First Response & Preservation Technical Explainer

Could removing a SIM alter the evidence?¶

Yes.

Removing a physical SIM changes the phone's connection state and may also affect calls, messaging, authentication and applications that rely on the number.

The practical rule

Treat SIM removal as a deliberate change to one communication route, not a harmless identification step.

Record the phone before opening the tray¶

Where visible, preserve:

mobile signal;
network name;
displayed phone number;
current application;
battery;
Wi-Fi;
Bluetooth; and
any dual-SIM indicator.

Photograph the phone and SIM tray position before removal.

The SIM is not the whole phone¶

A physical SIM may contain identifiers and limited stored data.

Most relevant user content will usually sit elsewhere:

SIMService identity and limited local dataUseful identifiers may be present.

Phone / accounts / providerMost messages, app data and service recordsUsually the richer evidence sources.

So do not remove a SIM simply to discover a network or number when those facts can be obtained later by a less intrusive route.

Removal may change behaviour immediately¶

Possible effects include:

loss of mobile service;
active call interruption;
authentication failure;
change in the active line;
notification or warning;
application behaviour changing; and
an eSIM becoming the remaining mobile route.

What should I consider with an eSIM after removing a physical SIM? covers that last point.

SIM removal does not equal isolation¶

Wi-Fi, Bluetooth and eSIM can all remain active.

If isolation is the aim, assess all communication routes.

The practical point is: remove a SIM only for a defined reason, record the before/after state and do not assume the phone is now offline.