Quick navigation
What carrier records usually contain
Depending on the carrier and record type, historical call detail and network records may include items such as:
- Date/time and duration of events (voice calls, SMS/MMS, and sometimes data sessions)
- Direction (originating vs terminating)
- Identifiers (subscriber number, IMEI/IMSI, account identifiers depending on carrier)
- Cell site and sector identifiers (site ID, sector, or similar fields)
- Network parameters that may help interpret coverage (varies by carrier/product)
Important: Many carrier records represent the network connection used—not a precise GPS coordinate of the handset.
Interpreting location requires careful methodology and explicit limitations.
Cell towers, sectors, and azimuth explained
Most cell towers are configured with multiple antennas that serve different directions. These are often described as
sectors. Each sector has an approximate pointing direction called azimuth (measured in degrees).
What is a “sector”?
A sector is a portion of coverage served by a specific antenna orientation. In many areas, towers use three sectors
(commonly approximated as 120° slices), but the real-world coverage can differ due to terrain, building density, network load, and antenna design.
What is “azimuth”?
Azimuth is the direction the antenna is pointed (e.g., 0° = north, 90° = east). It is used to visualize the likely direction of coverage,
but it is not a guarantee of where a phone was located.
How historical cell site analysis works
A defensible HCSLI workflow typically includes:
- Record normalization: confirm time zones, formats, and event types
- Site/sector interpretation: identify the serving cell site and sector for each relevant event
- Mapping: plot towers and visualize sector azimuths for context
- Timeline correlation: compare network events to case timelines (dispatch logs, video, witness statements, etc.)
- Limitations documentation: explicitly state what the data supports and what it does not
What HCSLI can and cannot prove
What it can help evaluate
- Whether network activity is consistent with a broad area during a time window
- Whether a claimed timeline is plausible or inconsistent with the observed connections
- Whether multiple events suggest a general direction of travel (with important limitations)
What it generally cannot prove by itself
- Exact street-address location (unless the record type is a separate precision/location product and properly validated)
- Which person was holding the phone
- Intent or behavior beyond what the records show
Common misconception: The tower used for a call is not always the closest tower. Phones connect based on signal quality,
network conditions, available channels, and handoff logic—not simple distance.
Common case types (defense, appeals, post-conviction)
- Criminal defense: testing whether the timeline and claimed location evidence is consistent
- Appeals: reviewing methodology, assumptions, and whether conclusions exceeded what records can support
- Post-conviction: re-analysis when original work lacked documented limitations or used unsupported inferences
- Civil matters: disputes where timing and general movement consistency are relevant
Best practices and common pitfalls
- Time zone errors: UTC vs local time is one of the most common sources of incorrect conclusions
- Overstating precision: treating sector visualization as exact handset location
- Ignoring network behavior: load balancing, handoffs, and environmental factors
- Missing context: not correlating records to known events (video timestamps, dispatch logs, etc.)
Related resources
For a deeper dive into mapping workflows, timelines, and report deliverables, see:
CDR analysis and cell tower mapping.
Educational content only. This page does not provide legal advice and does not promise specific outcomes. All conclusions depend on the available records and documented limitations.
Elite Digital Forensics Assistant