellular forensic tool successfully completes acquisition of

the target SIM then the ICCID shall be presented in a human-readable format

without modification. 

A_SIM-30 If a cellular forensic tool successfully completes acquisition of

the target SIM then the IMSI shall be presented in a human-readable format

without modification. 

A_SIM-31 If a cellular forensic tool successfully completes acquisition of

the target SIM then the MSISDN shall be presented in a human-readable

format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 14:15:00 EDT 2008

Device: ATT_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Tue May 20 14:15:00 EDT 2008

Acquisition finished: Tue May 20 14:26:37 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

SPN was not acquired

ICCID was acquired

IMSI was acquired

MSISDN was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via as expected

supported reports. 

October 2008 85 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-SIM-06 Susteen Secure View Version 1.8.0 

A_SIM-28 Acquisition of SPN. Not as 

expected

A_SIM-29 Acquisition of ICCID. as expected

A_SIM-30 Acquisition of IMSI. as expected

A_SIM-31 Acquisition of MSISDN. as expected 

Analysis: Partial expected results achieved 

October 2008 86 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.47 CFT-SIM-07 (AT&T SIM) 

Test Case CFT-SIM-07 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-07 Acquire SIM internal memory and review reported Abbreviated

Dialing Numbers (ADN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-32 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Abbreviated Dialing Numbers (ADN) shall be

presented in a human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 14:27:26 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 14:27:26 EDT 2008

Acquisition finished: Tue May 20 14:35:51 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

All ADNs were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-32 Acquisition of ADNs. as expected 

Analysis: Expected results achieved 

October 2008 87 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.48 CFT-SIM-08 (AT&T SIM) 

Test Case CFT-SIM-08 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-08 Acquire SIM internal memory and review reported Last Numbers

Dialed (LND).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-33 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Last Numbers Dialed (LND) shall be presented in a

human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 14:40:22 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 14:40:22 EDT 2008

Acquisition finished: Tue May 20 14:50:57 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

LNDs were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-33 Acquisition of LNDs. as expected 

Analysis: Expected results achieved 

October 2008 88 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.49 CFT-SIM-09 (AT&T SIM) 

Test Case CFT-SIM-09 Susteen Secure View Version 1.8.0 

Case CFT-SIM-09 Acquire SIM internal memory and review reported text messages (i.e.,

Summary: SMS, EMS).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of the

target SIM then the tool shall successfully recognize the target SIM via all

vendor supported interfaces (e.g., PC/SC reader, proprietary reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of the

target SIM then the tool shall have the ability to present acquired data in a

human-readable format via either preview-pane or generated report.

A_SIM-34 If a cellular forensic tool successfully completes acquisition of the

target SIM then all SMS text messages shall be presented in a human-readable

format without modification. 

A_SIM-35 If a cellular forensic tool successfully completes acquisition of the

target SIM then all EMS text messages shall be presented in a human-readable

format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Tue May 20 14:52:16 EDT 2008

Device: ATT_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Tue May 20 14:52:16 EDT 2008

Acquisition finished: Tue May 20 15:00:15 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

SMS messsages were acquired

Partial EMS messages were acquired 

Notes: 

EMS messages with the status of UNREAD were acquired but not properly presented

(i.e., displayed consistent with the pre-defined dataset). The message was

displayed as: 

*ÑeKCIAZ¡JÄgAZKggCOKgABeKAZKggCOKgAhQCiAJqGKKIAbl¿¡FQCeCGiKegY¡BeKAhsaSGCYY

sAHKYSmKeKIABgAho§AZKggCOKgABÑIAF§ÑGCiKÑCiKIAh§OKiQKeABgAÜÑKAnQKÑAdKGKSmKIADsAüà

hQKAdKGKSmSÑOA¿CeisApà 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via as expected

supported reports. 

October 2008 89 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-SIM-09 Susteen Secure View Version 1.8.0 

A_SIM-34 Acquisition of SMS messages. as expected

A_SIM-35 Acquisition of EMS messages. Partial 

Analysis: Partial expected results achieved 

October 2008 90 of 99 Results of Secure View V1.8.0 6/2008 
 

 

 

5.2.50 CFT-SIM-10 (AT&T SIM) 

Test Case CFT-SIM-10 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIM-10 Acquire SIM internal memory and review reported location related

data (i.e., LOCI, GPRSLOCI).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-36 If a cellular forensic tool successfully completes acquisition of

the target SIM then all location related data (i.e., LOCI) shall be

presented in a human-readable format without modification.

