Mobile Forensics · Timelines & Analysis · Lesson 4 of 5

Carrier Records & Cell Sites

Call records, cell sites and the warrant rule from Carpenter.

Records the carrier keeps

Some of the most useful timeline evidence isn't on the phone at all. Carriers keep their own records, mainly so they can bill customers and run the network. The best known is the call detail record (CDR). It's created by the network when a call is placed or a text is sent. Formats differ widely between carriers, but a CDR typically holds the phone numbers involved, the start time, the duration, and the cell and sector (the direction an antenna faces) that handled the call. Records of which cells a phone used over time are called cell site location information, or CSLI.

Carrier records are independent of the phone's clock and can't be edited by the user, which makes them great for corroboration. Two cautions apply. First, check what time zone the report uses. Carriers differ, and the report's documentation should say. Second, carriers keep records for a limited time, and how long varies. That's why investigators often ask a carrier to preserve records quickly, then get the proper legal process to obtain them.

That legal process matters. In the US, the Stored Communications Act sets out how the government can require providers to hand over records. In Carpenter v. United States (2018), the Supreme Court held that getting seven days or more of historical CSLI is a Fourth Amendment search. The government must generally get a warrant based on probable cause. A court order under the lower reasonable grounds standard was not enough. The Court noted exceptions such as emergencies, and it said its decision did not cover real-time tracking or tower dumps.

Other countries have their own rules, and US courts are still working out the edges of Carpenter, so treat this as the general picture, not legal advice.

An area, not an address

From Talking to Towers, you know a phone connects to a cell, and a cell covers an area. That area can be small in a dense city or huge in the countryside. NIST's mobile forensics guidelines note that a tower can serve phones up to about 35 kilometers (around 21 miles) away. A sector covers a wedge shaped slice, not a dot on a map.

Coverage isn't a neat shape either. Terrain, buildings, weather, antenna settings and how busy the network is all change which cell a phone picks. A phone doesn't always use the nearest tower. If the nearest one is overloaded, a farther one may handle the call. That's why careful examiners use the carrier's coverage information, and sometimes field tests, instead of drawing circles around tower locations.

So what does a cell record prove? It places the phone somewhere in the area that cell or sector served, at that time. It doesn't place a person, and it doesn't place anyone at a particular address. If a sector covers both a suspect's home and a shop, the record alone can't say which one. The phone could also have been carried by someone else.

A related request is a tower dump: a list of every phone that used a particular cell during a time window. It can help find a phone that was present at several scenes. It also sweeps in many people with nothing to do with the case, which raises serious privacy and scope questions. Carpenter didn't decide how tower dumps are treated, and courts differ, so the rules depend on the jurisdiction.

In a report, say the phone used a cell serving an area that includes a location, not that the person was there.