Cell Site Analysis and data validation: bringing the digital environment to justice

Our everyday world is enabled by technology and mobile devices. Everyone owns at least a cell phone generating communication, an individual's digital footprint. From an investigative point of view, this constitutes a complex array of information that can be evaluated and analyzed with modern technologies, following forensically sound practices.

A Call Detail Record (CDR) is the individual’s digital footprint: data registered and produced for all telecommunication exchange between mobile devices and the service infrastructure, documenting the details of calls or other transactions, for example, messages or data usage.

For service providers, CDRs are the basis for the generation of telephone bills. Carriers securely store many facts relative to the device's user activity: the files contain attributes such as the source and destination number, transmission date, time, duration, and more. They provide a way of tracking and mapping the position of a transmission relative to the connected cell towers used by devices in communication with each other.

In an investigation, these records represent an evidence source of the highest level of inalterability compared to others. In analyzing them, the potential of identifying cyber footprints, and revealing details relative to relationships with associates, communication and behavior patterns, and even geographical data, that can establish a proficient initial source of information for the investigation.

This practice is reinforced by exploring other factors: evidence available from a call detail record and correlated with other research becomes the means of creating a strong case. Another aspect to take into consideration, in support and in confirmation of the CDR itself, is looking at the network infrastructure more in-depth.

A network is a series of cell towers (BTS), the infrastructure that creates an individual’s mobile communication. The coverage and site performance it expresses are significant features to understand when creating a case. Cell Site Analysis (CSA) is the study of these networks, which has now become an important part of modern investigation. Invaluable and admissible court evidence is determined by underlining the connection between devices and individuals and linking these to the outlook of the real cell site environment that surrounds them.

Performing surveys of the BTS coverage is a critical aspect of forensic analysis to counteract weak evidence given by, for example, an incomplete or debatable mobile device extraction or, in the same vein, validate or strengthen what CDRs state as being true.

The natural evolution of a well-performed investigation is to move forward in processing and combining this knowledge with other sources. The digital environment, where devices and the network interact with each other, is where other evidence materializes: mobile extractions, CCTV camera feeds, GPX movement tracks, traffic logs, and traditional evidence.

The objective is to discover and present the connection between these sources and what is recorded in CDRs and defined in BTS cell site analysis. The interconnection of multiple evidence sources, which support and complement each other, confirm, and solidify the investigator’s job of bringing justice.