A_SIM-37 If a cellular forensic tool successfully completes acquisition of

the target SIM then all location related data (i.e., GRPSLOCI) shall be

presented in a human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue May 20 15:07:07 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Tue May 20 15:07:07 EDT 2008

Acquisition finished: Tue May 20 15:10:53 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

LOCI data was acquired

GPRSLOCI data was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-36 Acquisition of LOCI information. as expected

A_SIM-37 Acquisition of GPRSLOCI information. as expected 

Analysis: Expected results achieved 

October 2008 91 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.51 CFT-SIMO-01 (AT&T SIM) 

Test Case CFT-SIMO-01 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-01 Acquire SIM internal memory and review acquired data via

supported generated report formats.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 09:01:54 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 09:01:54 EDT 2008

Acquisition finished: Wed May 21 09:11:22 EDT 2008 

Complete representation of known data via generated reports was not

successful 

EMS messages with the status of UNREAD and DELETED were acquired but not

properly presented (i.e., displayed consistent with the pre-defined

dataset). 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

Partial 

Analysis: Partial expected results achieved 

October 2008 92 of 99 Results of Secure View V1.8.0 6/2008 
 

5.2.52 CFT-SIMO-05 (AT&T SIM) 

Test Case CFT-SIMO-05 Susteen Secure View Version 1.8.0 

Case CFT-SIMO-05 Acquire SIM internal memory and review reports for recoverable

Summary: deleted data. 

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data in

a human-readable format without modification via supported generated report

formats. 

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data in

a human-readable format without modification via supported generated report

formats. 

A_SIMO-62 If the cellular forensic tool successfully completes acquisition of

the target SIM and recoverable deleted SMS messages exist then the tool shall

present recoverable deleted data in a human-readable format without

modification. 

A_SIMO-63 If the cellular forensic tool successfully completes acquisition of

the target SIM and recoverable deleted EMS messages exist then the tool shall

present recoverable deleted data in a human-readable format without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Wed May 21 09:24:47 EDT 2008

Device: ATT_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Wed May 21 09:24:47 EDT 2008

Acquisition finished: Wed May 21 09:33:18 EDT 2008 

Complete representation of known data via generated reports was successful

Deleted SMS data was recovered 

Deleted EMS data was recovered but not properly presented 

Notes: 

Deleted EMS messages were partially acquired but not properly presented (i.e.,

displayed consistent with the pre-defined dataset). The message was displayed

as: 

QSgARgABAHKYKiKIAJÄgAZKggCOKY¡JÄgAZKggCOKgABYg§APCmKAhQKABESYSisAh§AJÄEKIAfÄ

CYYARÄCOKgY¡Z§Ñ§aQ§ÑSGAf§kÑIADsiKgABÑIAPCmKAhQKABESYSisAh§AHSgaYCsAjÑSG§IKAFàà

PCeCGiKegABYY§oSÑOAZKggCOKgAjÑADKAFeKCiKIARÄAlCeS§kgAXCÑOkCOKgAà 

Results: 

Assertion & Expected Result Actual 

Result 

October 2008 93 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-SIMO-05 Susteen Secure View Version 1.8.0 

A_SIMO-58 Comparison of known SIM data elements via as expected

generated reports.

A_SIMO-59 Comparison of known SIM data elements via as expected

preview-pane.

A_SIMO-62 Recovery of deleted SMS messages. as expected

A_SIMO-63 Recovery of deleted EMS messages. Not as 

expected 

Analysis: Expected results Not achieved 

October 2008 94 of 99 Results of Secure View V1.8.0 6/2008 
 

5.2.53 CFT-SIMO-07 (AT&T SIM) 

Test Case CFT-SIMO-07 Susteen Secure View Version 1.8.0 

Case CFT-SIMO-07 Acquire SIM internal memory and review data containing foreign

Summary: language characters.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-65 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present abbreviated

dialing numbers (ADN) containing foreign language characters in their

native format without modification. 

A_SIMO-66 If the cellular forensic tool supports proper display of foreign

language character sets then the application should present text messages

containing foreign language characters in their native format without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Wed May 21 09:47:42 EDT 2008

Device: ATT_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Secure View Version 1.8.0

Highlights: Acquisition started: Wed May 21 09:42:42 EDT 2008

Acquisition finished: Wed May 21 09:51:05 EDT 2008 

Complete representation of known data via generated reports was successful

ADNs containing foreign characters were acquired and properly displayed

Text messages containing foreign characters were acquired and properly

displayed 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via as expected

generated reports.

A_SIMO-59 Comparison of known SIM data elements via as expected

preview-pane.

A_SIMO-65 Acquisition of ADNs containing foreign language as expected

characters. 

A_SIMO-66 Acquisition of text messages containing foreign as expected

language characters. 

October 2008 95 of 99 Results of Secure View V1.8.0 6/2008 
 

Test Case CFT-SIMO-07 Susteen Secure View Version 1.8.0 

Analysis: Expected results achieved 

October 2008 96 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.54 CFT-SIMO-08 (AT&T SIM) 

Test Case CFT-SIMO-08 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-08 Begin acquisition on a PIN protected SIM to determine if the

tool provides an accurate count of the remaining number of PIN attempts and

if the PIN attempts are decremented when entering an incorrect value.

