The Application of Call Data Records in Corporate Forensic Investigations

Call data records can provide vital information about specific calls made from mobile phones. This data can provide businesses with the evidence about how, when and where calls were made.

What are Call Data Records?

Call data records (CDRs) are the recorded data from a specific phone number (e.g. text message, or phone call) produced by a telephone exchange from a mobile phone or similar device. However, the contents of the calls/messages are not revealed through a call data record. Call data records simply detail the calls or messages that took place, outlining basic call properties and measurements.

What information can Call Data Records identify?

• When the call took place, detailing specific dates, durations and times of calls and messages.
• Who made a call and who was the recipient of the call.
• Highlight the number of contacts between different parties/telephone numbers;
• Highlight all calls/messages which took place during evenings and weekends;
• Identify when calls/messages took place but were subsequently deleted from the handset;
• IMEI (International Mobile Equipment Identity) number swapping, which shows whether the SIM card of a specific device was moved into a different handset when calls were made.

What information can Call Data Records identify when combined with Cell Site Analysis?

When Call Data Record Analysis is combined with Cell Site Analysis, an accurate geographical location of the mobile device can be established, constructing conclusive evidence. Pattern analysis can also assist with identifying when a device travels over a significant distance.

Cell Site Analysis is a digital forensic process designed to establish the geographical location of a mobile phone when calls, messages or data is sent or received. This can determine if a device was within the vicinity of a location on a specific time and date and track the path of a mobile phone from location to location.

Combined with Call Data Records, the information gathered is used to graphically illustrate the movement and general locality of a device and/or user. This combined data is vital in establishing phone usage and user movements on various dates leading up to the events in question.

How can this be used within a corporate forensic investigation?

CDR logs list every billable communication from mobile phones, allowing definite records of how and when a phone was used. This data can be crucial for companies that require digital evidence for internal investigations, covering a range of circumstances, including:

• Employee investigations;
• Data theft;
• Fraudulent activity;
• Mismanagement and theft of intellectual property;
• Corruption and bribery investigations.