Identifiers

identifiers

Every identifier needed for legal requests, from a case: device, telephony, network, accounts, and the apps whose operator holds data.

Prerequisites

• A case from device acquire (full or --triage) or import.
• Telephony identifiers (IMEI, IMSI, ICCID, line number) come from a live acquisition (iphonesubinfo); an extraction usually does not hold them.

No phone, no network.

Usage

apex identifiers ./case-42                          # terminal sheet
apex identifiers ./case-42 --json -o identifiers.json

What it lists

Section	Fields	Source
Device	manufacturer, model, device name, serial, Android ID, Android version, build fingerprint	properties, settings
Telephony	IMEI, IMSI, ICCID, line number (MSISDN), SIM and network operator, SIM country	read-only getters of service call iphonesubinfo, classified on the computer (Luhn check for IMEI, SIM MCC/MNC prefix for IMSI)
Network	factory Wi-Fi MAC, Bluetooth MAC and name	dumpsys wifi, settings
Accounts	every account on the phone, with the service a request goes to (Google, WhatsApp, Instagram / Threads user IDs, Telegram, Samsung, Xiaomi…)	dumpsys account / accounts_*.db
Apps whose operator holds data	ride-hailing (Uber, Bolt, Heetch…), delivery, payment (PayPal, Lydia, Revolut), crypto wallets and exchanges, encrypted messaging, social, marketplaces	installed packages

The line number is only known if the SIM or the operator stored it; it is often missing. When the APEX agent ran, each SIM's line number, ICCID and carrier as Android reports them are added.

Android 13+ masks account names in dumpsys account (abc***@gmail.com). When the APEX agent ran, APEX replaces each masked name with the full one the agent read, for the accounts visible to it (Google, WhatsApp…); the others stay masked: the full ID comes from the operator.

The same sheet is in the HTML report and the procès-verbal.