Cellular Carrier Info (carrier.plist)

Location

Description

Property list file containing cellular carrier configuration information including the carrier name, MCC (Mobile Country Code), MNC (Mobile Network Code), carrier bundle version, SIM ICCID, and supported network features. On dual-SIM devices, separate carrier configurations exist for each SIM slot.

Forensic Value

Carrier configuration identifies the cellular provider and SIM card associated with the device, which is essential for correlating with carrier records obtained via legal process. The MCC and MNC codes identify the country and network operator, establishing the cellular network the device was registered on. SIM ICCID values uniquely identify the physical SIM card and can be matched against carrier subscriber records. On dual-SIM devices, the presence of two carrier configurations may reveal a secondary phone line used for compartmentalized communications. Changes in carrier configuration can indicate SIM swapping activity.

Tools Required

Collection Commands

idevicebackup2 backup --full /forensics/ios_backup/

python3 ileapp.py -t tar -i /path/to/backup -o /forensics/output/

ideviceinfo -u <UDID> -q com.apple.mobile.iTunes > carrier_info.txt

Collection Constraints

• •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References