- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
This is a plain-English guide for everyday people and attorneys. It explains what call detail records (CDRs) are, what they typically contain, and what they typically do not contain. It is not technical training and is not legal advice.
For a separate, higher-level overview of how CDRs relate to mapping and timelines, see CDR analysis and cell tower mapping.
A CDR is a carrier-generated record that summarizes a communication event—such as a phone call, a text message entry, or a data session entry. Think of it like a “receipt” or log line: it typically shows when something happened, who it involved, and sometimes which network resources were used.
Common, defensible uses include:
Important limitations to understand:
CDRs can contain unfamiliar labels and IDs.
Not every carrier provides the same columns, but most CDRs include several of the items below. The goal here is to make the terminology readable—not to provide deep technical detail.
| Field (common label) | Plain-English meaning | Why it matters |
|---|---|---|
| Date / Time (sometimes UTC) | When the event occurred (call start, message event time, etc.) | Forms the backbone of any timeline; time zone mistakes can change interpretations |
| Calling / Originating Number | The number that initiated the call or message | Helps show direction and who started the communication |
| Called / Terminating Number | The receiving number | Helps confirm counterparties and communication patterns |
| Direction (MO/MT, Outgoing/Incoming) | Whether the event was outgoing or incoming | Clarifies who initiated and can resolve “he called me” disputes |
| Duration | How long the call lasted (if a voice call record) | Useful for context (missed call vs conversation); not applicable to all record types |
| Event Type (voice/SMS/MMS/data) | What kind of communication it was | Helps categorize activity in a timeline (calls vs texts vs data) |
| Cell Site / Tower ID (or similar) | Identifier for the network resource used near the time of the event | Can support approximate geographic context, but it is not GPS |
| IMEI / Device ID (sometimes included) | Identifier associated with a device used on the line | Can help differentiate devices and identify potential device changes over time |
Note: A single “line” in a CDR does not automatically identify the person holding the phone at that moment. It generally documents activity associated with a line/device.
Understanding what is typically missing prevents unrealistic expectations and misinterpretations.
CDRs most commonly show metadata (the “who/when/how”), not content (the “what was said”).
People often expect CDRs to provide “exact location.” In reality, location is often indirect (tower/sector context) and can vary in precision.
The safest approach is to treat CDRs as a timeline source first, then cautiously add context (like tower/sector) only when the records support it.
Confirm the time zone (often UTC) and normalize it before drawing conclusions.
Direction fields prevent common misunderstandings in disputes.
Tower/sector fields can add context but should not be treated like a pin on a map without supporting records.
These are common terms you may see in call records and related cellular records.
For a deeper (still non-technical) glossary specific to towers/sectors/azimuth, see: Azimuth, Sectors, and Cell IDs (Glossary).
Usually, no. Many CDRs provide indirect network context (like a tower/sector identifier) rather than GPS coordinates. The level of location detail depends on the carrier, the record type, and what was requested.
Typically, no. CDRs generally show metadata (who/when/duration/type) rather than the content of what was said or written. Separate legal processes and data sources may be required for content, depending on the circumstances.
Many carrier records use UTC or include offsets that must be converted. If someone mixes time zones or formats, the timeline can appear shifted. A consistent conversion approach is critical.
A CDR generally documents activity associated with a line/device on a network. It does not automatically identify the individual holding the device at that moment. Identity questions often require corroborating evidence.
People use these terms interchangeably, but the source matters. A phone’s on-device call log is different from a carrier CDR. Carrier records are generated by the network and often contain fields that do not appear on the phone.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder