CYFOR’s in-house cell site experts detail the specifics of Cell Site Analysis. A specialist technique, which can provide vital digital evidence within a criminal investigation.
What is Cell Site Analysis?
Cell site analysis is the examination of Call Data Records (CDRs) that are obtained from mobile phone networks. These files contain records of calls made and received, records of text messages sent and received (SMS messages), as well as records of when the phone has used the internet for things such as email and other applications (GPRS sessions). For every call, text or GPRS session there is a record of the “cell“ (sometimes referred to as mast) that is connected to that event in question. As that gives us a location of where that cell is, it can, therefore [within reason] indicate where the phone in question was located. From this, our analysis can:
- Map out locations where a phone was at a time, or where it frequents or has travelled. This could be of use if the user is visiting a location they shouldn’t be, for example.
- Detail when parties have communicated with each other and how often. This may be of use when parents are not meant to contact one another, for example. Also, whilst this information can be deleted from a phone, the network data is a “golden copy” and cannot be deleted. They store this for 12 months.
- Detail when any SIM swapping has taken place, so where someone is moving their SIM card between different handsets. This could be of use if you are trying to identify if someone is hiding a phone from interrogation by the local authority.
- Detail when more than one handset may be colocating, so for example if 2 parents who should not be meeting up are travelling from one area to another to then meet up.
How does Cell Site Analysis work?
Each time a phone connects to the network, for a call or text message, one of the many antennas attached to telecommunication masts around the country are used. Each antenna, or cell, is identified by the network and this cell ID appears in the requested CDRs, with the exception of Vodafone who do not record cell IDs for received calls. In addition, data services, such as the internet, email, video calls and downloads, can result in a connection between the phone and network. The movement of the phone generates new entries in the CDRs and can enable the phone to be tracked.
Cells have service areas and these areas overlap to enable phones to move without disconnecting from the network. In many locations multiple cells are available and the circumstances will determine which of these cells will be used and appear in the CDRs. Large-scale movements can be mapped using just the mast locations associated with the cells used. With significant activity during the journey, it is possible to determine the route taken and probable means of transport. This may prove sufficient.
A phone’s location can be determined through the cells used at or directly before and after the time of interest.
Drive Surveys
A phone’s location can be determined through the cells used at or directly before and after the time of interest. A drive survey can measure the service area of a cell. Specialist equipment is used to generate measurements of the cells providing service and the service area of the cell identified. This will show the potential location of the phone, either at the time of interest or directly before and after. This can show that the CDRs are consistent, or inconsistent, with the possibility that the phone was at the location of interest at the time.
Location Surveys
Alternatively, a location survey can determine the activity of the phone in relation to specific locations, rather than specific times. This survey makes measurements on the appropriate network in the vicinity of the location of interest. These measurements are used to determine the cells that could be used by a phone when located at, or close to, the address and when the phone may have been in the vicinity. It should be noted that the use of surveyed cells does not prove that the phone was near the address and a drive survey to determine the extent of the service area of the cells used may be appropriate.
Finally, a location survey can also be used to aid in determining whether the site is the home address of the user of the phone. This process identifies the quiet periods within the CDRs consistent with the user having gone to sleep and then uses the CDR entries either side of these to determine the cells that provide service at the home location. These cells can be compared to the survey measurements to determine whether the CDRs are consistent with the surveyed address.
The post What is Cell Site Analysis? appeared first on CYFOR.