According to the CHFI v11 Mobile and IoT Forensics domain, the primary mechanism used by telecommunications service providers to verify user identity during call setup is the use of IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) . These identifiers are fundamental to cellular network authentication and subscriber management.
The IMSI uniquely identifies the subscriber and is stored on the SIM card, while the IMEI uniquely identifies the mobile device itself. During call setup, the cellular network authenticates the subscriber by validating the IMSI against the provider's Home Location Register (HLR) or Home Subscriber Server (HSS).
Simultaneously, the IMEI is checked to ensure the device is legitimate and not blacklisted. CHFI v11 highlights these identifiers as critical forensic artifacts for subscriber attribution, call detail record (CDR) analysis, and location tracking .
The other options are incorrect because call duration and call content are not used for identity verification.
Monitoring call content is also restricted due to privacy and legal constraints. Tracking location alone does not establish identity; it only provides positional data once authentication has already occurred.
CHFI v11 emphasizes that IMSI and IMEI correlation is essential for mobile forensics investigations, enabling investigators to link calls, devices, locations, and subscribers accurately. Therefore, the correct and CHFI v11-verified mechanism for ensuring user identity during call setup is utilizing IMSI and IMEI information , making Option D the correct answer.