Digital Forensics Consultancy Ltd
Further to the above, although it may be alleged that a particular mobile phone is attributable to a particular user, if this is disputed, the strength of the alleged attribution should be thoroughly tested. If the original attribution was based on unsound conclusions, call patterns may be present in the records to suggest that the mobile phone in question belonged to another user, or other users.
In addition to its use in attribution investigations, call pattern analysis enables an expert to determine whether changes occurred to a user's 'normal' behaviour during a specific period. In particular, such investigations can be important to determine whether a user's activity at the time an incident occurred was suspicious, or not.
A mobile telephone is a small portable device. Handset models vary dramatically in features and functionality. Some are relatively inexpensive and therefore easily replaceable; others may be feature rich but easy to damage, prone to software glitches or a have poor battery life. Regardless of whether security features have been enabled (i.e. PIN codes or security locks), almost all mobile phones are easy to share and could be used by more than one user.
As a result of the relatively non-personal nature of a mobile phone, it cannot be taken for granted that a particular individual was the user of a particular mobile at a particular time.
In order to investigate who might have been using a particular mobile, at a particular time, 'attribution' investigations can be performed. These investigations involve careful examination and consideration of the call records to identify patterns. While some patterns may be obvious, others can be considerably more subtle and require more experience to identify.
Cell Site (Cellsite) attribution investigations are of particular importance where a particular user is said to have operated a number of different mobile telephone numbers over a period of time.
A common suggestion in criminal cases is that a user operated one mobile as a 'clean' phone (i.e. to contact family and friends), but one or more other mobiles as 'dirty' phones (i.e. to contact co-conspiritors). Attribution investigations are therefore necessary to prove or disprove these assertions.