HTS Analysis: Examining Traffic, Device, Time, Location, and Relationship Data from a Digital Forensics Perspective

HTS/CDR data is not, by itself, a record that gives a definitive answer to the question “who did what, where?” It is a digital-forensics data set whose source, method of generation, temporal and spatial uncertainty, device-line distinction, communication graph, and legal context must be evaluated together.

Unit 1: HTS Foundations, Evidence Management, and Data Preparation

Before examining call-detail or traffic records, define sources, time zones, clock offsets, record types, and the events they actually represent. Establish identity and reconciliation rules where one communication event may appear in multiple records. Missing or uncertain fields must not be filled with invented certainty during preprocessing. Traceable transformations from source to analysis table make findings reproducible.

1.1. Introduction

HTS analysis is more than filtering hundreds or millions of rows of telephone traffic records in Excel. The real problem is determining which event records produced at different layers of an electronic-communications system represent, which events they do not represent, how they can be related to one another, and how far conclusions can reasonably be drawn from those relationships.

From a digital-forensics perspective, the fundamental distinctions are:

Source record ≠ interpretation
Cell-site record ≠ exact location
Subscription ≠ actual user
IMEI ≠ person
Number of communications ≠ nature of the relationship
Correlation ≠ causation
Algorithmic candidate ≠ forensic conclusion

In the NIST framework, digital-forensic work is broader than analytical examination alone: acquisition must be documented, integrity preserved, custody maintained, methods validated, and results made reproducible. ISO/IEC 27037 addresses the acquisition and preservation of potential digital evidence, while ISO/IEC 27042 addresses the validity and repeatability of analytical and interpretive processes.[19], [16], [23]

In my approach to digital forensics, HTS examination is divided into four layers:

ORIGINAL SOURCE
     ↓
DETERMINISTIC / TRACEABLE TRANSFORMATION
     ↓
ALGORITHMIC INFERENCE / CANDIDATE GENERATION
     ↓
EXPERT ASSESSMENT

A telephone number as it appears in the source file belongs to the first layer. Converting +90 5xx... and 05xx... representations into the same canonical number belongs to the second. Computing the Jaccard similarity of the contact sets of two lines belongs to the third. Assessing what that similarity means in the context of an investigation belongs to the fourth.

Keeping these layers separate is a core principle of HTS analysis: do not say more than the data says, and do not lose what the data does say.

1.2. HTS, CDR, and Traffic Data

In Turkish practice, the term HTS generally refers to Historical Traffic Query records. In international technical literature, the broader concepts are Call Detail Records (CDR) and traffic/charging records.

3GPP TS 32.298 defines Charging Data Record parameters within telecommunications management and charging architectures; TS 32.297 addresses CDR file format and transfer.[28], [27] An operator export delivered to a judicial authority does not have to contain every field defined by the standard. SWGDE notes that operator record formats can differ, while fields such as date-time, originating/destination number, duration, and cell/sector are common, and that the operator's record-description key is important for interpretation.[7]

The European ePrivacy Directive treats metadata processed while communications are conveyed or billed as traffic data. Network information such as routing, time, duration, volume, and connection establishment or termination may fall within this category; location data concerns network information about the geographic position of terminal equipment.[1]

HTS is primarily metadata. In most cases it provides data about:

• which number,
• communicated with which number,
• when,
• in which direction,
• for how long,
• with which device identifier,
• in which cell/base-station context,
• through which communication type.

Deriving the content of a call or message from an HTS record is a different claim and must not be confused with standard traffic records.

1.3. Distinguishing Person, Subscription, SIM, and Device Identifiers

1.3.1. MSISDN

A telephone number is the most visible node in an analysis graph, but it is not directly a person. A line may be used by another person, may be corporate, may be shared within a family, or the subscriber and the actual user may be different.

Therefore:

subscriber(number) = X

and

user(number, t) = X

are not the same proposition.

1.3.2. IMSI

The IMSI identifies a mobile subscription/SIM at network level. It is not the same concept as a telephone number. The relationship between number, subscription, and device can change over time.

1.3.3. IMEI

According to GSMA, an IMEI contains 15 digits; the first 8 digits form the TAC and are used to identify the manufacturer/model family of the device.[41]

A forensic model contains three distinct entities:

PERSON → LINE/SIM → DEVICE

The same IMEI appearing with multiple numbers may have several explanations, including device sharing, SIM replacement, or a data-quality issue. The same number appearing with multiple IMEIs may likewise indicate a device change.

For this reason, the MSISDN ↔ IMEI relationship should be stored as a time-bounded relationship.

1.4. Base-Station Observations and Location Uncertainty

Cell/base-station data is one of the most frequently misinterpreted parts of HTS analysis.

Historical cell-site data primarily records the serving cell or sector associated with a communications event. That network observation cannot be converted into a point location for the device and does not, by itself, establish a particular address or physical point.[7]

“Cell X was used.”

and

“The device was at the coordinates of Cell X.”

are not equivalent statements.

Factors that may affect cell selection include:

• RF propagation,
• antenna azimuth and sector,
• frequency,
• terrain and built environment,
• network load,
• optimization,
• handover,
• device/radio conditions.

An RF field survey also does not reproduce the historical event moment exactly; it samples the RF environment at the time of measurement.[7]

Historical cell-site matching must not assume a static mobile network. Identifiers can be reused or remapped, and antenna orientation, frequency, and coverage conditions may change over time. The validity interval of the cell reference data, its provider, and the event timestamp therefore belong to the matching procedure. Without a retained reference-data version, repeating the analysis later may produce a different map. Such a map is an interpretation of network observations, not a direct measurement of a person's precise location.

1.5. Legal Framework

Although HTS is technical data, the first question is not algorithmic:

Under what legal authority and process was the data obtained?

In Türkiye, Article 135 of the Code of Criminal Procedure is one of the principal provisions concerning the identification of telecommunications communications and the evaluation of signal information. Identification of communications, interception/recording, and evaluation of signal information are not the same measure; the scope of the concrete measure must be assessed separately.[2], [30]

In decisions involving the acquisition and technical analysis of HTS records, the Constitutional Court of Türkiye has considered factors such as the method by which data was obtained, its reliability, its technical interpretation, and the defense's opportunity to challenge it. The approach of the Court of Cassation cited by the Constitutional Court also emphasizes the importance of individualized and detailed HTS reports.[11]

Electronic-communications data falls within the context of personal data and confidentiality of communications. BTK guidance emphasizes purpose limitation, relevance, proportionality, and security under Article 51 of Law No. 5809 and the relevant regulation.[13], [43]

The technical chain is:

Scope of authority
   ↓
Scope of acquired data
   ↓
Technical integrity
   ↓
Analysis
   ↓
Interpretation
   ↓
Report

1.6. Evidence Life Cycle and Provenance

When a source file is received, the first operation should not be to filter the table.

Minimum metadata to record includes:

file name
file size
time received
sender / receiver
file format
official request / reference
provider hash, if available
calculated hash
working-copy identifier

SWGDE recommends preserving the original electronic copy, using a working copy, and maintaining hash and chain-of-custody records.[7], [10]

1.6.1. Hash

SHA-256(source.xlsx) = ...
SHA-256(working-copy.xlsx) = ...

A hash supports byte-level integrity. It does not prove that the substantive contents of the file have been interpreted correctly.

1.6.2. Source and Derivative

source.xlsx
   ↓
normalized dataset
   ↓
deduplicated dataset
   ↓
analysis tables
   ↓
graph / timeline / map
   ↓
report

Every derivative should be traceable back to the source.

1.7. ETL: Data Engineering Before Analysis

The most critical yet least visible part of HTS analysis is the Extract--Transform--Load process.

File
 ↓
container / format validation
 ↓
sheet and header detection
 ↓
operator/data type
 ↓
column mapping
 ↓
row parsing
 ↓
canonical data

Because field names and report formats can differ among operators, the source format's description key is important.[7]

1.7.1. Canonical Schema

record_id
source_file
source_row
target_msisdn
peer_msisdn
event_type
direction
event_time
duration_seconds
target_imei
peer_imei
cell_id
sector
lac_tac
cell_raw
latitude
longitude
province
district
ip_address
source_port
destination_port
subscriber_id
subscriber_name
operator

Core rule:

A source column must not be lost; a canonical value must remain traceable to its source.

1.8. Normalization

1.8.1. Telephone Number

05321234567
5321234567
905321234567
+905321234567

may represent the same number.

normalize_msisdn(x):
    trim
    remove formatting
    apply documented country rule
    validate
    return canonical

No country-specific assumption should be made when the country context is unknown.

1.8.2. IMEI

An IMEI is an identifier, not a mathematical number; it should be preserved as a string. Excel introduces a risk of scientific-notation corruption.

Checks may include:

digits only?
length?
Luhn?
is TAC plausible?
scientific-notation corruption?

A failed validation should be used to produce a quality flag, not to delete the record.

1.8.3. Date-Time

09.09.2026 14:05:01
2026-09-09 14:05:01
Excel serial date
09/09/26 14:05

should be converted into a single timestamp model.

The following should be documented:

• timezone,
• second-level precision,
• whether the timestamp indicates the beginning or end of the event,
• source-system semantics.

1.8.4. Event Type

VOICE_OUT
VOICE_IN
SMS_OUT
SMS_IN
MISSED
GPRS_SESSION
WAP
OTHER

Meaning should not be assigned until the operator code has been verified.

1.9. Duplicates and Deduplication

A naive SELECT DISTINCT * is not always correct.

The same event may appear in target and counterpart queries or in repeated exports. One copy may contain additional cell-site fields.

Candidate key:

target
peer
event_type
timestamp
duration
cell
imei

Flow:

raw data
 ↓
duplicate-candidate grouping
 ↓
field-level comparison
 ↓
preserve provenance
 ↓
deduplicated view

Both raw and deduplicated results may be reported.

1.10. Data-Quality Analysis

Before analysis, the following should be measured:

N_total
N_invalid_time
N_empty_target
N_empty_peer
N_invalid_msisdn
N_invalid_imei
N_missing_cell
N_unresolved_cell
N_duplicate_candidate
N_unknown_event_type

q_time = 1 - N_invalid_time / N_total

q_cell = N_resolved_cell / N_cell_records

Without knowing the missing-data rate, a conclusion of “no match” cannot be interpreted strongly.

Unit 2: Communication Profiles, Time, and Relationship Analysis

In communication-network analysis, specify whether a node denotes a person, line, or device. Edge direction, time window, and weight must be defined before comparing degree or centrality. Recompute relationships across time windows; high contact frequency is not by itself proof of a social or legal relationship. Investigate alternative explanations and recording-system limitations for apparently unusual patterns.

2.1. General Communication Profile

For a target, derive:

total events
outgoing / incoming calls
SMS sent / received
missed calls
total call duration
unique counterpart numbers
unique IMEIs
unique cells
active days
first record
last record

At this stage, the goal is less to generate findings than to understand the scale and character of the data set.

2.2. Contact Analysis

For each counterpart number, compute:

count_total
count_out
count_in
count_sms
duration_total
first_seen
last_seen
distinct_days
distinct_cells

C(u,v)=|{e:e=(u,v)}|

D(u,v) = Σ_{e=(u,v)} duration(e)

Communication count or duration alone does not determine the nature of a relationship.

2.3. Top-N, One-Time, and Long Calls

2.3.1. Most Frequently Contacted

GROUP BY peer
ORDER BY COUNT(*) DESC

2.3.2. Contacted Once

GROUP BY peer
HAVING COUNT(*) = 1

2.3.3. Longest Individual Call

FILTER voice
FILTER duration > 0
ORDER BY duration DESC

maximum individual duration and total relationship duration are different metrics.

2.4. Communication Direction and Asymmetry

O = outgoing,   I = incoming

A=(|O-I|)/(O+I)

A → 0 indicates more balanced traffic, while A → 1 indicates a more one-sided traffic pattern.

This measures only communication direction; it does not determine the social or legal meaning of the relationship.

2.5. Temporal Analysis

Hourly activity:

H(h) = Σ_i 1[hour(t_i) = h]

Daily activity:

D(d) = Σ_i 1[date(t_i) = d]

Weekday/weekend, day, and hour profiles can be derived. Rather than assuming a fixed rule such as “night = anomalous,” the subject's own baseline should be preferred.

2.6. Activity Gaps

For ordered timestamps:

t_1<t_2<...<t_n

gap_i=t_{i+1}-t_i

If gap_i ≥ T, it is a candidate inactivity interval.

sort by time
for adjacent events:
    gap = next - current
    if gap >= threshold:
        emit gap

The threshold should be interpreted together with the line's normal usage frequency.

2.7. Before and After an Event

For event time t0:

W_before = [t0 - Δb, t0)

W_after = (t0, t0 + Δa]

Compare changes in:

• communication,
• cell,
• IMEI,
• city,
• counterpart

within these windows.

Temporal proximity to an event is not causation.

2.8. Communication Graph

G=(V,E)

V: numbers E: communications

Edge properties may include:

count
duration
first_seen
last_seen
direction
distinct_days

Weighted graphs, social-network similarity, and centrality measures are widely used in telecommunications research on CDR data.[5]

High degree or centrality does not automatically determine a person's social or legal role. Call centers, for example, naturally produce high degree.

2.9. Common Contacts

P_A = contacts(A),   P_B = contacts(B)

C = P_A ∩ P_B

For multiple targets:

C = ⋂_i P_i

A more flexible model is:

peer → how many different targets did this peer communicate with?

