Subujoseph, the observations below are suggested in response to your questions. The observations are for research purposes only and are not given to advise you in any case you are currently handling. Obviously we couldn't and shouldn't discuss live cases anyway as I am not instructed to advise nor am I providing evidence for any case. I feel sure you know this already but for clarification purposes it needs to be stated for anyone else reading this thread.
The question here is "Is the date/time shown with cell usage for GPRS usage accurate?
I do not have an answer for you as the information you have given is insufficient to draw a conclusion. As an observation though, an investigator should not be working totally in the dark and with minimal tech understanding/knowledge. The interpretation about call records/charging records should have been served in a witness statement from the relevant operator identify exactly the meaning of each heading and corroboration from the network operator about the relevance date/time stamps YY/MM/DD & HH/MM/SS as per each record and any disparities to be aware.
You mentioned H3G earlier but made no mention about any donor roaming mobile operator's network carrying any CS or GPRS traffic that would generate a second call/charging record? If that were known it may impact or inform your research
You may wish to research here http//
Did that cell usage occurred at that exact time?" Is this a simple Yes or No question or does the answer require much more elaborate analysis as indicated in your blog?
From the info you have given it would not be helpful to you to give a simple yes or no to your question about exact time. Not certain what you mean by elaborate, but maybe my comments might help. If not then I need to know the discovery process you believe to be elaborate?
I do recall reading maybe three or four years ago about GPRS attach and SGSN detach states having some problems concerning a mobile in GPRS attach state and the SGSN performed a detach state following detach timer expiry. As I recall this was a reference to a mobile moving from one LAC/RAC to another with the same GPRS channel allocated but with no GPRS ready state connection. The mobile having moved to a new LAC/RAC the network still had in the register the mobile with the previous (old) LAC/RAC. Unfortunately, I do not know who the relevant mobile network was back then or the relevant mobile device. Whether this scenario would generate a false location reference for a call/charging record might inform your research.
Compilations
I am always wary of compilation documents (reports/spreadhseets etc) largely because they take no account of mistakes made by the person/s who may have compiled the data in the compilation documents. Perhaps you could clarify whether your research actually concerns working with a copy of the original data?
This is what I found - For e.g. If there is a GPRS usage at 123015hrs utilising a cell-12345 and later there is also another GPRS usage at 131510hrs again utilising the same cell-12345, then the second record cannot be relied upon because the cell id indicated in the second record is a duplicate from the 1st record. Please note that there is other evidence (CCTV, ANPR etc.) which shows that the phone have moved away from the area served by the cell-12345.
Dealing with CCTV and ANPR as a statement of fact neither are elements forming part of routing communications to or from a mobile device in GSM/WCDMA/LTE. Neither actually knows the precise mobile device. As you have only identified two GPRS events how does the CCTV and ANPR corroborate the mobile device hadn't remained in the same LAC/RAC and another mobile device was used?
Hello Pals!
I have been looking at the subject matter and its getting me more confused as to what its meant to achieve. I think its all dependent on the software extracting the records which vary from one Network to another. Some yard sticks are set to extract the first cell tower, while some are set to recover first and last, while others are set to recover the last. Another problem this poses is if the Mobile is in motion and distance it covers within the period under investigation. I think this is the much i can add.