This article covers CDR analysis method. It assumes throughout that records have been obtained through proper legal authorisation from the competent authority, and it is not concerned with acquisition. Analysis of records held without lawful basis is not an investigative technique; it is an offence, and no methodology discussion changes that.
What a CDR contains
A call detail record is a billing artefact repurposed as evidence. Fields vary by operator but typically include the calling and called numbers, date and time, duration, call type, the IMEI of the handset, the IMSI of the SIM, and cell identity information for the serving tower, often with sector or azimuth data.
Two properties of this dataset shape everything that follows.
It records association, not content. A CDR establishes that two numbers were connected for a duration. It says nothing about who held either handset or what was said.
Location data is coarse and non-uniform. Cell identity places a handset within the coverage area of a sector, which in dense urban deployment may be a few hundred metres and in rural deployment may be several kilometres. It is not a position fix.
Analysts who internalise these two properties produce defensible work. Analysts who do not produce timelines that place people at addresses with a precision the data cannot support.
Core analytical techniques
Frequency and pattern analysis
Rank contacts by call count, total duration and recency. The structure of a target’s communication life becomes visible quickly: a small number of high-frequency contacts, a long tail of infrequent ones, and – often most informative – numbers contacted intensively for a short period and then never again.
That last pattern is frequently the operationally relevant one. A number active for eleven days around the incident window and dormant before and after is worth more attention than the number called every day for two years.
Common contact analysis
Given two or more targets, identify numbers contacted by all of them. This is the single most productive CDR technique for establishing association between individuals who deny knowing each other, and it scales poorly in spreadsheets and trivially in a graph. See our guide to link analysis software for how this graph-based approach works more broadly.
Interpret with care. Shared contacts include shopkeepers, autorickshaw drivers, common relatives and customer service numbers. Filter high-degree numbers before drawing conclusions.
Temporal analysis
Plot activity by hour of day and day of week. Deviations from an established baseline are more informative than the baseline itself: a target whose activity is consistently diurnal showing sustained late-night activity in a specific week is a lead.
Around a known incident time, the immediate aftermath window is usually the highest-yield period in the entire dataset. People make calls after events.
Tower and movement analysis
Sequencing serving-cell records produces an approximate movement pattern. Used correctly, this supports or contradicts an account of movement. Used incorrectly, it fabricates precision.
Legitimate inferences: the handset was within the coverage area of a sector at a time; the handset moved between coverage areas in a direction; the handset’s pattern is inconsistent with a claim of being elsewhere, where the areas are far apart.
Illegitimate inferences: the handset was at a specific building; the handset was stationary because records are absent; two handsets were together because both used the same tower, in an area where that tower serves fifty thousand people.
Tower dump analysis
Records for all handsets served by a cell in a window, obtained under specific authorisation, allow identification of numbers present at multiple incident locations. Analytically powerful for serial offences.
It is also the technique with the widest reach into people who are not suspects, and it demands the tightest discipline: narrow windows, prompt elimination, documented minimisation, and strict access control over the resulting dataset.
IMEI and SIM correlation
IMEI-to-IMSI mappings reveal handset sharing, SIM rotation and multi-SIM use. A single IMEI carrying several IMSIs sequentially is a common pattern in organised offending. The inverse – one IMSI moving across handsets – indicates handset changes.
Note that IMEI values can be duplicated or reprogrammed, particularly on low-cost devices, and analysis should account for the possibility.
The interpretation errors that matter
Subscriber identity is not user identity. A large share of connections in India are not used by the registered subscriber. Establishing who held a handset requires corroboration independent of the CDR.
Absence of records is not absence of activity. Handset off, no coverage, data-only communication, an alternative device. Records show what the network billed, not what a person did.
Correlation of presence is not association. Two numbers on the same tower in a dense area is a weak signal.
Format drift breaks pipelines silently. Operators change column ordering, date formats and encoding without notice. Ingestion should validate schema on every import and fail loudly.
Time zone and format inconsistency. Records arrive with mixed date conventions. A single misparsed date column will reorder an entire timeline.
Where CDR analysis tooling changes the outcome
Manual analysis is viable for a single target across a short window. It stops being viable at three targets across ninety days, which is a routine case shape.
Purpose-built tooling should ingest each operator’s format without manual restructuring, validate and normalise timestamps, resolve numbers to entities across cases, run common-contact and frequency analysis at scale, render the communication network as a graph, sequence tower data on a map with honest coverage representation rather than point pins, and log every query against the dataset.
That last requirement is the one most often missing and most consequential. A CDR dataset is sensitive personal data about a large number of uninvolved people. Query-level audit logging is what makes its retention defensible.
Presenting CDR findings
State the legal authorisation and its scope. State the source and period of records. State the analytical method. Express location findings as coverage areas rather than points. Distinguish clearly between what the records establish and what they are consistent with.
A CDR analysis that is honest about its own resolution is considerably harder to attack than one that overstates and is then dismantled on a single overreaching claim. For the broader stack this analysis typically sits within, see our overview of crime analysis software, or explore how pi-scout handles CDR ingestion and analysis at scale.