A common contact is a structural connection; the nature of the relationship must be assessed separately.

2.10. Jaccard Similarity

J(A,B) = |A ∩ B| / |A ∪ B|

The same method can be used for:

contact_jaccard
cell_jaccard
district_jaccard

Jaccard is a similarity measure, not an identity decision.

2.11. Tie Strength

HTS/CDR records do not directly reveal the emotional or social nature of a relationship between two numbers. What can be measured is how intensive, reciprocal, persistent, and recent their communication is within a selected observation window. For that reason, tie strength is used here instead of "social proximity." In telecommunication networks, measures such as call count and aggregate duration are used as edge weights, while reciprocated calls and total call duration are established observable indicators for characterizing communication ties.[5], [37]

The following features can be retained for a pair of lines:

f1  = active communication days
f2  = communication count
f3  = reciprocity
f4  = total call duration
f5  = relationship span
f6  = recency
f7  = communication persistence
f8  = recent activity change
f9  = median inter-event time
f10 = burstiness

f4 is computed only for event types for which duration is meaningful. f5 represents last_seen - first_seen; a long calendar span between two sparse events does not by itself indicate a strong tie.

When direction is reliable, reciprocity can be measured as:

R(u,v) = 2 * min(N_u→v, N_v→u) / (N_u→v + N_v→u)

Values near 1 indicate balanced contributions in both directions, while 0 corresponds to one-way communication. If direction is unknown, the feature should remain unavailable rather than being assigned zero.

Recency can transform the elapsed time Δt since the last communication into a decaying value:

Recency = exp(-λ * Δt)

λ is not a universal constant; it must reflect the observation horizon.

Persistence can be measured over stable periods such as weeks rather than individual days:

Persistence = active_periods / elapsed_periods

This separates the same number of communications concentrated into a few days from activity that continues across months. Recent change can likewise compare the communication rate in a recent window with an earlier baseline:

Trend = log((1 + recent_rate) / (1 + baseline_rate))

A positive value indicates increased recent activity and a negative value indicates a decrease. It describes a change between two selected periods, not the nature of the relationship.

The median time between consecutive events and burstiness provide a separate view of temporal rhythm. If Δt denotes inter-event time, the classical burstiness coefficient is:

B = (σ_Δt - μ_Δt) / (σ_Δt + μ_Δt)

The coefficient is defined in the burstiness literature.[20] High burstiness can indicate short clusters of intensive communication, but it does not by itself imply a stronger tie. Because the coefficient can be unstable for very short event sequences, it should not be interpreted without a sufficient number of events. f9 and f10 are therefore useful in the relationship profile without necessarily being included in the core score.

The core features can be read in four groups:

intensity             → f2, f4
persistence           → f1, f5, f7
reciprocity           → f3
recency / evolution   → f6, f8

If a single score is needed, applying the same normalization to every feature is usually inappropriate. Each feature should use a transformation consistent with its distribution:

S(u,v) = Σ_{i∈C} w_i · g_i(f_i)
C = {1,2,3,4,5,6,7,8}

Heavy-tailed quantities such as communication count and total duration can use a logarithmic transform or percentile rank; naturally bounded ratios such as reciprocity and persistence can remain on their native scale; recency can use temporal decay. Weights must be justified against the data and the purpose of the analysis.

Nighttime or weekend communication can describe temporal context, but shift work, on-call duty, and operational routines make it unsuitable as an automatically positive contribution to tie strength. The result should therefore be used as a review-priority measure of communication intensity, persistence, reciprocity, and recency within a stated time window, not as a conclusion that two people have a "close relationship." When a score is shown, its contributing features and observation window should remain visible.

2.11.1. Reference Population and Score Stability

A composite tie-strength score is not an absolute physical measurement. If features are scaled relative to the observed candidate set, the score depends not only on the events between two lines but also on which relationships define the reference population.

For example, if an intensity feature is scaled as:

g_max(x; X) = x / max(X)

adding a new relationship with much greater intensity to X can reduce every previously calculated relative value. The source events have not changed; the comparison population has.

Relative scores should therefore state at least:

reference time interval
reference relationship set
transformation used
treatment of missing feature values

For heavy-tailed count and duration variables, alternatives include transformations such as log(1+x), percentile ranks, or a previously defined reference distribution. These are not equivalent. Percentiles express position within the declared population, whereas a fixed reference distribution can provide a more stable scale across separate examinations.

Score stability does not make a forensic interpretation stronger by itself. It does, however, improve methodological auditability when the same data and the same declared reference population reproduce the same result.

2.12. Communication Between Targets

For a target set T, select edges satisfying:

u ∈ T AND v ∈ T

A canonical pair:

(min(u,v), max(u,v))

can group both directions under one relationship while preserving direction separately.

2.13. Temporal Activity and Coverage When Records Are Incomplete

A calendar, hourly histogram, or activity heatmap derived from communications records makes a claim about query coverage as well as providing a visual summary. When the first \(N\) retrieved rows do not represent the entire database result, an empty day cannot be interpreted as ``no communication occurred.'' Row caps, pagination, authorization scope, and late data delivery introduce distinct sources of incompleteness. A chart must state whether counts describe loaded records or a verified complete query population.

The same communication can appear as multiple rows across sources. Before aggregating, define event identity, record-version deduplication, and cross-source reconciliation. Direction and participant roles can differ across representations without implying that every pair of reversed rows is duplicate evidence. A call crossing midnight belongs to its starting day when calculating call-start counts, but contributes to both days when calculating duration occupancy. These measures must not be silently combined.

Period comparisons require windows of equal duration, a consistent time-zone policy, and identical filtering. Records delivered in processing-time order need not arrive in event-time order: sorting the fetched subset on the client cannot recover earlier events that were never fetched. Hourly bars and target–record links should remain alternate projections of the authorized dataset rather than independent search paths that expand user access.

2.14. Communication Density under Incomplete Observation Windows

Grouping communication starts into a histogram implicitly assumes comparable observation coverage across the analyzed period. This assumption fails when some records are unavailable, a query reaches a row cap, or upstream collection did not cover certain intervals. Let \(N(t)\) denote observed events and \(E(t)\) the time actually under observation. An observed rate \(\hat\lambda(t)=N(t)/E(t)\) is interpretable only when \(E(t)>0\).

Two days with the same recorded call count are not necessarily comparable if one has 24 hours of coverage and the other only six. Even an exposure-normalized rate is not automatically an unbiased estimate of the true rate: missingness can be systematic and may differ by source. An unobserved interval must not be visualized as a confirmed zero-event interval.

Time zones, timestamp precision, and duplicate events from multiple sources must be reconciled before aggregation. A call crossing midnight does not become a second communication event; if duration is aggregated by calendar day, its actual overlap can instead be allocated to the appropriate days. Reports should include event counts, covered intervals, missing-data indicators, and the precise counting convention used.

