jspωiki
International Mobile Equipment Identity

Overview [1] [2] [3]#

International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP (i.e., GSM, UMTS and LTE) and iDEN Mobile Devices, as well as some satellite phones.

International Mobile Equipment Identity is usually found printed inside the battery compartment of the mobile Devices, but can also be displayed on-screen on most mobile Devices by entering *#06# on the dialpad, or alongside other system information in the settings menu on mobile Devices Operating Systems.

The International Mobile Equipment Identity number is used by a GSM network to identify valid devices and therefore can be used for stopping a stolen phone from accessing that network. For example, if a mobile phone is stolen, the owner can call their network provider and instruct them to "blacklist" the phone using its IMEI number. This renders the phone useless on that network and sometimes other networks too, whether or not the phone's SIM is changed.

International Mobile Equipment Identity is only used for identifying the Mobile Devices and has no permanent or semi-permanent relation to the subscriber. The subscriber is identified by transmission of an IMSI number, which is stored on a SIM card that can (in theory) be transferred to any Mobile Device. However, many network and security features are enabled by knowing the current Mobile Device being used by a subscriber.

Structure of the IMEI and IMEISV #

For example, the
  • old style IMEI code 35-209900-176148-1 (15-digit)
  • IMEISV code 35-209900-176148-23 (16-digit)

Tells us the following:

  • Type Allocation Code (TAC) : 6 decimal places, centrally assigned.: 35-2099 - issued by the BABT (code 35) with the allocation number 2099
  • Final Assembly Code (FAC): 00 - indicating the phone was made during the transition period when FACs were being removed.
  • Serial Number (SNR): 176148 - uniquely identifying a unit of this model
  • CD: 1 so it is a GSM Phase 2 or higher
  • Software Version Number (SVN): 23 - The "software version number" identifying the revision of the software installed on the phone. 99 is reserved.

By contrast, the new style IMEI code 49-015420-323751 has an 8-digit TAC of 49-015420.

The new CDMA Mobile Equipment Identifier (MEID) uses the same basic format as the IMEI.

Working with International Mobile Equipment Identity [3]#

IMEI numbers are used as a serial number for the device. Much like the serial number you might find on other items like cameras, TVs and stereos. However, the IMEI is also used by the Mobile Network Operator to identify the device over the cellular network via the Central Equipment Identity Register (CEIR). This helps to deliver content, assist with subscriber to equipment correlation, equipment maintenance and equipment allocation.

The IMEI is a 15 digit number composed of several subsections:

  • Type Allocation Code (TAC)
  • Serial Number (SN)
  • Check-Digit(CD).

Since 2004 however IMEI Software Version (IMEISV) are being used to assist with a carrier’s identification of the software version running on the device. This feature can assist with upgrades, notification to users and maintenance of the user device by the Mobile Network Operator. This number is composed of the TAC, SN and SV for a total of 16 digits (sometimes 17).

The check digit is generally dropped from the IMEISV. The check digit can be calculated, if missing, by dropping the SV digits and using Luhns Algorithm against the remaining digits starting at the right most digit. The layout of both the IMEI and IMEISV is described below.

  • T = TAC digit
  • N = Serial Number digit
  • C = Check Digit
  • S = Software Version digit

IMEI = TTTTTTTT-NNNNNN-C

IMEISV = TTTTTTTT=NNNNNN-SS

What becomes confusing to examiners is the fact that some mobile forensic software will report two IMEI numbers and identify one as the calculated and the other as the IMEI. Furthermore, telco carriers will often send back CDRs that display the IMEISV and not IMEI. Since they are slightly different (last two digits typically) the comparison with the IMEI that is listed on the identification label or displayed by the mobile forensic software does not match. These discrepancies can lead to problems when documenting and even testifying to the identity of the device if not clearly understood.

For both the IMEI AND IMEISV The most important numbers are the first 8 and the next 6 (TAC and Serial Number). The numbers following will either be the check digit (with a 0 filler to reach 15 digits) or the software version composed of two digits. What should also be known is that the two software digits can change over time based upon an update to the device’s software. With today’s devices this can be a frequent occurrence! With Android devices pressing the common *#06# will list the IMEISV in the form of 17 digits (TTTTTTTT-NNNNNN-C / SS) whereas iOS devices will simply display the common 15 (TTTTTTTT-NNNNNN-C). However, both CDR data from carriers and mobile forensic software often only list the standard IMEI number while others list the IMEISV. At times some mobile forensic software lists both!

As long as the examiner understands that the significant numbers within the IMEI or IMEISV are the first 8 and following 6 clarity can easily be demonstrated and described when requested to do so.

By knowing:

  • the exact IMEI that is listed on the identification label can be derived from the IMEISV to show unequivocally they are the same,
  • that the multiple IMEIs listed by the forensic tool are just the IMEI and IMEISV,
and the returned IMEI from a telco that is off by a few digits is the IMEISV not the anticipated IMEI, you can make an informed analysis and conclusion.

More Information#

There might be more information for this subject on one of the following: