Demystifying Call Detail Records

Call detail records, commonly known as CDRs, show up in nearly every case involving a mobile phone. They appear in homicides and armed robberies. They appear in distracted driving suits, contract disputes, divorce proceedings, and wrongful death claims. Attorneys on both sides of the docket are expected to understand what these records show, what they do not show, and where opposing counsel might overreach. This article walks through the fundamentals so that criminal defense lawyers, prosecutors, and civil litigators can read a CDR with confidence and ask the right questions of the carrier, the investigator, and any retained expert.

What a Call Detail Record Actually Is

A call detail record is a transactional log produced by a cellular carrier each time a device interacts with the network. Carriers generate CDRs for billing, network engineering, fraud detection, and lawful response to legal process. A typical record line includes the originating and terminating phone numbers, the date and time of the event, the duration of the call or session, the type of event (voice, SMS, MMS, or data), and the identifier of the cell sector that handled the event. Many carrier productions also include the sector azimuth, the latitude and longitude of the tower, and in some cases timing advance, RTT, or per call measurement data.

It is a structured log of network events, and reading it correctly requires understanding how cellular telephone networks are organized, what the carrier captured, and what the carrier did not.

Billing Records Are Not the Same as CDRs

One of the most common mistakes in early case work is treating a carrier billing statement as a substitute for a CDR. A customer can pull a billing statement from an online portal in minutes. That document shows numbers dialed and minutes used. It generally does not show cell sector information, sector azimuth, or the technical fields needed for any meaningful location analysis.

A proper CDR is produced by the carrier in response to legal process and includes the engineering fields that an analyst needs. Attorneys who confuse the two often discover the error well into discovery, sometimes after deadlines have passed. The first practical step in any case involving phone evidence is to confirm which document the file contains.

Cell Site Location Information and the Tower Selection Question

Cell Site Location Information (CSLI) refers to the cell sector data inside the CDR that allows an analyst to associate an event with a tower and a directional sector. CSLI is the foundation of historical cell site analysis. A frequent question from attorneys is simple to ask and surprisingly hard to answer: does a phone always connect to the closest tower? The answer is no. Tower selection is influenced by signal strength, network load, terrain, weather, building materials, the orientation of the device, and the configuration of the network at that moment.

This distinction matters in court. A CDR can place a device within a service area consistent with a particular tower and sector. It generally cannot pinpoint a street address. Counsel who present CSLI as more precise than it is risk both an adverse ruling and a credibility problem with the jury once a competent cross-examination begins.

Advanced Location Data: Timing Advance, RTT, NELOS, and PCMD

Beyond the basic cell sector field, modern productions from 4G and beyond sometimes include advanced measurements. Timing advance is a value used by the network to manage signal timing and can be converted, with care, into an approximate distance from the serving tower. Round Trip Time, or RTT, measures the time a signal takes to travel between the device and the network. AT&T uses a proprietary system known as the Network Event Location System, or NELOS, while other carriers rely on Per Call Measurement Data, or PCMD. These engineering records can be overwhelming and easily misinterpreted.

The records can sharpen an analysis, but each has limits. Timing advance values can appear shorter than the actual distance traveled because of how the network reports them.

What CDRs Can and Cannot Show

CDRs are well suited to several specific tasks. They can establish that two numbers communicated at a particular time. They can show patterns of contact between people of interest. They can place a device within a service area at a given moment. They can confirm or refute that a phone was actively engaged with the network at the time of a collision, a robbery, or a disputed conversation.

CDRs are less suited to other tasks. They cannot establish who held the phone. They cannot capture the contents of a text message, a chat, or an encrypted application. They cannot reliably show indoor location at the precision of a single room. They cannot, on their own, prove that a person was driving rather than riding as a passenger. These gaps are filled by other forms of evidence, including device extractions, application data, vehicle telematics, Wi-Fi logs, and Google Location History.

The Clock Is Already Running: Preservation and Subpoenas

Carrier retention periods are short, uneven across providers, and subject to change. Federal regulations require carriers to retain certain toll billing records for eighteen months,¹ but the engineering data behind those records—including detailed CSLI and advanced location measurements—often disappears far sooner. Some location records are gone in a matter of days. Tower lists and sector configurations may not be available at all after a brief window.

Practical guidance for any attorney with phone evidence in a case is to send a preservation letter as soon as the case is opened. It directs the carrier to hold the requested data while formal process is prepared. The letter should identify the target number, the date range, and the categories of data requested, including voice CDRs, SMS CDRs, data session records, and any available advanced location data.

Formal compulsion typically proceeds under the Stored Communications Act, which sets out the levels of process required for different categories of records.² Content of communications requires a search warrant. Historical location data of any significant duration also requires a warrant under Carpenter v. United States.³ Subscriber information and certain transactional records may be obtained with a subpoena or court order, depending on the category. Counsel should match the level of process to the data sought, then anticipate motion practice on the scope of the request.

Reading the Production: A Practical Workflow

When a carrier production lands on the desk, a disciplined workflow helps avoid the common mistakes.

• Identify the type of document produced. Confirm whether it is a CDR with engineering fields, a billing statement, or a subscriber information sheet.
• Verify the date range. Carriers sometimes produce a narrower window than the legal process specified.
• Identify the fields present. A useful CSLI analysis includes, at minimum, the cell sector identifier, the sector azimuth, and the tower coordinates. Without those fields, any location work is severely limited.
• Confirm the time zone. Cell phone records are often produced in Coordinated Universal Time (UTC), while events at issue are described in local time. Misalignment by a few hours has changed the outcome of more than one case.
• Watch for gaps. A long gap in records during an otherwise active period may indicate the phone was powered down, in airplane mode, out of service area, or that the carrier did not produce the full file. Each explanation has different implications, and an analyst should be able to rule out the production error before counsel argues the behavioral explanation to a jury.

Working with an Expert

Most attorneys who handle phone evidence regularly come to rely on experts. A retained expert generally provides three things: a written analysis of the records, a set of exhibits suitable for trial, and direct or cross testimony as needed.

Counsel should engage an expert early, ideally before the subpoena is drafted. An experienced analyst can advise on the categories of data to request, the language of the request, and the scope of the preservation letter. Late engagement—after a production has already been received in an inadequate format—often produces avoidable expense and lost evidence.

When evaluating an expert, consider the qualifications relevant to the case at hand. A background in law enforcement cellular analysis, formal training in digital forensics, telecommunications certifications, courtroom experience, and a record of analyses that have withstood challenge are the basic markers. The expert should be willing to discuss the limits of the data, not just its strengths.

A Brief Closing Word

Call detail records are powerful evidence when read carefully and presented honestly. They are also one of the more commonly overstated forms of digital evidence in modern litigation. Attorneys who understand the structure of a CDR, the difference between billing and engineering data, the limits of CSLI, and the procedural requirements of preservation and compulsion will be better positioned than opposing counsel in nearly every case where phone records appear.

The technology continues to evolve. The arrival of 5G and the emergence of 6G research raise new questions about how cell site analysis will be performed in the coming years. The fundamentals covered here, however, will remain the starting point for the foreseeable future.

---