Other terminology is also important.  Some additional definitions for terms that will be used later are:

• SMS content: Text message detailed content.  This includes standard text message only and is a different service from Apple proprietary iMessages and third-party text message apps.
• Cell Tower: The sole-source connection that a device makes on the given cellular network.  Call detail records generally provide this information via GPS latitude & longitude.  Many will also have the sector or side of the tower detailed as well.
• Tower Dump: A listing of all devices connected to a given cellular tower at a certain point in time.  These are mostly passive connections, but all cell phones need to be connected to a cellular tower in order to receive cellular phone calls.
• PCMD: Per call measurement data. This data helps determine the distance a cell phone (or handset) is from a particular cell tower during a call.  It is allegedly accurate within 10 meters or so.
• NELOS: The same as PCMD, only NELOS is the term used by AT&T
• RTT: Range to Tower.  The same as PCMD & NELOS, but RTT is used by Verizon Wireless

These definitions will become important as we list the particular data areas and their retention periods.

Cellular Provider Retention Periods

All cellular service providers retain different types of data for different time periods.  When investigating a case, it’s important to know how long you may have access to this data for, otherwise it could be an investigative red herring.  It’s also important to note that these retention policies are not written in stone and can be modified by the provider at any time.  The retention periods below were provided by each of the 5 major U.S. Cellular carriers themselves on the date of this publication:

Verizon Wireless

Subscriber Information:  7-10 years

Call History:  7 years

Tower Locations as they related to Call History:  1 rolling calendar year

SMS Content:  3-5 days (although I’ve been told unofficially it may be as much as 7-10 days)

Tower Dumps:  1 year

Range to Tower (RTT) Data:  8 days

AT&T

Subscriber Information:  7 Years

Call History:  7 years

Tower Locations as they related to Call History:  7 years

SMS Content:  Not Available

Tower Dumps:  7 years

Range to Tower (RTT) Data:  180 days

Sprint

Subscriber Information:  10 years

Call History:  18 months.  Bill reprint form 7-10 years, pre-pay accounts only 18 months regardless.

Tower Locations as they related to Call History:  18 months

SMS Content:   Not Available

Tower Dumps:  18 months

Range to Tower (RTT) Data:  14-90 days.  The technician advised that after 14 days, certain detail in these records is purged, but the remainder is kept for up to 90 days.

T-Mobile

Subscriber Information:  3-5 years.  Canceled accounts are purged after account closes.

Call History:  23 months

Tower Locations as they related to Call History:  23 months

SMS Content:  Not Available

Tower Dumps:  3 months

Range to Tower (RTT) Data:  23 months.  This seems rather long to me, but the technician repeated it on the phone.

U.S. Cellular

Subscriber Information:  up to 7 years

Call History:  1 rolling calendar year.  Bill reprint: 7 years.

Tower Locations as they related to Call History:  1 rolling calendar year

SMS Content:  3-5 days

Tower Dumps:  1 rolling calendar year

Range to Tower (RTT) Data:  Not Available (technician stated would be coming soon).

As you can see, the retention periods and even the types of available records are not uniform, making this type of information crucial in both criminal and civil investigations alike.  For records such as bill re-print, the detail in this data will be far less than we normally see in traditional investigative cellular call detail records, so I wouldn’t rely on this information for anything other than basic communication documentation.   As a rule, I recommend checking with the provider first to see if the data you’re looking for is still available.

Wrapping it Up

In the right hands and in the spirit of the holistic mobile investigation, cellular call detail records can be a powerful piece of evidence to help confirm or refute a person’s location during a given time frame or incident.  However, the ability to know what types of data are available, how long the data is accessible for and how to analyze and explain that data is a crucial intangible in any case.  Without that, it’s all just one big spreadsheet!

Available Globally

We Find the Truth for a Living!

Computer Forensics — Mobile Forensics — Specialized Investigation

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation investigations in Virginia court history.  Patrick is a graduate of SCERS, BCERT, the Reid School of Interview & Interrogation and multiple online investigation schools (among others). He continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations, while keeping in touch with the public safety community as a Law Enforcement Instructor.