Explanation of the Terms Found in Call Data Record Analysis

Call Data Records (CDRs) contain numerous technical fields generated by telecommunications networks.

Understanding these terms is essential for digital forensic investigators, law enforcement analysts, and intelligence practitioners because each field can provide evidence relating to communication activity, device identification, subscriber attribution, and location analysis.

Subscriber Information

MSISDN (Mobile Station International Subscriber Directory Number)

The MSISDN is the subscriber’s telephone number.

Example:

+44 7123 456789

It represents the number dialled by users but does not uniquely identify either the SIM card or the handset.

IMSI (International Mobile Subscriber Identity)

The IMSI uniquely identifies the subscriber’s SIM card.

Example:

234150123456789

Components:

Mobile Country Code (MCC)
Mobile Network Code (MNC)

Mobile Subscriber Identification Number

Investigative significance:

Identifies a specific SIM.
Links multiple numbers to a subscriber.
Tracks SIM swaps.

IMEI (International Mobile Equipment Identity)

The IMEI identifies the physical mobile device.

Example:

356789123456789

Structure:

Type Allocation Code (TAC)
Serial Number
Check Digit

Forensic uses:

Identifying stolen devices.
Linking multiple SIM cards to one handset.
Detecting handset changes.

Call Information Fields

A-Party

The originating number.

Person making the call.

B-Party

The receiving number.

Person receiving the call.

Called Party Number

The destination number.

Calling Party Number

The source number initiating the communication.

Call Direction

Indicates:

MO = Mobile Originated
MT = Mobile Terminated

Mobile Originated (MO)

The subscriber initiated the call or message.

Mobile Terminated (MT)

The subscriber received the call or message.

Call Type

May include:

Voice
SMS
MMS
Data
Voicemail

Call Duration

Length of the call.

Usually measured in:

Seconds
Minutes

A zero duration call may indicate:

Missed call.
Unanswered call.
Rejected call.

Date and Time Fields

Start Time

The exact time the event began.

End Time

The exact time the event ended.

Timestamp

Date and time associated with the event.

Example:

2026-06-20 14:25:36 UTC

Time Zone Offset

Shows whether timestamps use:

UTC
Local time
Daylight saving adjustments

This is extremely important during investigations.

Location Information

Cell ID (CID)

A unique identifier for the cellular tower sector serving the device.

Example:

Cell ID: 48291

The Cell ID identifies a specific radio cell.

Location Area Code (LAC)

Identifies a geographical area containing multiple cells.

Purpose:

Reduces signalling traffic.
Helps track movement between areas.

Tracking Area Code (TAC)

Used in 4G and 5G networks.

Equivalent to the LAC used in earlier technologies.

eNodeB ID

Used in LTE networks.

Identifies the physical 4G base station.

gNodeB ID

Used in 5G networks.

Identifies the physical 5G base station.

Sector ID

Many towers have three sectors.

Each sector covers approximately 120 degrees.

Azimuth

The compass direction of the sector antenna.

Examples:

0° = North
90° = East
180° = South
270° = West

This helps estimate device location.

Timing Advance (TA)

Measures the delay between the handset and tower.

Higher TA values generally indicate greater distance.

Approximate ranges:

TA Value Distance

0 0–550 m

1 550–1,100 m

2 1,100–1,650 m

Network Information

MCC (Mobile Country Code)

Identifies the country.

Examples:

234 = United Kingdom
310 = United States

MNC (Mobile Network Code)

Identifies the mobile operator.

Examples:

Combined with MCC to identify the network.

CGI (Cell Global Identity)

A unique identifier combining:

MCC
MNC
LAC
Cell ID

APN (Access Point Name)

Used for mobile data services.

Examples:

internet
wap
mms

APNs identify the gateway used to access data services.

SMS and Messaging Fields

SMSC (Short Message Service Centre)

The server responsible for handling SMS messages.

Delivery Status

Indicates whether a message:

Delivered
Failed
Pending

Message Type

May indicate:

Data Session Fields

IP Address

Assigned during a data session.

Can assist in:

Internet activity investigations.
Attribution.
Service provider requests.

Session Duration

The length of a data connection.

Data Volume

The amount of data transferred.

Measured in:

Uplink

Data transmitted from the device.

Examples:

Uploading files.
Sending emails.

Downlink

Data received by the device.

Examples:

Video streaming.
Downloads.

Roaming Fields

Visited Network

The network currently serving the subscriber.

Home Network

The subscriber’s original network provider.

Roaming Status

Indicates whether the subscriber is using:

Domestic service.
International roaming.

Event Status Codes

Common examples include:

Code Meaning

Answered Call connected

Busy Recipient busy

No Answer Not answered

Failed Connection failed

Rejected Call rejected

Diverted Call forwarded

Device Information Fields

Handset Type

The model of the device.

Examples:

iPhone 16 Pro
Samsung Galaxy S26

Device Manufacturer

Examples:

Apple
Samsung
Google

Operating Technology

May indicate:

GSM (2G)
UMTS (3G)
LTE (4G)
NR (5G)

Investigation Terminology

Cell Site Analysis

Determining approximate device location from serving cells.

Co-location

Two or more devices appearing within the same cell at similar times.

Link Analysis

Examining communication relationships between subscribers.

Event Record

A single row within a CDR dataset.

Subscriber Attribution

Associating a device, SIM, or number with an individual.

Example CDR Entry

Field Value

MSISDN +44 7123 456789

IMSI 234150123456789

IMEI 356789123456789

Call Type Voice

Direction MO

Start Time 20/06/2026 14:25:36

Duration 124 seconds

Cell ID 48291

Sector 2

LAC 5102

MCC 234

MNC 15

Technology LTE

This single record tells an investigator:

The subscriber made a call.
The device used a particular SIM.
The call lasted 124 seconds.
The device was connected to a specific LTE cell.
The event occurred at a precise time.

Digital Forensic Significance

CDR terminology allows investigators to:

Reconstruct communications.
Identify subscriber devices.
Analyse movement.
Map locations.
Establish timelines.
Identify associations.
Support criminal investigations.
Corroborate other digital evidence.

Correct interpretation of CDR terminology is essential because misunderstanding fields such as Cell ID, Timing Advance, IMSI, or IMEI can lead to incorrect conclusions regarding a device’s location or a subscriber’s activities.

About Athena Forensics

For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.

Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.

We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.

Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.

Our team are all security cleared and we offer non-disclosure agreements if required.

Our premises along with our security procedures have been inspected and approved by law enforcement agencies.

Athena Forensics do not disclose personal information to other companies or suppliers.

Mobile Phone Forensic Expert Witness Services

Digital Forensic Expert Witness Services

Criminal Law

Child Care Proceedings

Our Digital Forensic Experts