How to recover a deleted SMS with SIM Manager

How to recover a deleted SMS with SIM Manager

Recovering a deleted SMS is something many of us need to do from time to time. This guide explains when undeleting an SMS is possible, which tools are required and how the process works.One doesn't need to be a forensic detective, or a suspecting spouse in order to need such a feature; you'll be surprised to see that most companies that offer SIM card recovery tools use sample screenshots with an undeleted SMS saying something like "he is not coming back tonight, let's do it again" or "last night was great". Let's give humanity a chance.

Undeleting a SMS is what normal people need too, from time to time you receive important data via SMS (an address, a phone number) or write such data to one and save it in the outbox (ex: a password, a PIN, etc) in order to retrieve it later – this is where a deleted SMS can be a problem. A SIM card recovery tool is handy in such cases.

How SMS are deleted

In order to recover an SMS, we need to understand how they are deleted. The SIM card has a special file where the SMS are stored, the file has several "slots" in it, each slot holds a message. The number of slots is finite, i.e. a SIM card can store 20 or 25 SMS (depending on the capacity, newer cards have more slots). When all the slots are filled, you have to delete an old SMS before you can save a new one.

The structure of one such slot is made of several fields, such as: the phone number of the sender, the date and time the SMS was received, the text of the message itself. There are other fields which are not shown to us, one of them is the state of the current slot, which can be either "empty", or "in use".

Here is a picture that illustrates a SIM card with 4 SMS slots, all of which are in use.

Some phones will delete an SMS by setting the value in the "state" field to "free", leaving the other fields intact. When a new SMS is received, the phone will verify whether free slots exist, and if they do – they'll be used to store the new SMS. Until a new SMS arrives and the "marked as free" space is not needed – the SMS can be recovered, by simply changing the "state" field back to "in use" using a tool such as SIM Manager and a SIM card reader. This is what the SMS file looks like when a message was "marked as deleted"

 

In contrast, other phones will not only alter the "state" field, but they will also overwrite the other fields with some default value, immediately after the message was deleted.

This is what the SMS file looks like when a message was "wiped"

 

How SMS are recovered

By now it should be clear that in order to recover a deleted SMS, all you have to do is change the state of the SMS to "in use", and the phone will happily display that message.

SIM Manager will display the messages that were "marked as deleted" in red, to make sure that you see them, enable the "Show deleted SMS" option in Options\Settings.

If you see one such SMS, right-click it and press "Undelete". Alternatively, you can press "Wipe" and make sure that it cannot be recovered.

Here is a screenshot which shows a real life SIM card with 20 SMS slots, 4 of which contain messages, but only the first two are in use, the last two are marked as deleted.

Below is another screenshot, made with a forensic analysis tool called SIM Explorer, which illustrates the raw data of the SIM card besides the interpreted human-readable representation; the tool is mostly used to gather electronic evidence from SIM cards, but in our case we'll use it to take a look at the guts of the card and understand how SIM card recovery works.

Note how the "00" in the beginning means "free", while "07" means "in use". The first two messages will be shown by the phone, the following two messages are not going to be shown by the mobile phone – but you can see that the actual contents of the message is still physically on the card, therefore the SMS can be recovered. The rest of the file are the empty slots. Note that they not only have "00" in the beginning, but the rest is filed with "FF FF" – which is the default value for a wiped message.

Finally, you need a SIM card reader, which acts as an interface between the SIM card recovery software and the SIM card itself. Here is en example of one such device.

When is it impossible to recover a deleted SMS?

Unfortunately things are not as simple as getting a SIM card reader and a copy of SIM Manager, there is one more detail – does your phone delete the message, or does it only mark it as deleted?

The problem is that different mobile phone companies do it their way, and you can't know what your case is unless you actually give it a try, because none of the companies writes about this in the description of their products.

Finally, there is another detail – many new phones have the habit of storing the SMS in their own memory, rather than on the SIM card. In that case, the solution described here does not apply, because each phone manufacturer has it their way. There are cases in which the phone will use its own memory for SMS storage, and when it gets full – the new SMS will be stored on the SIM card.

There is no certain way of telling guessing how a phone behaves, therefore you should study your phone's habits and see for yourself. It is also a good idea to develop the custom to save the important message to the SIM – to maximize the chance to recover the deleted SMS if things go wrong.

How many old SMSes can I recover?

This depends on how many slots there are. The general rule is that you should try to recover the SMS as soon as you know that it was deleted. If you don't do that, the slot marked as empty can be overwritten with a new message when you receive one – you don't want that.

If you're dealing with very important data, consider turning the phone off – to exclude the possibility that a new SMS will be received.