Cell Site Experts and Corporate Forensic Investigations

The requirement for cell site experts is becoming more prevalent within corporate forensic investigations.

With the prolific use of mobile phones, being able to determine the movement and location of a handset can be invaluable admissible evidence in court. Whilst the requirement for cell site experts has been commonplace in criminal investigations for some time, the application of cell site analysis is becoming more prevalent within corporate forensic investigations. The data obtained by cell site experts can be crucial for companies that require digital evidence for internal corporate investigations, covering a range of circumstances, including:

• Employee misconduct investigations.
• Data theft.
• Fraudulent activity.
• Mismanagement and theft of intellectual property.
• Corruption and bribery investigations.

What is Cell Site Analysis?

When a mobile phone makes or receives a call, sends or receives a text message, or connects to the internet, it connects to a cell site. The record of this communication is stored by the network that the phone connects to for 12 months. This golden copy of the records does not require the device, and furthermore, it is retained by the network regardless of what happens to the phone, or the contents of it. Should the location of the cell be of importance to your investigation, a Radio Frequency (RF) survey can be completed at locations of interest to establish whether the cell concerned serves the location of interest, thus showing the user of the phone could have been at that location. This information can prove invaluable during the course of a corporate investigation or during a court case.

Smartphones will often connect to the internet in the background, be that to check for emails, or run an application, which means that even when it is not on a call or involved in a text message, it could be generating data indicating the locality it is in as frequently as every few minutes. Cell site experts can examine this information within the call data records (CDRs) provided by mobile networks to determine whether a suspect could have been at a particular location at a specific time. Conversely, a defender may retrieve this information in order to be able to prove that their client, or their mobile phone, was not at a given location at a particular time and may have been elsewhere.

What are CDRs?

Call Data Records (CDRs) are a golden copy of communications data by a mobile device held by the networks for 12 months and are not tampered with in any way. As such, examination of CDRs for any reason, be that for corporate clients, a criminal matter, or a family court matter, will provide the truth about the activity of a mobile phone whilst it is attached to the network. The CDRs that are provided by telephone networks contain several elements which can provide vital evidence:

• A record of who has been communicated with, detailing dates, times, and durations.
• Details of the device that was used.
• The location of the cell that was used, therefore the general area that the phone was in.

This means that further analysis can be done, such as:

• Highlight the number of contacts between different parties/telephone numbers.
• Identify when calls/messages took place but were subsequently deleted from the handset (when compared to a device examination).
• IMEI (International Mobile Equipment Identity) number swapping, which shows whether the SIM card of a specific device was moved into a different handset

Case Study | Vehicle Collision

CYFOR was recently instructed by a law firm for a corporate client whereby CDRs were obtained for a mobile phone belonging to the driver of a vehicle involved in a collision. Our team of cell site experts were able to accurately decipher what the CDRs revealed about the use of the handset and equip the client with vital information which they were then able to effectively use at court when dealing with the matter.

Case Study | Employee misconduct

Our cell site experts were required within an employee misconduct hearing, whereby an employee of the client was accused of communicating with competitors and passing private information to them. CYFOR’s cell site expert was able to examine the call data results of the work phone used by the employee and establish both communications with the competitor and the use of cells that served the competitor’s offices, indicating occasions that the former employee may have visited the location. This was used in the hearing by the company to take action against the staff member.