How to Read a Call Detail Record (CDR) Report: A PI’s Guide for Attorneys
How to Read a Call Detail Record (CDR): A Guide for Attorneys
Attorneys often need two answers first: who communicated with whom, and when? A structured CDR review can organize calls and messages into timelines and frequency reports by day, week, month, multiple months, or any case-defined period—without claiming more than the provider records can prove.
Reviewed August 19, 2026 · Attorney-focused Florida guide
Identify the numbers connected by each event, then corroborate who can reliably be associated with those numbers.
Sequence calls and messages by date, time, duration, direction, and event type.
Report total and recurring contacts by day, week, month, multiple months, or a case-defined period.
Read the production as evidence, not as a spreadsheet
A defensible CDR review first identifies which numbers communicated, when each event occurred, and how often contacts repeated. Those events can then be summarized by day, week, month, multiple months, or a case-defined period—but only after the provider fields, time basis, and number attribution are verified.
For counsel, the practical objective is to build a traceable communications timeline and reliable frequency reports: total calls or messages, recurring number pairs, activity by day, week, or month, changes over time, and events surrounding critical dates. Those findings can test accounts of what happened, identify gaps and patterns, and separate provider-recorded facts from investigative interpretation.
CDR analysis does not establish guilt, intent, identity, or precise handset location by itself. Those conclusions require corroboration and fact-specific legal analysis.
What is a Call Detail Record?
A Call Detail Record, or CDR, is a provider-generated log of a communication or network event associated with an account or device. Exact fields vary by carrier, date, technology, and record type.
Subscriber records, device identifiers, cell-site lists, sector data, certifications, and carrier legends may arrive in separate files. Two columns with similar names can mean different things across providers. The carrier’s own documentation controls the meaning of the fields.
Start, end, release, or event timestamps.
Originating, terminating, forwarded, or routed numbers.
Incoming, outgoing, answered, unanswered, or forwarded.
Recorded connection or event duration under carrier rules.
Voice, SMS, data session, voicemail, or another coded event.
Cell site, sector, device, account, or subscriber fields when produced.
What CDRs show—and what they do not prove
Most CDRs are metadata. They ordinarily record that a network event occurred; they do not contain the spoken words of a call or the text of a message.
CDRs may document
- A recorded communication between telephone numbers
- Timing, direction, duration, and event type
- Repeated contacts, bursts of activity, and communication gaps
- Subscriber or device information supplied by the provider
- Serving cell-site or sector identifiers when produced
- Patterns that can be compared with other case evidence
CDRs do not establish by themselves
- Who physically possessed or used the phone
- Who actually participated in a conversation
- Why two numbers communicated
- The content of a call, text, or app-based message
- The precise GPS location of the handset
- Intent, knowledge, guilt, or the nature of a relationship
A subscriber name establishes an account relationship, not automatic proof of the user. A call record documents contact between numbers, not the purpose or meaning of the communication.
How to read a CDR report in ten steps
The sequence matters. Beginning with charts or conclusions before defining the source fields can carry an early mistake through the entire analysis.
Inventory the production
Record the carrier, account or number, date range, file names, record types, certifications, legends, tower lists, and attachments. Note what appears missing.
Preserve the originals
Keep source files unchanged. Work from a documented copy so sorting, filtering, and normalization do not alter the evidence received. [2][3]
Read the carrier legend
Define every relevant column and event code before interpreting rows. Do not import assumptions from another carrier’s format.
Confirm the time basis
Determine whether timestamps use local time, UTC, or another format. Check daylight-saving transitions and differences among start, end, and release times.
Normalize without replacing source values
Standardize working copies of numbers, dates, and labels while retaining the original fields for verification and source tracing.
Separate event types
Voice, SMS, data, forwarding, voicemail routing, and unanswered events may require different treatment. A zero-duration event is not automatically meaningless.
Resolve numbers cautiously
Associate numbers with people only through corroborating subscriber, device, contact, financial, interview, or case evidence. Record the basis for every attribution.
Build a who-contacted-whom timeline
Sequence relevant events by number pair, attributed user when supported, date, time, direction, duration, and event type. Compare the timeline with reports, surveillance, video, transactions, access records, and witness accounts.
Produce frequency reports
Total contacts by day, week, month, multiple months, number pair, direction, event type, or a case-defined window. Identify changes, bursts, gaps, and exceptions, while recognizing that an event count does not by itself prove a conversation or relationship.
Prepare source-referenced work product
Tables, maps, link charts, and timelines should point back to original records, identify transformations, and distinguish provider data from analysis.
A tower connection is not a precise GPS point
When a production includes cell-site information, it may identify the site and sector that handled a network event. Network configuration, terrain, buildings, traffic, maintenance, antenna orientation, technology, and other conditions can affect which site handled the event.
A map can visualize network activity, but it should not be presented as proof that a handset stood at one exact address. The conclusion must match the precision of the underlying records.
Carpenter v. United States
In 2018, the U.S. Supreme Court held that the government’s acquisition of the historical cell-site location information at issue was a Fourth Amendment search. The Court described its decision as narrow and did not resolve every question involving real-time CSLI, tower dumps, or other collection methods. [1]
Legal process, admissibility, constitutional issues, and discovery strategy remain counsel’s responsibility and must be evaluated under the facts and current governing law.