Unit 3: Device, Subscriber, Location, Movement, and Anomaly Analysis

3.1. IMEI Analysis

3.1.1. Number → IMEI

IMEI
first_seen
last_seen
event_count

3.1.2. IMEI → Number

IMEI → {MSISDN1, MSISDN2, ...}

3.1.3. Shared IMEI

|Users(imei)| ≥ 2

indicates a candidate shared device.

But temporal separation is critical:

simultaneous use
sequential use

do not carry the same meaning.

3.1.4. IMEI Timeline

t1 A → IMEI-X
t2 A → IMEI-Y
t3 B → IMEI-X

may be more informative than an aggregate table.

3.2. Possible Same User / Multi-SIM

Telecommunications research uses social-network and behavioral-similarity measures to examine whether multiple SIMs may be associated with the same user.[5]

Observable features may include:

shared IMEI
contact-set similarity
cell-set similarity
district-set similarity
temporal complementarity
simultaneous-use contradiction

These features do not have to be collapsed into a single identity score. A shared device or similar contact pattern may justify reviewing a same-user hypothesis, whereas geographically incompatible observations within the same temporal interval may provide strong counter-evidence. A missing feature must not be treated as zero-valued evidence.

The output should be:

a candidate pair of lines to review under the same-user hypothesis

not a conclusion that they are the same person. If a composite classification model is used, its weights and decision threshold require justification on independent validation data.

3.3. Ownership Uncertainty and Record-Based Indicators

The subscriber and the actual user are not the same concept. When actual use of a line is uncertain, analysis should rely on verifiable record-based indicators rather than a single label or score.

Indicators that may be examined include:

missing or inconsistent identity fields
frequent changes in device/SIM relationships
time-bounded use of one device by multiple lines
short observed life cycle
activation or disappearance around an event
narrow contact set
one-sided or low-volume use

None of these indicators determines the actual user by itself. Some may also be explained by data quality, device sharing, temporary use, or ordinary subscription behavior. Ownership uncertainty should therefore remain a hypothesis supported by separately visible confirming and contradicting observations.

3.4. Cell-Site Analysis

For each cell/base station, calculate:

count
first_seen
last_seen
distinct_days
province
district
coordinate

Where possible, use a technical key such as:

operator + LAC/TAC + Cell ID/ECGI + sector

Address text alone is fragile.

3.5. Haversine Distance

For two coordinates:

a = sin²(Δφ/2) + cos(φ₁) cos(φ₂) sin²(Δλ/2)

d = 2R · arcsin(√a)

This is the geometric distance between two cell-site coordinates; it is not the actual distance between devices or an RF coverage radius.

3.6. Common Cell-Site Analysis

For two targets:

A={(t,cell)}
B={(t,cell)}

Temporal condition:

|t_A - t_B| ≤ Δt

Spatial condition may be:

same_cell

or:

distance(cell_A, cell_B) ≤ R

3.6.1. Two-Pointer

i = j = 0
while i < len(A) and j < len(B):
    dt = A[i].time - B[j].time
    if abs(dt) <= tolerance:
        evaluate spatial match
    elif dt < 0:
        i += 1
    else:
        j += 1

3.6.2. Multiple Targets

PARTITION BY cell
ORDER BY time
SLIDING WINDOW Δt
EMIT distinct user pairs
AGGREGATE

This approach scales better than naively comparing every pair of users.

3.6.3. Bounded Temporal Matching

Finding the nearest record in another time series is not sufficient by itself. The nearest record may still fall outside the admissible temporal interval. Matching should therefore be separated into two steps:

1. locate the temporally nearest candidate
2. independently verify |t_candidate - t0| <= Δt

When timestamps are sorted, the insertion position of t0 can be found by binary search. The nearest candidate must then lie next to that insertion position. This avoids scanning the full time series for every query and reduces lookup cost to approximately O(log n + k), where k is the small set of records additionally examined inside the admissible interval.[12]

If two candidates are equally distant from t0, the choice should not be made silently. Both can be retained, or a documented secondary key can provide deterministic technical ordering. Such a tie-break key must not be interpreted as evidence of the real-world event order.

3.6.4. Multi-Target Match Clusters and the Limit of Transitivity

Temporal-spatial matches among many targets can be represented as a graph. Nodes represent the examined lines and edges represent pairs satisfying the declared Δt and location conditions.

u -- v  =>  at least one match between u and v satisfies the declared rules

Connected components can be built efficiently with disjoint-set union (Union-Find) or equivalent graph methods.[12] The matching relation, however, is not necessarily transitive:

u ~ v
v ~ w

does not imply:

u ~ w

A connected component therefore does not mean that all members were simultaneously at the same place. It is only a candidate correlation cluster connected under the selected matching rules. The actual pairwise matches and their temporal differences must remain available for review.

3.7. Levels of “Same Cell/Base Station”

1. same Cell ID / sector
2. same physical site, different sector
3. nearby physical sites

are not the same thing.

A report should state explicitly what “same base station” means technically.

3.8. Cell at the Time of a Call

Assume a call A → B, t0.

The target cell may be recorded directly. If the counterpart requires a separate record, search for:

candidate=argmin|t_B-t_0|

subject to:

|t_B - t_0| ≤ Δt

“The nearest record” and “a record at the same time” are not equivalent.

3.9. City Transitions

A time-ordered sequence:

Ankara
Ankara
Bolu
Bolu
Istanbul

can be compressed to:

Ankara → Bolu → Istanbul

Each transition can be stored with:

from
to
last_seen_from
first_seen_to
Δt
distance

3.10. Route and Movement

HTS does not yield a GPS route. What it yields is a time-ordered trace of cell usage:

(t1,cell1)
(t2,cell2)
...

Apparent speed:

v = distance(cell_i, cell_{i+1}) / (t_{i+1} - t_i)

If it is implausibly high, possible explanations such as data error, cell oscillation, clock differences, or network behavior should be investigated.

Research on CDR-based mobility has shown that failure to account for location uncertainty and cell oscillation can make mobility regularity appear stronger than it actually is.[48]

3.11. Routine Analysis

Possible features include:

hour_of_day
weekday/weekend
cell
distinct_days
event_count

Example:

night → Cell A → 24 distinct days
working hours → Cell B → 19 distinct weekdays

Appropriate interpretation:

Cell A is the recurring dominant cell during nighttime hours.

Overstated interpretation:

Cell A is the person's home.

3.12. Proximity to an Event Location or Critical Point

For event location P0:

d_i=distance(P_i,P_0)

If d_i ≤ R, the cell site is a geographic candidate.

This is cell-site proximity, not a measurement proving that the device was at the event location.

POI analysis may likewise be performed textually or geographically using classes such as:

airport
bus terminal
hotel
hospital
border crossing
special point of interest

3.13. Technical Interpretation of Historical Location Questions

An appropriate algorithm is:

candidates =
    records where |event_time - t0| <= tolerance

nearest =
    argmin |event_time - t0|

Output:

t0
nearest record time
Δt
cell/sector
coordinate

Appropriate wording:

The HTS record nearest to time t0 is associated with Cell X.

SWGDE's warning about precise location is particularly important here.[7]

3.14. Conference-Call Candidates

If no explicit session ID exists, calls can be modeled as intervals:

I(c) = [start, start + duration]

Sweep-line approach:

create call start/end events
sort by time
maintain active call set
if concurrent relevant-call count exceeds threshold, emit candidate

This indicates temporal overlap only; without validated operator semantics it is not a definitive conference-call conclusion.

3.15. Anomaly Detection

An anomaly means “unexpected relative to the normal model”; it does not mean “criminal.”

3.15.1. Z-Score

z = (x - μ) / σ

3.15.2. Robust MAD

MAD=median(|x_i-median(x)|)

z_r=0.6745(x-median(x))/(MAD)

3.15.3. Example Anomaly Features

unexpected hour
sudden daily activity spike
new cell
new IMEI
long silence
unusual city transition

Time-series, clustering, and forecasting methods are used in the academic literature for CDR traffic anomaly analysis.[33]

anomaly ≠ malicious
anomaly ≠ criminal
anomaly ≠ intentional

3.16. GPRS, IP, and CGNAT

In mobile-internet analysis, a public IP address alone is often insufficient.

In a CGNAT context, evaluate together:

public_ip
source_port
timestamp
subscriber/private context

Because a carrier-grade NAT can allow multiple subscribers to share one public IPv4 address, subscriber attribution cannot rely on the address alone. RFC 6888 describes the relevance of retaining the external source address, external source port, timestamp, and a subscriber identifier together for mapping records.[39]

IP geolocation is not:

IP → exact physical address

ASN/ISP information, allocation data, and geographic estimates are different information layers.

3.17. Subscriber versus Actual User

Subscription data may show:

subscriber(number)=X

Establishing:

user(number,t)=X

requires additional correlation.

Possible signals include:

• device relationships,
• long-term usage,
• routines,
• relationships with other verified lines,
• device forensic examination,
• other digital artifacts,
• witness statements/testimony.

SWGDE notes that CDR data does not conclusively establish the identity of the person using a device.[7]

Unit 4: Analytical Inference, Scale, Validation, and Reproducibility

4.1. Separating Source, Derivative, and Interpretation

• Source: Cell X record at 14:05
• Deterministic derivative: Distance from Cell X to event location: 1.8 km
• Algorithmic inference: event-location proximity candidate
• Expert interpretation: assessment together with other findings

An algorithm should not replace interpretation.

4.2. False Positives and False Negatives

False Positive:
algorithm flagged it, but it is not meaningful in context

False Negative:
a meaningful pattern exists, but the algorithm did not flag it

In common-cell analysis, dense urban environments may increase false positives, while sparse records may increase false negatives.

A results screen should display data coverage together with matches.

4.3. Separate Dimensions of Match Quality

The quality of a temporal-spatial match does not need to be reduced to one "confidence score." At least three dimensions can be retained together while remaining separate:

temporal compatibility → time difference and source time resolution
spatial resolution      → same sector / same physical site / nearby site
data sufficiency        → effect of missing, unresolved, and out-of-scope records

These dimensions are not substitutes for one another. A very small time difference does not compensate for poor spatial resolution, and high data completeness does not turn a serving-cell observation into an exact physical location.

Reporting the dimensions separately makes it easier to review where a result is strong or limited. If any composite score is used, it must be stated that the value is not a universal evidential weight and that its transformations and weights require separate validation.

4.4. Big Data and Performance

For millions of records, data architecture is as important as the algorithm.

Indexes:

(target,event_time)
(peer,event_time)
(imei,event_time)
(cell,event_time)
(event_time)

Precomputed structures:

contact_stats
imei_usage
cell_usage
daily_activity
hour_profile

Columnar storage, vectorized execution, predicate pushdown, and projection reduce unnecessary data movement in large CDR data sets.

Core principle:

Perform computation where the data resides; do not move data unnecessarily.

4.4.1. Computational Cost of Equivalent Analytical Definitions

For large HTS data sets, it is important not only to define the analysis correctly but also to compute the same definition at lower cost. A naive comparison of every record in one time series with every record in another requires:

O(n * m)

comparisons for series of size n and m.

Once the series are sorted by time, a two-pointer scan or sliding temporal window can proceed in approximately:

O(n + m + c)

after sorting, where c is the number of emitted matches. If sorting has not already been performed, O(n log n + m log m) is added as preprocessing. A single temporal lookup in a sorted sequence can be reduced to O(log n) with binary search.[12]

For graph-based multi-target correlation, connected components can likewise be maintained near linear cost in practice with a disjoint-set structure under appropriate implementations.[12]

A performance optimization must not redefine the analytical event. The optimized method should be checked against a simpler reference calculation on selected data, including boundary cases. Greater speed is not a justification for producing different analytical results.

4.5. Graph Centrality and Community Detection

Degree, weighted degree, betweenness, or PageRank-like measures may quantify structural importance in a graph.

high centrality ≠ legal/social leadership

Community-detection algorithms such as Louvain or Leiden can produce densely connected clusters. The output is only a graph community; it may correspond to a family, workplace, service, or another context.

Forensic use:

candidate cluster → contextual/manual review

4.6. Machine Learning

Suitable application areas include:

• anomaly ranking,
• entity resolution,
• graph embedding,
• behavioral clustering,
• quality classification.

However:

model prediction ≠ source observation

In forensic systems, an explainable-first approach is often advantageous:

SQL
set intersection
Jaccard
Haversine
sliding window
simple statistics

The reproducibility and independent-review principles of ISO/IEC 27042 support this approach.[16]

4.7. The Role of a Model in Forensic Analysis

Machine learning can rank candidates and reveal patterns in HTS data, but the model is not the evidence source. Source records, operator data, and reproducible derived measurements remain primary. A model result should be treated as an investigation priority or hypothesis candidate rather than a factual event statement.

4.8. Time-Aware Data Splitting

Random train/test splits can leak repeated behavior across time. Records from the same person, device, or event sequence may appear in both sets and inflate performance. Depending on the question, time-based holdout, grouped splitting, or event-based separation can be more defensible.

4.9. Reproducibility Before Explainability

A feature-importance plot does not make an analysis reproducible. Data slice, feature pipeline, model version, threshold, and random seed must first be traceable. Explanation becomes meaningful only after the underlying behavior can be reproduced.

