International Mobile Equipment Identity

Overview [1] [2] [3]#

International Mobile Equipment Identity (IMEI) is a number, usually and is a Unique Identifier for 3GPP (i.e., GSM, UMTS and LTE) and iDEN Mobile Devices, as well as some satellite phones.

International Mobile Equipment Identity is usually found printed inside the battery compartment of the mobile Devices, but can also be displayed on-screen on most mobile Devices by entering *#06# on the dialpad, or alongside other system information in the settings menu on mobile Devices Operating Systems.

The International Mobile Equipment Identity number is used by a GSM network to identify valid devices and therefore can be used for stopping a stolen phone from accessing that network. For example, if a mobile phone is stolen, the owner can call their network provider and instruct them to "blacklist" the phone using its IMEI number. This renders the phone useless on that network and sometimes other networks too, whether or not the phone's SIM is changed.

International Mobile Equipment Identity is only used for identifying the Mobile Devices and has no permanent or semi-permanent relation to the subscriber. The subscriber is identified by transmission of an IMSI number, which is stored on a SIM card that can (in theory) be transferred to any Mobile Device. However, many network and security features are enabled by knowing the current Mobile Device being used by a subscriber.

Structure of the IMEI and IMEISV #

For example, the
  • old style IMEI code 35-209900-176148-1 (15-digit)
  • IMEISV code 35-209900-176148-23 (16-digit)

Tells us the following:

The It uniquely characterizes a mobile station and gives clues about the manufacturer and the date of manufacturing.

By contrast, the new style IMEI code 49-015420-323751 has an 8-digit TAC of 49-015420.

The new CDMA Mobile Equipment Identifier (MEID) uses the same basic format as the IMEI.

Since 2004#

Since 2004 however IMEI Software Version (IMEISV) are being used to assist with a carrier’s identification of the software version running on the device. This feature can assist with upgrades, notification to users and maintenance of the user device by the Mobile Network Operator. This number is composed of the TAC, SNR and SVN for a total of 16 digits (sometimes 17).

The TAC becomes a combination of the "older" TAC plus the FAC.

The Check Digit is generally dropped from the IMEISV. The Check Digit can be calculated, if missing, by dropping the SVN digits and using Luhn Algorithm against the remaining digits starting at the rightmost digit.



What becomes confusing to examiners is the fact that some mobile forensic software will report two IMEI numbers and identify one as the calculated and the other as the IMEI. Furthermore, telco carriers will often send back CDRs that display the IMEISV and not IMEI. Since they are slightly different (last two digits typically) the comparison with the IMEI that is listed on the identification label or displayed by the mobile forensic software does not match. These discrepancies can lead to problems when documenting and even testifying to the identity of the device if not clearly understood.

For both the IMEI AND IMEISV The most important numbers are the first 8 and the next 6 (TAC and Serial Number). The numbers following will either be the check digit (with a 0 filler to reach 15 digits) or the software version composed of two digits. What should also be known is that the two software digits can change over time based upon an update to the device’s software. With today’s devices this can be a frequent occurrence! With Android devices pressing the common *#06# will list the IMEISV in the form of 17 digits (TTTTTTTT-NNNNNN-C / SS) whereas iOS devices will simply display the common 15 (TTTTTTTT-NNNNNN-C). However, both CDR data from carriers and mobile forensic software often only list the standard IMEI number while others list the IMEISV. At times some mobile forensic software lists both!

As long as the examiner understands that the significant numbers within the IMEI or IMEISV are the first 8 and following 6 clarity can easily be demonstrated and described when requested to do so.

By knowing:

  • the exact IMEI that is listed on the identification label can be derived from the IMEISV to show unequivocally they are the same,
  • that the multiple IMEIs listed by the forensic tool are just the IMEI and IMEISV,
and the returned IMEI from a telco that is off by a few digits is the IMEISV not the anticipated IMEI, you can make an informed analysis and conclusion.

More Information#

There might be more information for this subject on one of the following: