http://en.m.wikipedia.org/wiki/Mobile_phone_tracking#section_1
Not sure if this will help, but it explains how mobile phone's are traced. I'm currently very curious as to how they traced her phone and what actually happened with it and the sim card etc.
It is possible but I doubt that is actually what was used as it requires the phone is to be on - and needs very specific network hardware which Vodafone made a big deal about not having in the last couple of months when new location-specific emergency broadcast rules were being discussed for things like bushfires.
I think the more likely alternative is around the way networks trace phone for normal calls.
When a phone a is switched on, it establishes a connection to 1 cell tower and is referenced to both the SIM data and the phone ID. I doubt this is stored so no good once the phone is off.
As phones move around the current cell tower is traced. Also I doubt this is stored except for whatever the current cell tower is - again no good after the phone is turned off.
Finally when a SIM is removed or phone is switched off, the last tower is recorded and retained. Search "IMSI Detach" process for reference.
So I think the only historical data recorded for a de-activated phone (except actual actual/text usage) is the last cell tower location. This fits with the media reports of SIM being removed and hone being located.
The other option is the phone was switched back on without the SIM.