How does cell site analysis work?

Cell Site Analysis can locate a mobile phone operating in a certain area when any call activity occurs on the phone, this could be a voice call, text message or a connection to the internet.

The opposite also applies, that is, we can eliminate a mobile phone from being in a certain location at a certain time if the call data supports this.

The following will introduce the basic concepts of how cell site analysis is conducted, including the data we work with and how mobile phones communicate with the network. We will see at a basic level that a mobile phone is a radio transceiver, which uses radio signals to communicate with cell sites, which in turn, communicate with the other components of the host network.

When a mobile phone is involved in call activity, certain data is generated and stored by the network. This data is primarily for the purposes of billing and includes the date and time of the call; the calling and receiving number the duration and the type of call, i.e. whether it is a text, voice call, or data connection.

Call data records however also include data that can be used in cell site analysis, such as the IMEI number, which is a unique serial number embedded within the handset, but most importantly, the CELL ID of the cell used to carry the call is recorded.

Call data for a specific mobile number is requested by the investigating Police Force, or by Solicitors acting for defence and is subsequently provided by the relevant network operator. The format and content of data provided varies significantly between network operators. We can present this data in an easy to understand chronological table by extracting the data, sorting and formatting. Sometimes there is duplicate data that is removed from the table as it is not relevant, this helps us to produce a concise schedule of calls. Once this has been done, we can add call numbers to the schedule for reference.

Cell Site data is also requested from the network operator, this is so we can match the cell ID used within the call data, to its relevant cell site and sector. The data includes the name of the site, the grid reference, post code and the Azimuth, or direction of the sector used. It’s the sector data which can help us to establish the geographical location of a mobile phone relative to the cell site being used. Network operators provide the cell used at the start and the end of a call, some calls use the same cell at the start and the end of the call, while others will use different cells.

When a mobile phone powers up, it performs a network search by sending out a signal. This signal is received by a local cell site and various checks are carried out in order to validate the mobile onto its correct network.

This process is called “Registration” and happens during the few seconds when the mobile performs its start-up tune. The process is complete when the network icon appears on the screen, the mobile is now ready to make or receive calls, or to connect to the internet.

Once a mobile has registered with the network, it is ready to make, or receive a call, text message, or connect to the internet. Once a mobile has started a call through a local cell site, the data is stored by the network, Vodafone for example. The call will be routed through the Vodafone core network to the receiving mobile via the T-Mobile cell site and core network for example. Data is stored by both networks during the course of the call, although the amount of data stored differs between networks.

Cell sites exist in many different forms, the most common types are either free standing masts or rooftop installations and are referred to as MACRO cells, that is they are positioned at a reasonable height relative to surrounding clutter and have a certain power and capacity capability. This type of cell can provide service for as little as a few hundred meters in dense urban areas to many kilometres in rural areas. Cell sites can also be contained within less obvious places such as shopping centres, airports and within small structures on the front of commercial buildings in busy high streets; Cells contained within these types of structures are known as micro cells. Micro cells have only a small range of service and are primarily designed to add more capacity in very busy areas. Micro cells typically serve an area of 50-150m.

Typically, cell sites are split into “Sectors” usually there are 3 sectors, each with its own antenna. The sectors are generally equally spaced at 120 degree intervals so as to provide service all around the mast, or building. Importantly, each of these sectors has its own unique CELL IDENTITY, which as we know is recorded within the call data records. Network engineers plan the coverage using hexagons, however, radio signals rarely propagate in this manner and we are much more likely to find an irregular coverage pattern. The actual coverage area does not provide a precise pattern, radio signals, due to their nature propagate in such a way that produces an irregular coverage area which is dependent upon many external factors such as local building clutter and topography. There is also an area of overlap between the sectors where the signals are equal in strength.

The distribution of cell sites is directly proportional to the population density. For this reason, we see many cell sites deployed within city centre areas; these cell sites will typically serve an area up to 1Km radius. As we move out of the city centre into the suburbs, the cell range increases, typically to 2-3Km. Moving into a rural area cell sites are sparser and their range increases again, typically providing service to 3-5Km, often up to 10Km. In very remote areas cells can often serve greater distances, with the theoretical maximum being 35Km, although this is rarely observed.

The mobile phone constantly monitors the network and measures the strongest cells available. These measurements are sent back to the network approximately every second, so that the network knows which cell to allocate to the mobile when it needs to make or receive a call. In the example we can see that the mobile is measuring three cell id’s and it reports these to the network along with their strengths. It is often the case in urban areas that a mobile can detect and measure six cells at any given time, all of these cells will be reported back to the network in a similar manner, usually there is a best cell, and then a list of neighbour cells. As the phone moves between coverage areas, it will report the new serving and neighbour cells.

Specialist equipment is used to conduct surveys at specific locations in order to determine which cell, or cells, provides service to that location. The equipment used will store all of the measurements made to a file, so that the results can be viewed and analysed on a computer. The equipment also logs the position of measurements using GPS technology, so we can produce the results on a map if necessary.