4.10. Validation and Technical Review

SWGDE recommends that historical cell-site-analysis results be verifiable on sample data through manual mapping or a tool using a different methodology, and that technical review be performed.[7]

A general HTS validation flow is:

1. produce algorithmic result
2. select sample
3. return to source row
4. recompute manually
5. compare with an alternative method
6. investigate discrepancies

4.11. Reproducibility Package

source_hashes.json
analysis_config.json
normalization_rules.md
software_version.txt
queries/
derived/
report/

Example parameters:

{
  "time_tolerance_seconds": 120,
  "distance_radius_meters": 1000,
  "analysis_mode": "deduplicated",
  "timezone": "Europe/Istanbul"
}

If a parameter can affect the result, it should be visible in the report.

Unit 5: Reporting, Mapping, Correlation, and Hypothesis Management

5.1. Reporting Language

Poor wording:

The person was at the event location.

More appropriate wording:

Records for the target line show use of Cell X within a time interval close to the event. Because a cell-site record does not by itself establish the device's precise physical location, this finding should be evaluated together with other location and investigative data.

Poor wording:

The two persons moved together.

More appropriate wording:

Records for the two lines contain same-cell/sector matches within the stated temporal tolerance. This technical correlation does not by itself establish the identities of the device users or their physical co-presence.

5.2. Minimum Report Contents

1. Examination task
2. Submitted material
3. Hash / integrity
4. Data source and scope
5. Tool and version
6. Normalization
7. Raw/deduplicated mode
8. Parameters/thresholds
9. Findings
10. Source-row references
11. Map/graph explanations
12. Limitations
13. Conclusion

5.3. Map and RF Presentation

A map should show:

• scale,
• north,
• coordinate system,
• cell/sector,
• time,
• tolerance,
• meaning of symbols.

Drawing a cell as a circle with a fixed radius does not mean that the real RF coverage is that circle.

HTS is a historical network record; an RF survey is a field measurement made at a specific time. They are not the same thing.[7]

5.4. Multi-Source Correlation

HTS may be evaluated together with sources such as:

mobile-device forensic image
SIM artifacts
application records
CGNAT
camera footage
vehicle data
access-control logs
witness statement/testimony

NIST SP 800-101 treats mobile-device forensics as the forensically sound acquisition and examination of digital evidence on a device.[17]

Device forensics → endpoint artifact
HTS/CDR          → network/operator artifact

If sources conflict, one should not automatically be discarded.

5.5. Hypothesis and Counter-Hypothesis

Example:

H1: Lines A and B may have been used alternately by the same user.

Test:

shared IMEI?
contact Jaccard?
cell routine?
same-time distant-location contradiction?
subscription?
device artifact?

Counter-hypothesis:

H0: The lines belong to different users; the similarity results from a shared social or work environment.

Good analysis looks not only for supporting findings, but also for contradictions.

5.6. Data Minimization and Security

HTS records may also contain data relating to people who are irrelevant to the investigation.

The system should enforce:

• role-based access,
• audit,
• project isolation,
• export control,
• purpose-limited processing,
• retention controls.

The principles of purpose limitation, relevance, necessity, and proportionality under the BTK/KVKK framework are important here.[13], [43]

5.7. Limits of Visual Inference in Dense Communication Graphs

Drawing every edge in a large communication graph does not itself produce analytical evidence. High-degree nodes can dominate the display while low-frequency connections relevant to an inquiry become invisible. If aggregation, thresholding or sampling is used, the graph should disclose which records those operations suppress. An edge absent from a visual summary is not proof that the corresponding relationship is absent from the source dataset.

Observed degree also depends on opportunities for observation. A line monitored for longer or represented by more records can have high degree without necessarily implying a stronger social connection. Centrality and community assignments should be assessed against time window, coverage and multiple-comparison effects. After trying many thresholds and measures on the same dataset, the most visually striking pattern does not acquire statistical significance without independent validation.

Reports must distinguish raw records, derived relationships and analytical interpretations. Two nodes positioned close together by a layout algorithm are not thereby geographically close or directly connected as people. Every derived edge should be traceable to its time interval, filtering rules and relationship definition. Making uncertainty and coverage visible is a verification requirement, not merely a design preference.

Unit 6: End-to-End Analysis and Case Study

6.1. End-to-End HTS Algorithm

INPUT:
    source files
    legal scope
    event context

1. PRESERVE
    hash originals
    create working copies
    record provenance

2. DETECT
    identify provider/file type
    validate workbook structure

3. PARSE
    map source columns
    preserve source row identity

4. NORMALIZE
    MSISDN
    IMEI
    timestamp
    event type
    cell

5. VALIDATE
    missing/invalid/outlier fields
    duplicate candidates

6. ENRICH
    subscriber
    TAC
    cell coordinates
    province/district

7. BASELINE
    counts
    active days
    quality metrics

8. SINGLE-TARGET
    contacts
    time
    device
    cell
    route/routine

9. MULTI-TARGET
    common contacts
    common IMEI
    common cells
    internal graph

10. EVENT-CENTRIC
    before/after
    location proximity
    temporal windows

11. CANDIDATE GENERATION
    anomaly
    possible same user
    ownership uncertainty
    social proximity

12. VERIFY
    source sampling
    alternate method
    technical review

13. REPORT
    observation
    deterministic derivation
    algorithmic candidate
    expert interpretation
    limitations

6.2. Analytical Validation Using Synthetic Records

Line P: 05xx...201
Line Q: 05xx...202
Line R: 05xx...203
Event time: t0
Event point: P0

Records:

P → Cell K, t0 - δ1
Q → Cell K, t0 - δ2
R → Cell L, t0 - δ3

0 < δ2 < δ1
P and Q are observed with the same device identifier in different time intervals.
J_contact(P,Q) = j_c
J_cell(P,Q)    = j_b

Here j_c and j_b denote calculated similarity values only; the example does not define a decision threshold.

Incorrect:

P and Q were at the event location and were the same person.

Technical assessment:

1. Use of the same cell by P and Q in intervals close to the event time is a temporal-spatial correlation.
2. The geometric distance between Cell K and the event point must be calculated separately.
3. Cell use is not an exact device location.
4. A shared device identifier establishes a device relationship, not user identity by itself.
5. Jaccard values are set-similarity measures, not identity decisions.
6. Simultaneous and incompatible observations should be sought as counter-evidence to the same-user hypothesis.
7. The result must be assessed together with independent evidence.

6.3. Common Mistakes

1. Treating a cell-site record as GPS.
2. Automatically treating the subscriber as the actual user.
3. Treating a shared IMEI as proof of the same person.
4. Treating a high communication count as the nature of a relationship.
5. Treating a common contact as direct proof of an organizational link.
6. Treating an algorithmic score as an evidence score.
7. Losing provenance during deduplication.
8. Presenting a map as more precise than the underlying measurement.
9. Reporting only findings that support the hypothesis.
10. Hiding parameters such as Δt, R, and thresholds.
11. Ignoring the missing-data rate.
12. Collapsing source observation and model/expert interpretation into the same sentence.

