Skip to content
HomeResourcesUnderstanding Call Detail Records
Communications Analysis

Understanding Call Detail Records

What CDR data can show, what it cannot show, and why careful interpretation matters.

6 min readPractical forensic guidanceUpdated September 2026
Understanding Call Detail Records
Evidence firstPreserve the source. Understand the context.

Call detail records can help reconstruct communication activity, but they are not transcripts of conversations. They are structured records about events such as calls, messages or network activity and must be interpreted in context.

What a CDR normally contains

Depending on the provider and dataset, records may include telephone numbers, date and time, duration, direction, service type and network-related fields. Field names and formats vary, so mapping the dataset correctly is essential before analysis.

Patterns are more useful than isolated rows

Analysts often look for repeated contact, changes in frequency, relevant time windows, reciprocal activity and relationships between two or more datasets. One record rarely tells the whole story.

Time zones and formatting matter

Timestamps may be stored in local time, UTC or provider-specific formats. Incorrect assumptions about time zones can shift an entire chronology and create false conclusions.

CDRs have limits

A CDR may show that a communication event occurred, but it does not automatically prove who physically used the device or what was said. Those conclusions require corroborating evidence.

Evidence to preserve
  • Original provider files
  • Field descriptions or data dictionaries
  • Source and date of acquisition
  • Time-zone information
  • Any filtering or conversion steps
  • Unmodified copies of each dataset
Avoid if possible
  • Editing the original CSV or spreadsheet
  • Assuming every number belongs to the named account holder
  • Ignoring failed or zero-duration events
  • Comparing datasets before normalising time and field formats
A useful rule: preserve before you clean up, export before logs expire, and document any action that changes the source.