Call Detail Records / Cell Site Analysis

---

• Attributing contact between parties.
• Showing the proximity of a person in relation to a scene of crime.
• Support or refute the attribution of an association of a mobile number to a person.
• Support or refute the attribution of an association of a mobile number to a specific address.
• Showing patterns of movement between areas.
• Showing if a number of people or rather, cell phones were in close proximity together.

Historic Cell Site Analysis, more commonly known as Cell Site Analysis, is the process through which the Call Data Records (CDRs) for a phone are used to identify the potential location of the phone. Call Data Records detail phone information such as the date,time, duration and origin of a call.

Cell Site Analysis can locate a mobile phone operating in a certain area when any call activity occurs on the phone, this could be a voice call, text message or a connection to the internet.

The opposite also applies, that is, we can eliminate a mobile phone from being in a certain location at a certain time if the call data supports this.

The following will introduce the basic concepts of how cell site analysis is conducted, including the data we work with and how mobile phones communicate with the network. We will see at a basic level that a mobile phone is a radio transceiver, which uses radio signals to communicate with cell sites, which in turn, communicate with the other components of the host network.

When a mobile phone is involved in call activity, certain data is generated and stored by the network. This data is primarily for the purposes of billing and includes the date and time of the call; the calling and receiving number the duration and the type of call, i.e. whether it is a text, voice call, or data connection.

Call data records however also include data that can be used in cell site analysis, such as the IMEI number, which is a unique serial number embedded within the handset, but most importantly, the CELL ID of the

cell used to carry the call is recorded.

Call data for a specific mobile number is requested by the police, or the defence and is subsequently provided by the relevant network operator. The format and content of data provided varies significantly between network operators. We can present this data in an easy to understand chronological table by extracting the data, sorting and formatting. 

Cell Site location data is also requested from the network operator, this is so we can match the cell ID used within the call data, to its relevant cell site and sector. The data includes the name of the site, the grid reference, postal address and the Azimuth, or direction of the sector used. It’s the sector data which can help us to establish the geographical location of a mobile phone relative to the cell site being used. Network operators provide the cell used at the start and the end of a call, some calls use the same cell at the start and the end of the call, while others will use different cells.

When a mobile phone powers up, it performs a network search by sending out a signal. This signal is received by a local cell site and various checks are carried out in order to validate the cell phone onto its correct network.

This process is called “Registration” and happens during the few seconds when the cell phone performs its start-up tune. The process is complete when the network icon appears on the screen, the cell phone is now ready to make or receive calls, or to connect to the internet.

Once a cell phone has registered with the network, it is ready to make, or receive a call, text message, or connect to the internet. Once a cell phoone has started a call through a local cell site, the data is stored by the network, Verizon Wireless for example. The call will be routed through the Verizon Wireless core network to the receiving mobile via the T-Mobile cell site and core network for example. Data is stored by both networks during the course of the call, although the amount of data stored differs between networks.

Cell sites exist in many different forms, the most common types are either free standing masts or rooftop installations and are referred to as MACRO cells, that is they are positioned at a reasonable height relative to surrounding clutter and have a certain power and capacity capability. This type of cell can provide service for as little as a few hundred yards in dense urban areas to many miles in rural areas. Cell sites can also be contained within less obvious places such as shopping centres, airports and within small structures on the front of commercial buildings in busy high streets; Cells contained within these types of structures are known as micro cells. Micro cells have only a small range of service and are primarily designed to add more capacity in very busy areas. Micro cells typically serve an area of 50-150 yards.

Typically, cell sites are split into “Sectors” usually there are 3 sectors, each with its own antenna, but sometimes more, sometimes less. The sectors are generally equally spaced at 120 degree intervals so as to provide service all around the mast, or building. Importantly, each of these sectors has its own unique CELL IDENTITY, which as we know is recorded within the call data records. Network engineers plan the coverage using hexagons, however, radio signals rarely propagate in this manner and we are much more likely to find an irregular coverage pattern. The actual coverage area does not provide a precise pattern, radio signals, due to their nature propagate in such a way that produces an irregular coverage area which is dependent upon many external factors such as local building clutter and topography. There is also an area of overlap between the sectors where the signals are equal in strength.

The distribution of cell sites is directly proportional to the population density. For this reason, we see many cell sites deployed within city centre areas; these cell sites will typically serve an area up to 1 Km radius. As we move out of the city centre into the suburbs, the cell range increases, typically to 2-3 Km. Moving into a rural area cell sites are sparser and their range increases again, typically providing service to 3-5 Km, often up to 10 Km. In very remote areas cells can often serve greater distances, with the theoretical maximum being 35 Km, although this is rarely observed.

The mobile phone constantly monitors the network and measures the strongest cells available. These measurements are sent back to the network approximately every second, so that the network knows which cell to allocate to the mobile when it needs to make or receive a call. In the example we can see that the cell phone is measuring three cell ids and it reports these to the network along with their strengths. It is often the case in urban areas that a mobile can detect and measure six cells at any given time, all of these cells will be reported back to the network in a similar manner, usually there is a best cell, and then a list of neighbour cells. As the phone moves between coverage areas, it will report the new serving and neighbour cells.