6.4. Expert Checklist

6.4.1. Source

• [ ] Was the original file preserved?
• [ ] Was a hash calculated?
• [ ] Is chain of custody recorded?
• [ ] Are the provider and format known?

6.4.2. Normalization

• [ ] Are MSISDN rules documented?
• [ ] Is IMEI preserved as an identifier?
• [ ] Are timestamp semantics known?
• [ ] Was event mapping verified?
• [ ] Is the cell key technically correct?

6.4.3. Analysis

• [ ] Is the raw/deduplicated distinction clear?
• [ ] Is the temporal tolerance reported?
• [ ] Is the distance threshold reported?
• [ ] Is the missing-data rate known?
• [ ] Was the counter-hypothesis tested?

6.4.4. Report

• [ ] Are source observations separated from interpretation?
• [ ] Are map limitations stated?
• [ ] Is the algorithm explainable?
• [ ] Can the result be traced back to source rows?
• [ ] Can a technical review be performed?

6.5. A Concise, Evidence-Based Approach

The aim in HTS analysis is not to perform less analysis. It is to reduce unnecessary claims while strengthening the evidentiary chain.

Few assumptions.
Explicit data.
Explicit transformation.
Explicit parameters.
Explicit error bounds.
Reproducible results.

A good system can produce hundreds of charts. A good digital-forensics specialist knows which chart answers the technical question actually being asked.

Among a million rows, the important point is not to display every row, but to be able to show the chain that produced the result.

Unit 7: Advanced Analysis, Traceability, and Validation

7.1. Traceability from a Graph Edge Back to Source Records

An edge drawn in a communication graph is not source evidence itself; it is a relationship derived from source records. Explainable analysis therefore requires more than saying that “A is connected to B.” The analyst should be able to trace the relationship back to the events that produced it.

graph edge
   -> supporting communication events
   -> canonical event identity
   -> source / derived record

Edge weight may be derived from call count, total duration, or another feature. If direction is available, which side initiated the event should remain distinguishable; if communication type is available, the event classes contributing to the edge should remain recoverable. Visualization can summarize these properties, but the summary should not replace the evidence path.

This connects provenance with interaction design. When an analyst selects a notable relationship in the graph, the same authorized scope should allow the supporting records to be inspected and, when appropriate, traced into a timeline or the original/derived record. The graph then becomes an investigative projection with a route back to evidence rather than a closed model that only emits conclusions.

For very large datasets, it is also important to preserve the scope from which the graph was built instead of silently querying all historical data again. “This relationship exists in the dataset” is not the same claim as “this relationship was observed in the result set for the inspected time range and filters.”

Explainable graph analysis can therefore be summarized as:

derived relation + source evidence path + scope information

This chain strengthens reproducibility and preserves the forensic boundary between source evidence and interpretation.

7.2. Reading Structural and Temporal Network Measures Together

The same communication set requires different measures for different questions. Degree counts distinct connections; weighted degree summarizes traffic volume; k-core describes how deeply a vertex remains inside a densely connected structure. Articulation points and bridges ask another question entirely: which vertices or edges are structural transitions between parts of the network?

The distinctions should remain explicit:

many connections   != structural bridge
high core number   != high PageRank
high PageRank      != forensic importance

A low-degree vertex can be the only articulation point between two subgraphs, while a high-degree vertex inside a dense cluster may have many alternative paths around it.

Directed HTS data also requires WCC and SCC to be separated. A weakly connected component ignores direction; a strongly connected component requires direction-respecting reachability. Treating unknown direction as bidirectional creates edges that were not observed. Directed metrics should therefore be accompanied by direction coverage.

Classical Jaccard compares peer sets only. If two targets contact the same peers with very different intensities, weighted Jaccard adds another view:

J_w(A,B) = Σ_i min(w_Ai, w_Bi) / Σ_i max(w_Ai, w_Bi)

The result remains in [0,1], but set overlap and intensity similarity should still be reported as separate concepts.

The distinctiveness of common neighbors can be evaluated with Adamic-Adar:

AA(A,B) = Σ_{z ∈ N(A) ∩ N(B), deg(z) > 1} 1 / ln(deg(z))

A common neighbor connected to almost everyone contributes less than a relatively rare common neighbor. A classical source is Adamic and Adar, Friends and Neighbors on the Web (2003): https://doi.org/10.1016/S0378-8733(03)00009-1

Similarity can also describe time profiles rather than peer sets. A target can be represented by a 24-dimensional hourly histogram or a 7-dimensional weekday histogram and compared with cosine similarity:

cos(A,B) = (A . B) / (||A|| * ||B||)

This is similarity of temporal usage shape; it is not evidence of identity, common intent, or coordination. If either vector has zero norm, the result is unavailable rather than forced to zero.

Static topology can hide event order. The presence of A -> B and B -> C edges does not by itself establish a temporally feasible chain from A to C. A time-respecting chain also requires event order. Direction, maximum hops, maximum inter-event gap, and maximum total span should therefore be explicit parameters rather than hidden assumptions.

7.3. Analysis Scope, Robust Baselines, and Persistent Change

A mathematically correct metric does not imply complete query coverage. If only the first 3,000 records of a paged result have been loaded, degree, PageRank, or Jaccard can be correct for those 3,000 records while still changing after later pages are included.

At minimum, analytical output should retain:

loaded record count
whether more query pages exist
earliest / latest included event time
fraction with known direction
rejected/unusable record count

"Is the calculation correct?" and "Does the calculation cover the whole query result?" are different questions.

Time-series baselines also benefit from local context. A target that normally has activity on a particular weekday or hour should not be judged solely against one global threshold. A robust historical baseline can begin with the following construction. The literature shows both that incomplete or bounded network observations can materially alter network-level measures and that robust scale estimators can be less sensitive to outliers than classical mean/standard-deviation summaries.[34], [42]

A robust historical baseline can begin with:

m = median(history)
MAD = median(|x_i - m|)
sigma_r = MAD / 0.6745

Exponentially weighted moving averages (EWMA) can describe the recent level, cumulative sums (CUSUM) can expose persistent small shifts, and robust deviation can identify an isolated unusual observation.[32], [31] "Unusual today" and "persistently increasing over recent periods" should therefore remain separate findings.

The forensic boundary is unchanged: these methods produce candidate patterns. No score becomes a forensic conclusion without source records, coverage, missing-data assessment, time accuracy, direction quality, and competing explanations.

7.3.1. Parameter Sensitivity and Boundary Effects

Parameters such as temporal tolerance, spatial radius, minimum event count, or anomaly threshold can directly change the candidate set. Let an analysis be represented by A(θ). Observing only the result at a single θ0 does not show how dependent the finding is on that parameter choice.

Results can therefore be compared over a methodologically reasonable neighborhood:

θ ∈ Θ

A candidate that remains present across a broad reasonable range can be described as more robust to the parameter choice; one that appears only near a boundary is boundary-sensitive.

