hi, Kamal!
I am thinking that most Nokia mobiles (when switching on) not perform Combined Attach and stay in GMM Idle (GPRS Detached) state on default. But I don’t know about others.
On your place, I would try to do as follows:
1)take the suspect mobile and switch it on;
2)then check out the subscriber status in SGSN (GPRS Attach/detach?) and VLR (Imsi attach/detach?).
3)If both flags are attached then wait without making any voice or data activities..It is very desirably to observe the signalling exchange concerning that subscriber on Gb- (e.g. Periodic RA Update, Detach message from SGSN etc.) and Gs-(e.g. Imsi Detach Indication etc.) interfaces.
4) If for example you will find out that after Detach timer expiry (3,5 h) in SGSN IMSI is detached also in VLR then more likely than not that your SGSN have abnormal behavior.
p.s. I am not working with Nokia equipment (with the exclusion of my Nokia handset:)
B.R.