CYFOR Blog

When conducting Cell Site Analysis or CDR Analysis it is imperative that only the raw call data that has been provided by the networks is used.

There are a host of reasons for this, the main one being that the data needs to be provided in Excel and PDF format so that checks can be completed to prove that data has not been edited prior to being processed for analysis. When a request for call data from a service provider has been submitted, they, under normal circumstances, provide the data in both excel and PDF formats. The excel format is used to process the call data record into a usable format, which is then subsequently analysed and mapped.

In a number of cases, we are provided with excel documents that contain call data records that have been processed by the prosecution analysts. Whilst we understand that this may appear helpful, unfortunately, we are unable to use these files evidentially. As digital forensic experts, we need to be comfortable that the data supplied is all of the data available. A pre-processed call data record may have data omitted that may assist a potential defence. On other occasions we are only provided call data records in PDF format, these cannot be processed into a mapping product and offer a very limited scope for analysis.

In order to prevent lengthy delays in processing your requests, we need to look at preserving the raw call data at the earliest opportunity. Unless it has already been obtained by the prosecution, you can only request call data from the networks going back 12 months, as the network providers are not legally obliged to retain it for longer.

Early submission of raw call data to cell site experts means that a more streamlined approach to the analysis can be completed. As a result, this improves the turnaround time for digital forensic reports.