The records kept by wireless phone companies about the use of cell phones are immense and very detailed. Wireless companies keep records about when and where a phone call is made, when text messages are sent and received, and when data is transferred.
All this phone activity data is available if you ask the wireless phone company to provide it to you, and you are still within the window of time that they keep their records. Unlike many other records, wireless phone records or call detail records (CDR), are not protected by the Stored Communications Act and are not protected by the Fourth Amendment. They can be obtained via subpoena or by request of the account holder via a notarized letter.
Cell phone records, otherwise known as “Call Detail Records,” show the caller’s phone number, the duration of call, the start and end time of the call, and the cell phone tower the phone was connected to. Additionally, a call detail record will provide all call attempts whether they connected or not. The cell tower, and therefore location, is only available upon request for each connected phone call. Text message meta data is also attainable, but the actual contents of the messages are not in the CDRs. To get the contents of the messages, a request must be made to the cell phone company within days of the incident.
However, not all messages are what cell phone companies consider text messages. iMessage, for example, uses end-to-end encryption and a data/WiFi connection to send and receive instead of SMS. iMessage is the default when communicating between two Apple devices. If iMessage isn’t available, it will fall back to SMS. Cell phone companies don’t actually have information on these messages sent through alternative systems. At the end of the day, it is incoming and outgoing data (like loading a webpage or YouTube video) and not actually a text message. Continuing with our example, does Apple have access to the contents of iMessages? Not really. They have an encrypted version without the ability to decrypt it. Only the recipient’s phone/device can decrypt it (end-to-end encryption). That is why Apple doesn’t/can’t comply in federal and local government subpoenas.
In the many investigations we perform, the cell phone device is missing for myriad reasons, leaving any evidence of phone usage to be gleaned from the call detail records. How are these different than the phone bill?
A phone bill is only accurate to the minute since the majority of wireless phone companies bill to the next full minute. This means that a phone call that lasts 15 seconds would show 1 minute on a phone bill. A call that lasts one minute and one second will show as two minutes on a phone bill. Also, a phone bill is only going to give you evidence of billable activity. Billable activity does not include outgoing calls that did not connect to another phone, and may not include outgoing calls that connect to another phone’s voicemail.
The call detail records can contain multiple types of records, including voice, text messaging and data transmission activity. The biggest mistake we see in the interpretation of this activity is that data transmissions are the result of user activity. Our firm worked a trucking accident case where the opposing expert was a 20-year veteran homicide detective who advised counsel that data transmissions indicated the truck driver was using his phone at the time of the accident. However, once we explained that data transmissions occur all the time, whether the phone is being used by the person or not, and that it is impossible to determine what kind of data is being transferred, the opposing party dropped the case. Voice calls are an indication of phone usage by the driver, however, whether or not the phone is being used hands free is impossible to determine from a record. Also, if the incoming call is answered by voicemail can be determined from the call detail record, where on some phone bills, this would not be indicated. Another misinterpretation that comes up in many of the distracted driving cases we do is that incoming text messages are an indication of user activity. It is impossible to tell from a phone record that incoming text messages are being read by the person with the phone. Outgoing text messages can be an indication that the phone is being used at the time the message is sent, but this is not an absolute as some applications can send message replies automatically if a person’s phone is moving in a car or truck.
Location information stored in call detail records can be used to determine if a phone is near a particular place. For instance, in insurance cases, it may be important to know if someone is near a location when a fire started. Call detail records can allow an expert to determine if the phone was in the general area near the time of the fire, or other incident. We have used this information in cases involving fires, explosions and hit-and-run auto accidents. In one case we handled, the insured driver in a hit-and-run case claimed to be in Atlanta, Georgia, at the time of the accident that occurred in Birmingham, Alabama. The driver’s call detail records clearly showed the phone near the location of the hit-and-run at the time of the accident. To get a complete picture of what happened in many cases, getting the call detail records from the wireless phone company is critical.
Lars is the co-author of the book Digital Forensics for Legal Professionals. He also co-authored Digital Forensics Trial Graphics: Educating the Jury Through Effective Use of Visuals. Lars is an EnCase Certified Examiner (EnCE), a Cellebrite Certified Operator (CCO), a Cellebrite Certified Physical Analyst (CCPA), a Certified Telecommunications Network Specialist (CTNS), Certified Wireless Analyst (CWA), a Certified Internet Protocol Telecommunications Specialist (CIPTS), and a Certified Telecommunications Analyst (CTA). Contact him at 984.232.2158 or by email at [email protected].
Well I know my husband is in jail and I know it’s one thing that we’re all subjected to somebody listening to your calls on the jail phones this lady is now saying she has evidence of whatever you but I’m not in any kind of criminal case I am not involved at all I feel so freaking violated this lady said she has all these phone records I like that’s funny my husband doesn’t call you from my but his bracelet he calls me from other people’s bracelet and my T-Mobile account and she said she had records up until three weeks ago on my T-Mobile account that they canceled it three weeks ago for fraud for somebody breaking into it this person broke they broke into my phone calls are using it I don’t think that’s legal is it legal I know it’s not I feel so violated you can’t use my personal records he has no right to go in my my business it’s one thing to go in his but not mine
Paul Pacheco says:I need sms/text messages from Visible wireless but they are telling me they cannot release those because of their privacy policy. How do I obtain these records. I need these records to prove to my employer that I was not using my phone at the time of my accident therefore to get my job back. What is the procedure to get these records. Subpoena?
Dan Wychgram says:My IT lady was working on my cell phone for $25/hour. She found and incoming video that she considered inappropriate for a young lady to send me. She used this as an excuse to go the girl’s mother, without my knowledge or permission, to start a series of allegations very harmful to me and my family. All of the allegations are lies. When the video was viewed by a third party, it was determined that the video was very appropriate in the context that it was used. Do I have a legal recourse against the IT lady?
