01Scope
- Record types: voice, SMS, data sessions; originating vs terminating; forwarded and unanswered calls
- Field semantics: MSISDN, IMEI, IMSI, cell ID/LAC/TAC, duration, time base and zone, record sequence
- Normalisation: E.164 numbers, UTC times with declared offsets, de-duplication of mirrored records
- Analysis: contact pairs, frequency, first/last contact, co-presence of devices, IMEI changes
- Location: cell coverage, sector azimuth, overlapping coverage, and why a cell is not an address
02Questions it answers
- Did number A contact number B, how often, when, and who initiated?
- Which handset (IMEI) was the SIM used in, and did it change?
- Was the device active in the coverage area of a given cell at a given time?
- Are two devices repeatedly on the same cells at the same times?
- Do the carrier records agree with the handset's own call log?
03Evidence used
| Source | What it yields | Note |
|---|---|---|
| Carrier records for each number and period, as delivered (CSV, XLSX, PDF) | Events with time, parties, duration, cell and device identifiers | Hash the delivered files; keep the carrier's cover letter stating time zone and field definitions. |
| Cell site list with coordinates, azimuths and dates of validity | Mapping from cell identifiers to coverage sectors for the period | Cell plans change; the list must match the record dates. |
| Handset call logs and messaging databases | The device-side view to cross-check against the carrier | Device logs can be deleted or cleared; the carrier record is the stronger source for existence. |
| Subscriber and device registration data | Who the number was registered to; IMEI to model mapping (TAC) | Registration is not use; a registered subscriber is not necessarily the user. |
04How it is approached
Fix the time base of every file
Carriers deliver local time, sometimes UTC, sometimes mixed across columns. Read the cover letter, test against a known event, declare the offset per file, convert to UTC and keep the original value alongside.
Normalise numbers before counting
Convert to E.164; map short codes and service numbers; de-duplicate records that appear in both parties' files; count only after normalisation.
Build the pair table with references
For each pair: count, first and last contact, direction, total duration, and the file and row numbers that support each figure.
Treat cells as areas
Plot the sector, not a pin. Show overlapping sectors and the cell's coverage estimate for the date; say that the device was within the area served, not at a place.
Cross-check with the handset
Compare carrier events with the device call log and messaging databases; list agreements, device-side gaps and carrier-side gaps separately.
05Artifacts
The library records behind this area:
06Pitfalls
- A cell identity places a device somewhere in a sector that can span kilometres; it is not a street address.
- Forwarded, unanswered and voicemail legs create records that look like contact but are not conversations.
- Data session records carry a start cell and sometimes an end cell; the device moved in between.
- Mirrored records (A→B in A's file and in B's file) double-count if not de-duplicated.
- Internet-based calls and messages do not appear in carrier voice and SMS records.
07What the report states
- Files received with hashes, carrier, period, record counts and the declared time base of each.
- Normalisation rules applied (number format, offset per file, de-duplication) and their effect on counts.
- Pair and frequency tables with file and row references.
- Cell-based statements as coverage areas with the cell plan version used.
- Agreements and gaps between carrier and handset records.
08Questions to ask a report
- Which time zone did the carrier use, and how was it verified for these files?
- Were the records de-duplicated across the parties' files before counting?
- Does the report present a cell as an area or as a point?
- Does every figure in the pair table carry a file and row reference?