Introduction
A mobile data session is a period during which a mobile device connects to a cellular network to exchange data services such as web browsing, social media, email, application traffic, streaming media, cloud synchronisation, and messaging.
Unlike traditional voice calls, which generate a single call record, data communications produce numerous network events and session records.
From a digital forensics perspective, data session records provide valuable evidence regarding device activity, network usage, approximate location, and internet connectivity.
These records are commonly obtained from mobile network operators as part of a telecommunications investigation.
What is a Data Session?
A data session begins when a mobile device establishes connectivity with the cellular packet-switched network and ends when that connection is terminated.
Examples include:
- Opening a web browser.
- Sending a message via an internet messaging application.
- Streaming music.
- Synchronising cloud services.
- Using social media.
- Background application updates.
- GPS map downloads.
Modern smartphones often maintain data sessions continuously, even when the user is not actively using the device.
Packet-Switched Communications
Unlike voice calls, which establish a dedicated circuit, mobile data uses packet switching.
Information is divided into packets containing:
- Source address
- Destination address
- Protocol information
- Data payload
- Timing information
The network records metadata associated with these packet exchanges.
Network Components That Record Data Sessions
2G and 3G Networks
Data sessions are recorded primarily by:
- SGSN (Serving GPRS Support Node)
- GGSN (Gateway GPRS Support Node)
The SGSN tracks:
- Subscriber location
- Session management
- Mobility
The GGSN provides:
- Internet connectivity
- IP address assignment
- Data accounting
4G LTE Networks
4G introduced:
- MME (Mobility Management Entity)
- SGW (Serving Gateway)
- PGW (Packet Gateway)
These systems generate session records containing:
- Subscriber information
- IP addresses
- Data volume
- Session duration
- Cell information
5G Networks
5G networks generate records from:
- AMF (Access and Mobility Function)
- SMF (Session Management Function)
- UPF (User Plane Function)
5G produces substantially larger amounts of signalling and session metadata.
Data Session Establishment
The process typically involves:
1. Device Registration
The handset attaches to the network.
2. Authentication
The SIM is authenticated using:
- IMSI
- Authentication keys
3. APN Selection
The device requests an Access Point Name.
Examples:
- internet
- mms
- business
4. IP Address Assignment
The network assigns:
- IPv4 address
- IPv6 address
5. Session Creation
A Packet Data Protocol (PDP) context or bearer session is established.
Information Recorded During a Data Session
A typical data session record may include:
Field Description
MSISDN Subscriber number
IMSI Subscriber identity
IMEI Device identity
APN Access point used
IP address Assigned internet address
Start time Session start
End time Session termination
Duration Total connection time
Uplink volume Data transmitted
Downlink volume Data received
Cell ID Serving cell
Technology 3G, 4G, 5G
Roaming status Home or visited network
Access Point Name (APN)
The APN determines how the device connects to external networks.
Examples:
- internet
- wap
- corporate VPN
- MMS services
Different APNs may route traffic through different gateways.
Forensic significance:
- Identifies service type.
- Distinguishes consumer and enterprise traffic.
- Indicates specialised services.
IP Address Allocation
When the session begins, the network assigns an IP address.
This may be:
- Public IP address.
- Private carrier-grade NAT address.
- IPv6 address.
Investigators may correlate:
- Subscriber records.
- ISP records.
- Web service logs.
This can link online activity to a mobile subscriber.
Session Start Records
A session start record often contains:
- Timestamp
- IMSI
- IMEI
- APN
- Assigned IP address
- Serving cell
This indicates the device became connected to mobile data services.
Interim Accounting Records
Long sessions may generate periodic records.
Examples:
- Every 15 minutes.
- Every 30 minutes.
- Every hour.
These records update:
- Data usage.
- Cell changes.
- Session status.
Session Stop Records
When the session ends, the network records:
- Session end time.
- Total duration.
- Total upload volume.
- Total download volume.
- Final cell location.
Data Volume Recording
Operators typically record:
Uplink
Data transmitted by the device.
Examples:
- Sending emails.
- Uploading photographs.
- Cloud backups.
Downlink
Data received by the device.
Examples:
- Streaming video.
- Web browsing.
- Downloading files.
Mobility During Sessions
As users move, the device may transition between cells.
Events include:
- Cell reselection.
- Handover.
- Tracking area updates.
This creates additional network records.
A long data session may therefore involve multiple cell sites.
Background Data Sessions
Modern smartphones continuously generate traffic from:
- Email synchronisation.
- Push notifications.
- Cloud backups.
- Messaging applications.
- Location services.
- Operating system updates.
A phone sitting unused may still produce numerous data records.
Internet Activity Versus Data Sessions
A data session does not reveal:
- Websites visited.
- Search terms.
- Message content.
- Emails.
- Application content.
The record simply shows:
- The device used data.
- When it occurred.
- How much data was transferred.
- Which network resources were used.
Correlation With Other Evidence
Data session records can be correlated with:
- Device extractions.
- Browser history.
- Application databases.
- Cloud records.
- Server logs.
- Wi-Fi logs.
- CCTV.
This provides stronger evidential support.
Example Data Session Record
Field Value
MSISDN +44 7123456789
IMSI 234150123456789
IMEI 356789123456789
APN internet
Start Time 20/06/2026 14:00:00
End Time 20/06/2026 15:30:00
Duration 5,400 seconds
Uplink 120 MB
Downlink 850 MB
Cell ID 48291
Technology LTE
This indicates:
- The subscriber was connected for 90 minutes.
- Approximately 970 MB of data was transferred.
- The device used a specific cell.
- The connection occurred over 4G.
Digital Forensic Value
Data session analysis can help determine:
- Whether a device was active.
- Approximate device location.
- Internet connectivity.
- Device movement.
- Usage patterns.
- Corroboration of timelines.
- Periods of inactivity.
Investigators frequently use data sessions to establish whether a suspect device was operational at a particular time.
Limitations
Data session records generally cannot prove:
- Which applications were used.
- The exact user of the device.
- Specific websites visited.
- The content of communications.
- Exact physical location.
Additional evidence is usually required.
Emerging 5G Considerations
5G introduces:
- Network slicing.
- Ultra-low latency services.
- Edge computing.
- Massive IoT support.
- Increased signalling records.
Future investigations may involve analysing significantly larger volumes of session metadata.
Conclusion
Mobile data sessions generate extensive network records that document when devices connect to cellular data services. These records contain subscriber identifiers, IP addresses, timestamps, cell information, and data usage statistics.
For digital forensic investigators, data session analysis provides valuable evidence regarding device activity, movement, and internet connectivity.
Although data sessions do not reveal communication content, they are an essential source of telecommunications evidence and frequently play a critical role in reconstructing events and supporting criminal investigations.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