How wiretap experience informs CDR review
Christopher Rizzi’s prior law-enforcement experience included serving as a wiretap coordinator and lead investigator in complex investigations. That work required intercepted communications to be organized by phone, speaker, subject, time, event, and investigative significance, then compared with surveillance, meetings, searches, transactions, and other evidence.
The same reconstruction discipline applies to phone records: define the fields, preserve the source, determine who can reliably be associated with each number, place communications in sequence, and look for independent corroboration.
Wiretap content and CDR metadata are different evidence
A lawfully authorized intercept may capture the content of a communication. A CDR generally records that a network event occurred.
Wiretap experience helps an investigator understand how communications fit into a larger case. It does not turn metadata into content or make a CDR self-proving.
Common errors and an attorney production checklist
Errors that distort analysis
- Starting before obtaining the carrier legend
- Mixing local time and UTC
- Overlooking daylight-saving changes
- Treating the subscriber as the proven user
- Counting duplicate productions as separate events
- Combining voice, SMS, and data without distinguishing them
- Assuming one contact proves a relationship or agreement
- Mapping a cell-site event as a precise handset location
Questions to ask early
- Does the production cover the complete relevant period?
- Are all relevant numbers, accounts, and devices included?
- Did the provider supply a legend or data dictionary?
- Are subscriber and device-identifier histories included?
- Are cell-site and sector records available when relevant?
- What time basis does each file use?
- Are files duplicate, partial, corrupt, or overlapping?
- Which conclusions require outside corroboration?
Early review matters because providers retain different categories of information for different periods. Investigators can help counsel inventory the production, identify gaps, organize the records, and frame follow-up questions.
Turning raw records into traceable case analysis
Depending on the matter, Royal Palm Investigations can organize and analyze CDR evidence for criminal, civil, family-law, and complex litigation throughout Florida.
Normalized event tables
Clean working tables that preserve original fields while standardizing dates, numbers, and analytical labels.
Contact and frequency reports
Source-referenced totals by number pair, direction, day, week, month, multiple months, or a case-defined period, including material changes and gaps.
Who, whom, and when timelines
Chronologies showing the numbers involved, supported user attribution, date, time, direction, duration, and event type alongside other known events.
Link charts
Visual relationship maps tied back to the underlying records and the stated basis for each attribution.
Cell-site visualizations
Carefully framed maps and exhibits that communicate location context without overstating precision.
Discrepancy logs and exhibits
Focused work product identifying gaps, conflicts, missing records, and questions for discovery or testimony.
Related support includes CDR Analysis Services, Litigation Support, Wiretap and Title III Defense, Computer and Cell-Phone Forensics, and Criminal Defense Investigations.
Call Detail Record questions from attorneys
What is the first thing to review in a CDR production?
Inventory the production and read the carrier legend before interpreting any row. Confirm the provider, record types, relevant numbers, date range, time basis, certifications, and supporting files.
Do Call Detail Records contain call or text content?
Most CDRs are metadata. They generally document network events, timing, direction, duration, and identifiers—not the spoken words of a call or the content of a text or app message.
Can a CDR prove who used a phone?
Not by itself. Subscriber information identifies an account relationship. Attribution to a specific user requires corroborating device, contact, witness, financial, interview, or other case evidence.
Does a cell tower identify a phone’s exact location?
No. A serving site or sector can provide location context, but it is not the same as a precise GPS coordinate. Any conclusion should reflect the limitations of the network records.
Why do carrier legends matter?
Providers use different column names, codes, time formats, and event definitions. A legend or data dictionary is necessary to understand what the carrier actually recorded.
What can a private investigator prepare from CDRs?
Depending on the case, an investigator may prepare normalized tables, contact and frequency reports, timelines, link charts, cell-site visualizations, discrepancy logs, and source-referenced exhibits for counsel.
Can CDR analysis show who was communicating with whom and when?
It can show which telephone numbers were connected by recorded events and when those events occurred. Identifying the people using those numbers requires corroboration, and a recorded event does not always prove that a completed conversation occurred.
What frequency reports can be prepared?
Reports can total calls or messages by day, week, month, multiple months, number pair, direction, event type, or another case-defined period. Frequency is useful context, but the count alone does not establish identity, intent, or the nature of a relationship.
Need phone records organized into usable evidence?
Royal Palm Investigations works with attorneys throughout Florida to organize complex communications evidence, identify material patterns and gaps, and prepare source-referenced work product for litigation strategy.
Request a Confidential Case Review
Royal Palm Investigations, LLC
13118 SR-64 E, Suite 301 · Bradenton, FL 34212
Florida License A3300070
Contact Royal Palm Investigations
Professional-information notice: This guide provides general investigative and technical information. It is not legal advice, does not determine admissibility, and should not be used to draw conclusions beyond the underlying records.
Digital-evidence and legal references
- Carpenter v. United States, 585 U.S. 296 (2018), official U.S. Supreme Court opinion.
- NIST SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics, addressing preservation, acquisition, examination, analysis, and reporting.
- NISTIR 8387, Digital Evidence Preservation: Considerations for Evidence Handlers.
Last reviewed: August 19, 2026. Carrier formats and legal requirements vary. Counsel should evaluate the governing law and the facts of the specific matter.
