Call Data Records

http//www.cellulardataresources.com/

Here's a site you might check out. I know it's not be exactly what you are looking for, but they do have some good links.

koppite, one problem you will run into is that CDR etc formats are not same. Analytical consideration of their content will equally challenge. Evidentially, the information seen served in evidence more often that not is watered-down (in some cases quite considerably). A further aspect that you will find challenging is when you add to your analysis the proliferation of compilation documents (not originals, mind you; I suppose this could be said to be analogous to a pseudo illustration of suggested originality) containing purported copy & pasted data (with added errors) which have been treated to some form of additional assumed speculative titling.

Some points for critique, maybe?

Greg,

If I were to request CDR’s for a specific number and time frame, within that time frame I may find that only a portion of the complete record is relevant and necessary to submit to a jury. Is that what you are referring to as being “watered down?”

I would suggest that anyone altering the records make sure they make a copy of the originals and document the changes they made. Look at them, look at them again, go to lunch and look at them and then go home for the night and check them the next day to check for any errors.

In your teaching do you suggest some sort of peer review?

If I were to request CDR’s for a specific number and time frame, within that time frame I may find that only a portion of the complete record is relevant and necessary to submit to a jury. Is that what you are referring to as being “watered down?”

Partly that is true, but the major problem is that evidence that you may not consider relevant could in fact be highly relevant, and it maybe disgarded because you didn't know it had a value or for some other reason. I am speaking figuratively, of course.

CDRs should not be broken down but the entire/complete record including any SS events etc should be included. For the sake of coming to the matter with the clean hands and fair trials content from CDR content should not be selectively chosen for evidence based upon the competency of the individual looking at the CDR. By presenting the entire CDR the person could then demonstrate the parts from it that s/he claims supports their case and then the other side should be able to agree or demonstrate content that detracts from the stated case claims.

I would suggest that anyone altering the records make sure they make a copy of the originals and document the changes they made. Look at them, look at them again, go to lunch and look at them and then go home for the night and check them the next day to check for any errors.

That is ok to ensure your confidence with your compilation of content. But the first port of call is to make sure you present the whole CDR/s to the other side

a) so that they can check the original against the compilation

b) for the purposes of evidence it is irrelevant whether you think you have got it right or not; for that judgment surely should be made by the court after assessment by the other party to either agree with you or disagree

In your teaching do you suggest some sort of peer review?

To whom do you imagine Peer Review should be requested, and what access to evidence would s/he, they have? How do you rank the competency and skillset of the Peer Reviewer?

Greg,
Yes, there is always the chance that evidence may not be considered relevant, but that is true in any case. That’s why we turn over everything. Not just because it’s the right thing to do, but it’s the law.

I believe the entire records should be provided, but you can overwhelm a juror with numbers and codes. That being said I know that some jurors get tired of just listening and do like visual aids as well. Without altering the records, sometimes a short power point presentation can drive home the specifics of a case.

By peer review I’m referring to verifying the accuracy of the data I would be presenting. If I was to do a power point or somehow consolidate the records I would want them to be checked for accuracy. If I started to branch out into presenting a case based upon the evidence I guess, depending on the skill sets of the “peer”, there exists the possibility of influencing the other persons conclusion. In conversation it is common for people, when asked do you understand, to say “yeah” or “right” when they don’t just to fit in.

…Yes, there is always the chance that evidence may not be considered relevant, but that is true in any case. That’s why we turn over everything. Not just because it’s the right thing to do, but it’s the law.

I believe the entire records should be provided, but you can overwhelm a juror with numbers and codes. That being said I know that some jurors get tired of just listening and do like visual aids as well. Without altering the records, sometimes a short power point presentation can drive home the specifics of a case.

I am not disagreeing with you about how you wish to conduct your investigation. That agreement is because I do not ask you to justify yourself (figuratively speaking) to me or another expert. You have to do that for yourself to the Court. What I am talking about is where people play poker with the evidence and hold evidence back, playing games with it in some silly attempt to pretend its strategy.

I agree with you the entire record, as complete record of all of its parts, should be provided. Evidence generated 9 times out of 10 is based upon the personnel of the operator saying what do you want? The requestor's competencies and skillsets are now tested because if s/he has only a vague idea or doesn't know then that forms the basis of the evidence meandouring around in a case with gullibility riding high about the interpretation of the evidence. So the complete record should always be presented and if, say, the prosecution/defence want to place an interpretation about the content in the "genuine original" then fine let them do so. But to try and swerve the criminal justice system with a compilation, passing it off as 'that is all that is needed and the court will make do with what it is given' undermines the foundation of evidential law and justice.

By peer review I’m referring to verifying the accuracy of the data I would be presenting. If I was to do a power point or somehow consolidate the records I would want them to be checked for accuracy. If I started to branch out into presenting a case based upon the evidence I guess, depending on the skill sets of the “peer”, there exists the possibility of influencing the other persons conclusion. In conversation it is common for people, when asked do you understand, to say “yeah” or “right” when they don’t just to fit in.

Thanks for explaining and I see where you are coming from. Your's and my understanding on Peer Review seem to be different. I see what you have mentioned as nothing more than an editorial proof reading, where as Peer Review would substantially provide something beyond proof reading.

For isntance, your post here

http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=7122

Now to your credit you have found something out about additional data associated with mobile calls that maybe available. You get that info but really don't understand it or vaguely get the gist. You find out some bits and run with what you know as your evidence. You ask someone else to check your work who has the knowledge or less than you have. So if both of you perhaps make a mistake where is the Peer Review in that to achieve what you wanted it to achieve?

This is why I was asking because I am sure someone else will provide yet a further definition of what they think Peer Review means.

