This article covers method. It assumes throughout that records have been obtained through proper legal authorisation.
What a CDR contains
A call detail record is a billing artefact repurposed as evidence. Fields vary by operator but typically include calling and called numbers, date and time, duration, call type, IMEI, IMSI, and cell identity.
Two properties shape everything: It records association, not content. A CDR establishes that two numbers were connected for a duration. It says nothing about who held either handset.
Location data is coarse and non-uniform. Cell identity places a handset within a sector, which in dense urban deployment may be a few hundred metres and in rural deployment several kilometres.
Analysts who internalise these properties produce defensible work.
Core analytical techniques
Frequency and pattern analysis — rank contacts by call count, duration and recency.
Common contact analysis — given two targets, identify numbers contacted by both. This is the single most productive CDR technique for establishing association between individuals who deny knowing each other.
Temporal analysis — plot activity by hour and day. Deviations from baseline are more informative than the baseline itself.
Tower and movement analysis — sequencing serving-cell records produces approximate movement pattern.
IMEI and SIM correlation — reveals handset sharing, SIM rotation and multi-SIM use.
The interpretation errors that matter
Subscriber identity is not user identity. Establishing who held a handset requires corroboration independent of the CDR.
Absence of records is not absence of activity.
Correlation of presence is not association.
Format drift breaks pipelines silently. Operators change column ordering without notice.
Time zone and format inconsistency. A single misparsed date column reorders an entire timeline.
Where tooling changes the outcome
Manual analysis is viable for a single target across a short window. It stops being viable at three targets across ninety days.
Purpose-built tooling should ingest each operator’s format without manual restructuring, validate and normalise timestamps, resolve numbers to entities, run analysis at scale, and log every query.
pi-scout ingests multi-operator CDR formats, resolves entities across cases, and provides graph-based communication analysis with full query auditing.
