As discussed in Section 1, SIM cards can provide us with information that may aid our investigations, such as phone numbers used and location information associated with the SIM card. In the past, we didn’t have to worry about more than one SIM in an iPhone. This is no longer the case. Dual SIM, aka eSIM, was introduced with the iPhone XS. The user can now leverage more than one SIM and have more than one phone number similar to what we saw in Android.  The files that track this information are /Library/Databases/CellularUsage.db and /wireless/Library/Preferences/com.apple.commcenter.plist. The file /wireless/Library/Preferences/com.apple.commcenter.data.plist also stores SIM card information.

NOTE: /private/var/wireless/Library/Databases/CellularUsage.db contains the ICCID & phone number. The subscriber_info.last_update_time = records the most recent SIM insertion but doesn’t update or record the time the SIM is extracted from the device.