Hello Everybody,
Am at a loss of what the argument is for? I think by his words he stated "Can anyone tell me where to get good and useable info on Call Data Records. What their formatis, how to analyze them etc. I am doing research for masters and would like some advice on this topic , please. I cannot find too much on the web although i am new to all this."
You must also note that CDR has its own error like false interpretations of BTS due to handovers, etc;

I think we should all focus around the aid he wants us to provide;

A CDR is a call history of a define subscriber showing calls or Short Message Service (SMS) or Multi Media Message (MMS), or any other data exchange done via caller status using a define network. It states the time, date, numbers calling, number called, post paid names , originating Base Trans-receiver Station (BTS) site, terminating BTS site, Originating IMEI, Terminating IMEI, Base Station identity to mention but a few. CDR’s are usually presented in spread sheets as it gives the reader the ability to rotate the data in rows and columns without hitches.
A typical CDR displays the following;
a. Number Calling (Originating number) This is the number of a defined subscriber calling another subscriber within or outside the network or the number sending out SMS, MMS etc.
b. Number Called (Terminating number) This the number of a defined subscriber receiving calls or other network services from another number in the network.
c. Date of Call This the date in which calls were made on the network service.
d. Time of Call This is the time in which calls were routed usually expressed in seconds.
e. Duration This has to do with the billing system of the network showing how long the person spent on each call made. It is used in billing while investigators use this to know the frequency in calls and intimacy that exist between both subscribers. It is usually expressed in seconds.
f. Originating BTS site is the site or mast from which the call is routed to the MSC. Its signals are usually measured in geographical knots. It’s the bearing for measuring triangulation of the mobile equipment. Every BTS has its bandwidth it can cover and they are of different categories e.g. Hop sites and End sites etc.
g. Terminating BTS site is the site or mast from where the call is received or answered from the MSC. Its signals are also measured in geographical knots.
h. Originating IMEI number This is the serial number of the phone originating the call.
i. Terminating IMEI number This is the serial number of the phone receiving the call
Depending on what you need the CDR For, if investigation the under listed can help;

As investigating Officers after receiving a CDR, we are obliged to start up with IMEI analysis, Call frequency Analysis, BTS Analysis and P to P transfer.
IMEI Analysis
28. An IMEI analysis is the cross check of the number of IMEI’s used in a defined CDR. Some CDR’s contain multiple IMEI which should be noted by the investigation officers as this could be signs into furthering the investigation, providing more leads.
IMEI Analysis
1. 355873001018210
2. 356185002396050
3. 353615010541030.
Call frequency Analysis
29. Call frequency Analysis is an analysis of all calls within a define CDR, noting how many times such calls were made from the analyzed CDR. It shows location and how many times the calls were routed from caller to called numbers and vice versa, it includes SMS or any other call feature in a CDR. It is usually expressed in Originating and Terminating Calls.
Call Frequency Analysis.
2348034731462

1. 2348065355377 1 Cell.
2. 2347035989587 13 Cells.
3. 2348034483116 1 Cell.
4. 2347031107340 1 Cell.
5. 2348062192683 1 Cell.
6. 2347037262685 1 Cell.
7. 2348067587469 1 Cell.
8. 2348037421417 6 Cells. *****
9. 07026730376 1 Cell.
10. 2348033132507 2 Cells.
11. 2347036366665 1 Cell.
12. 2347033660456 1 Cell.

Base Transceiver Station Analysis
30. This is an analysis of the frequency of usage of a mobile station on a BTS in a particular location for a clearer understanding of the area of operation of a defined subscriber.

P to P Transfer.
31. This is the analysis of a cash transfer in a defined CDR. For Instance MTN Sell n Share is represented with 777 which shows that the a particular amount of money was transferred from one MTN number to another.

33. A comprehensive study of the afore- written essay will pave way for the following;-

a. In reported cases of phone theft without the thief removing the SIM card; when the phone is put to use the IMSI will enable the trace of the phone and CDR will show numbers dialed or transfer of money made from phone.
b. In reported cases of phone theft where the SIM card is removed; the phone upon usage could be traced with via its IMEI, even if a different SIM is inserted into the phone.
c. In reported cases of harassment or threat calls or in commission of a crime with hidden phone numbers, such phones could be traced with both their IMEI & IMSI as the numbers are not hidden from the Base Station. Hiding of numbers is only configured for phone to phone transaction.
d. The study would enthrone the ability to arrest any person who is declared wanted who goes into hiding once his phone numbers are known. The IMEI & IMSI would reveal the person’s location as this also aids for faceless arrest. Even in the event of a change in SIM, a network search of for the IMEI will provide his current number and location.
e. The study could unveil the ability to place lines under investigation as such line could be recorded as evidence presentable in Law courts.
f. Phones could be used as guide for surveillance operations to determine contacts and locations visited by suspect.
g. Phone records can be used to expand investigations on both a persons past and present contacts especially when it involves unknown sponsorship. Yearly records could be gotten via the Home Location Register (HLR).
h. The Equipment Identity Register (EIR) can also be useful in ascertaining calls that came through a BTS location where an investigation is being carried out. For Instance when a murder or robbery is committed in a particular area at a particular time, all calls made and received could be securitized to see whether the offenders made contacts after their deed. It also registers the IMEI that has passed through the network which can be recalled for purposes of investigation.
Cheers!

Ninja,

If you read my first post, I suggested that koppite "may" wish to critique the matter. Ed took one line and I took another. Ed and I aren't arguing, or at least I hope not. Ed raises interesting topics and is a good contributor to the forum. OK.

Trewmte,
Am sorry, I don't mean no disrespect to you or Ed. I considered that one must learn 'A' before he can get to 'Z', please forgive me.

Noel.