Assertions: A_SIMO-67 If a cellular forensic tool provides the examiner with the

remaining number of authentication attempts then the application should

provide an accurate count of the remaining PIN attempts. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed May 21 09:52:50 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 09:52:50 EDT 2008

Acquisition finished: Wed May 21 09:53:35 EDT 2008 

Remaining number of PIN attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-67 Display of remaining number of PIN attempts. as expected 

Analysis: Expected results achieved 

October 2008 97 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.55 CFT-SIMO-09 (AT&T SIM) 

Test Case CFT-SIMO-09 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-09 Begin acquisition on a SIM whose PIN attempts have been

exhausted to determine if the tool provides an accurate count of the

remaining number of PUK attempts and if the PUK attempts are decremented

when entering an incorrect value.

Assertions: A_SIMO-68 If a cellular forensic tool provides the examiner with the

remaining number of PUK attempts then the application should provide an

accurate count of the remaining PUK attempts. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 09:54:05 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 09:54:05 EDT 2008

Acquisition finished: Wed May 21 09:57:04 EDT 2008 

Remaining number of PUK attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-68 Display of remaining number of PUK attempts. as expected 

Analysis: Expected results achieved 

October 2008 98 of 99 Results of Secure View V1.8.0 6/2008 
 

 

5.2.56 CFT-SIMO-11 (AT&T SIM) 

Test Case CFT-SIMO-11 Susteen Secure View Version 1.8.0 

Case 

Summary: 

CFT-SIMO-11 Acquire SIM internal memory and review the overall case file

hash. 

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-70 If the cellular forensic tool supports hashing for the overall

case file then the tool shall present the user with one hash value

representative of the entire case data. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed May 21 09:59:19 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Secure View Version 1.8.0

Acquisition started: Wed May 21 09:59:19 EDT 2008

Acquisition finished: Wed May 21 10:18:27 EDT 2008 

Complete representation of known data via generated reports was successful

Device hash reporting for overall case file was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-70 SIM hash reporting for overall case file. as expected 

Analysis: Expected results achieved 

October 2008 99 of 99 Results of Secure View V1.8.0 6/2008 
About the National Institute of Justice 

NIJ is the research, development, and evaluation agency of the U.S. Department of Justice. NIJ’s 

mission is to advance scientific research, development, and evaluation to enhance the administration of justice and public safety. NIJ’s principal authorities are derived from the Omnibus 

Crime Control and Safe Streets Act of 1968, as amended (see 42 U.S.C. §§ 3721–3723). 

The NIJ Director is appointed by the President and confirmed by the Senate. The Director establishes the Institute’s objectives, guided by the priorities of the Office of Justice Programs, the 

U.S. Department of Justice, and the needs of the field. The Institute actively solicits the views of 

criminal justice and other professionals and researchers to inform its search for the knowledge 

and tools to guide policy and practice. 

Strategic Goals 

NIJ has seven strategic goals grouped into three categories: 

Creating relevant knowledge and tools 

1. Partner with State and local practitioners and policymakers to identify social science research 

and technology needs. 

2. Create scientific, relevant, and reliable knowledge—with a particular emphasis on terrorism, 

violent crime, drugs and crime, cost-effectiveness, and community-based efforts—to enhance 

the administration of justice and public safety. 

3. Develop affordable and effective tools and technologies to enhance the administration of 

justice and public safety. 

Dissemination 

4. Disseminate relevant knowledge and information to practitioners and policymakers in an 

understandable, timely, and concise manner. 

5. Act as an honest broker to identify the information, tools, and technologies that respond to 

the needs of stakeholders. 

Agency management 

6. Practice fairness and openness in the research and development process. 

7. Ensure professionalism, excellence, accountability, cost-effectiveness, and integrity in the 

management and conduct of NIJ activities and programs. 

Program Areas 

In addressing these strategic challenges, the Institute is involved in the following program areas: 

crime control and prevention, including policing; drugs and crime; justice systems and offender 

behavior, including corrections; violence and victimization; communications and information 

technologies; critical incident response; investigative and forensic sciences, including DNA; lessthan-lethal technologies; officer protection; education and training technologies; testing and 

standards; technology assistance to law enforcement and corrections agencies; field testing of 

promising programs; and international crime control. 

In addition to sponsoring research and development and technology assistance, NIJ evaluates 

programs, policies, and technologies. NIJ communicates its research and evaluation findings 

through conferences and print and electronic media. 

To find out more about the National 

Institute of Justice, please visit: 

http://www.ojp.usdoj.gov/nij 

or contact: 

National Criminal Justice 

Reference Service 

P.O. Box 6000 

Rockville, MD 20849–6000 

800–851–3420 

http://www.ncjrs.gov