What are call detail records (CDRs)?
A call detail record (CDR) is a record of a telecommunications event, such as a phone call, text message, or data session.
CDRs contain metadata about the event rather than the content of the communication. Depending on the telecommunications provider and the type of record, this can include identifiers for the parties or devices involved, the date and time of the event, its duration, and information about the network resources used.
For investigators, the value of CDRs lies in the patterns they reveal. A single call may provide little insight on its own. Thousands of records can show who communicates regularly, when activity changes, how groups interact, and whether communications coincide with other investigative events.
What information do CDRs contain?
The precise fields available vary between telecommunications providers, jurisdictions, and types of record. CDRs may contain information such as:
- Originating and receiving telephone numbers or other identifiers
- Date and time of the communication
- Call duration
- Communication type, such as voice, SMS, or data
- Device or subscriber identifiers where available
- Cell site or sector information associated with the communication
Location information in a CDR should be interpreted carefully. A cell site or sector can indicate where a device was connected to the network, but it does not necessarily provide a precise GPS location.
CDRs also do not normally contain the content of a call or message. They describe the communication event itself.
This distinction matters when assessing what CDR data can establish as part of an investigation.
What can CDR analysis reveal?
CDRs become particularly useful when many records are analysed together.
An analyst might use them to identify:
Communication patterns
Repeated contact between two numbers may indicate an ongoing relationship, while changes in communication frequency may highlight periods of particular interest.
Network structure
By connecting numbers, devices, subscribers, and other investigative entities, analysts can identify groups, intermediaries, and relationships between otherwise separate parts of an investigation.
Changes over time
A sudden increase in communications, a change in the people contacted, or a shift in activity around a particular event may provide useful investigative context.
Location patterns
When CDRs contain cell site information, analysts can examine where communications occurred within the network at particular times. Repeated activity around the same areas can help support investigations into movements and patterns of life.
Connections to other evidence
CDRs become significantly more useful when considered alongside other information, such as financial transactions, vehicle movements, device extractions, company records, or intelligence reports.
The important question is often not simply who called whom, but what the communication activity means when viewed alongside everything else known about the investigation.
How are CDRs used in investigations?
CDRs can support a range of investigative and intelligence activities.
Organised crime investigations
Investigators can analyse communication networks to identify recurring contacts, potential intermediaries, and relationships between people connected to organised criminal activity.
Counter-terrorism and national security
Communication patterns can contribute to network analysis and threat assessment, particularly when combined with other intelligence sources.
Financial crime
CDRs can provide additional context around suspected fraud or money laundering activity, particularly when communication patterns coincide with financial transactions or other relevant events.
Missing persons and major incidents
Communication records can help reconstruct activity around a particular period and provide context for where devices were connected to the telecommunications network.
Cross-border investigations
Where investigations span jurisdictions or involve multiple data sources, CDR analysis can help identify relationships and patterns that are difficult to see within an individual dataset.
Why are CDRs difficult to analyse?
The challenge is rarely the existence of the records. It’s the scale and context.
An investigation may contain thousands or millions of communications involving hundreds or thousands of numbers. Looking at those records one at a time makes it difficult to understand the wider structure.
There are also practical challenges.
Multiple data sources
CDRs rarely exist in isolation. Investigators may need to combine them with device extraction data, subscriber information, financial records, company records, open-source intelligence, or previous case information.
Entity ambiguity
A telephone number is not necessarily the same thing as a person. Numbers can be shared, transferred, reassigned, or used across multiple devices. Investigators therefore need to establish relationships between numbers, devices, subscribers, and people rather than assuming they are interchangeable.
Complex relationships
Important investigative relationships may involve several steps. A person may communicate with one number, which is used by a device associated with another person, who is connected to a wider group.
These relationships can be difficult to trace when information is spread across separate tables or systems.
Time and location context
Communication records become more informative when analysed alongside time and location. This allows analysts to examine not just who communicated, but when activity occurred and how it relates to other events or movements.
Why graphs are useful for CDR analysis
CDR data is naturally relationship-rich.
A single record connects one communication event with identifiers, devices, times, and potentially network locations. Across thousands of records, those relationships form a communication network.
Graph technology provides a way to represent and explore that network directly.
Instead of treating each CDR as an isolated row, investigators can connect:
people → phone numbers → devices → communications → locations → events
This makes it easier to identify indirect relationships, recurring patterns, clusters of activity, and connections between communications and other investigative data.
Graph visualisation can then give analysts a way to explore those relationships interactively, while graph analytics can help identify patterns within larger networks.
From CDRs to a wider intelligence picture
CDR analysis becomes considerably more powerful when communication data is combined with other sources.
For example, an investigation might connect:
- CDRs showing communication between several numbers
- Device extraction data linking numbers to a physical handset
- Company records identifying relationships between individuals and businesses
- Financial records showing transactions between associated accounts
- Geospatial information showing where relevant activity occurred
- Intelligence reports providing additional context
Instead of analysing each dataset separately, investigators can examine how the information relates to the same people, organisations, devices, locations, and events.
This connected approach can help reveal relationships that would otherwise remain hidden across data silos.
How GraphAware Hume supports CDR analysis
GraphAware Hume helps analysts bring CDR data into a wider investigative context by connecting communication records with other intelligence sources.
Within GraphAware Hume, analysts can explore communication relationships visually, expand from known entities, and examine how activity changes over time and across locations.
This can support investigations such as:
- Identifying recurring communication patterns
- Exploring relationships between people, numbers, and devices
- Connecting CDRs with other investigative datasets
- Examining communication activity alongside temporal and geospatial information
- Investigating networks across multiple cases or sources
The value comes from giving analysts more context around the communications they are investigating, while keeping the underlying evidence and relationships visible.
FAQs
What is a call detail record?
A call detail record is a telecommunications record containing metadata about a communication event, such as a phone call, text message, or data session.
What information is included in a CDR?
Depending on the provider and record type, a CDR may include telephone or device identifiers, timestamps, call duration, communication type, and cell site information.
Do CDRs contain the content of calls or messages?
No. CDRs contain metadata about communication events rather than the content of the call or message.
Can CDRs show a person’s location?
CDRs may contain information about the cell site or sector used by a device during a communication event. This can provide useful location context, but it is not necessarily a precise GPS location.
How are CDRs used in criminal investigations?
Investigators can use CDRs to analyse communication patterns, reconstruct activity over time, identify relationships, and connect communications with other evidence and intelligence.
What is the difference between CDRs and phone extraction data?
CDRs describe telecommunications events recorded by a network provider. Phone extraction data is obtained from a device and can contain a different and much wider range of information, depending on the device, extraction method, and available data.
Why are graphs useful for CDR analysis?
Graphs represent relationships directly, making it easier to explore communication networks, identify indirect connections, combine CDRs with other intelligence sources, and analyse patterns across people, devices, locations, and events.