This procedure does not produce a probability of truth and must not be used to tune parameters retrospectively until a desired result appears. Its purpose is to make the dependence of a result on analytical assumptions visible. Reporting the selected parameter, the alternative range examined, and the resulting changes improves reproducibility and technical review.[16]

7.4. Query-Scoped Analytical Projection

In communication and network analysis, the data universe from which a graph is derived is as important as the algorithm itself. When the examination concerns a subset defined by time, target, event type, or other criteria rather than the complete archive, the network should be treated as an analytical projection of that record subset.

query scope
    ↓
records entering analysis
    ↓
analytical snapshot
    ↓
graph / table / timeline

A table, graph, and timeline are different representations of the same record set, not separate evidence sets. Selecting a subgraph or excluding some vertices does not create a new claim about the source universe unless that change of scope is explicitly defined.

When the complete record set has not been acquired, structural measures may be mathematically correct on the observed subgraph yet change when additional data becomes available. At least three concepts should therefore remain separate:

query scope          = records belonging to the examination universe
analysis set         = records actually entering computation
analytical rendering = table, graph, or temporal representation of those records

How the network boundary is defined, and which records remain unobserved, can change degree, centrality, similarity, and community measures.[34] A result should be reported together with the data scope on which it was calculated.

7.5. Separating Event Graphs from Aggregated Relationship Graphs

HTS/CDR data may contain hundreds or thousands of communication events between the same two endpoints. Drawing every event as a separate edge is closest to the source records, but it quickly creates visual clutter. Two views can therefore be kept explicitly distinct:

event graph
A --cc1--> B
A --cc2--> B
A --cc3--> B

relationship graph
A == 3 events ==> B

An aggregated relationship edge is not new evidence. It is a summary of existing events between the same endpoints. Fields maintained for a relationship may include:

event_count
first_seen
last_seen
known_total_duration
distinct_days
event_type_distribution
known_direction_count
evidence_references

If duration, direction, or event type is unavailable in the source or cannot be normalized reliably, the missing state should remain explicit. In particular, forcing an event with unknown direction into A -> B or B -> A for visual convenience also introduces a false edge into later directed measures such as centrality and SCC.

Aggregation should be designed together with a path back to source evidence:

A == 37 events ==> B
        ↓
37 supporting records
        ↓
selected event
        ↓
source / canonical record

The graph can therefore display one edge while still allowing the analyst to inspect the events from which that edge was derived. If edge width represents communication count, a bounded nonlinear scale may be preferable; otherwise one extremely frequent relationship can dominate the entire visual field.

The relationship view emphasizes patterns, while the event view emphasizes evidential detail. They are not alternatives but different levels of resolution over the same data.

7.6. Progressive and Bounded Subgraph Extraction

In very large communication networks, the structure around a selected focal vertex can be extracted within a bounded number of hops instead of examining every vertex at once. A bounded breadth-first search (BFS) can be used for this purpose:

focal vertex
   ↓
1-hop neighbors
   ↓
2-hop neighbors
   ↓
max_hops / max_nodes / max_edges limit

With an adjacency list available, classical BFS has an upper bound of:

O(V + E)

[12] Limits such as max_hops, max_nodes, and max_edges restrict computation and examination scope only; vertices outside the bound must not be interpreted as absent from the underlying data set.

The order in which equally distant vertices are considered should also be reproducible. Degree, identifier, or another explicit secondary key may be used as a tie-breaker, provided that the rule is documented. Searching for a focus, preserving context, and expanding the surrounding graph on demand is also supported in the visual-analytics literature.[21], [44]

A bounded subgraph does not replace the source network. Structural interpretation remains valid only within the declared vertex, edge, and hop limits.

7.7. Versioned Analytical Snapshots and Indexing

As long as the underlying record set remains unchanged, network structure, relationship aggregates, and structural measures belong to the same analytical version. Instead of recomputing expensive derivations at every examination step, an analytical snapshot can therefore be associated with the version that defines its input.

record set + scope + rule version
              ↓
       analytical version N
              ↓
       analytical snapshot
       ├─ vertices
       ├─ relationships
       ├─ adjacency structure
       ├─ components
       ├─ centrality measures
       └─ evidence links

Adding records, changing the analytical scope, or changing the derivation rule requires a new analytical version. Merely presenting the same records in another form should not change the analytical result.

General indexes can reduce repeated full scans:

endpoint       → event records
canonical pair → aggregated relationship
vertex         → neighboring vertices

For N records, such indexes can usually be constructed in one pass with O(N) work. A hash-based index provides average O(1) key lookup followed by O(k) work for the returned records. BFS over adjacency is O(V + E), while t iterations of PageRank require approximately O(t(V+E)) work.[12]

The analytical version should be retained together with provenance. W3C PROV-O provides a general model for representing provenance through entities, activities, and derivation relations.[38] When input scope, transformation rule, and the path back to source records are known for each analytical version, the same result can be independently reproduced.

7.8. Record Semantics, Record Multiplicity, and Safe Deduplication

In HTS/CDR examination, two similar rows must not automatically be assumed to represent the same event. Charging and traffic records may be produced by different network components, service domains, or export processes. The fact that 3GPP treats CDR parameter semantics and CDR file transfer in separate technical specifications also illustrates that record meaning cannot be reduced to a few displayed columns.[28], [27]

Three concepts should remain distinct:

repeated import of the same file / row
        ≠
multiple source records related to one communication event
        ≠
different communication events between the same parties

Deduplication is therefore not equivalent to running DISTINCT. The selected key, timestamp resolution, direction, service type, cell information, device identity, and provider-specific fields can all change the result.

A safer workflow is:

RAW record
  ↓
duplicate candidate
  ↓
compare source fields
  ↓
apply documented same-event rule
  ↓
preserve RAW rows
  ↓
produce deduplicated analytical view

The deduplicated view must not replace the original source. It should remain possible to trace which rows were merged into one analytical event and under which rule. SWGDE guidance on preserving source data, provider documentation, and examination provenance supports this separation.[7], [10]

7.9. Time Semantics, Resolution, and Aggregation

The meaning of an HTS timestamp cannot be inferred from its date-time format alone. Before analysis, at least the following questions should be resolved:

which time zone?
UTC or local time?
daylight-saving transition?
event start or event end?
second or minute resolution?
provider rounding?

Time resolution directly affects event ordering and claims of simultaneity. If a source does not preserve seconds, two records carrying the same minute value may have an unknown true order. The analysis should preserve that uncertainty rather than manufacture a sequence.[7]

Aggregation is a separate analytical decision. Mokhtari and colleagues transformed five-minute inbound/outbound activity from real operator CDRs into hourly call counts for time-series analysis.[33] The example demonstrates how the selected window changes what remains visible:

5 minutes → short spike remains visible
1 hour    → short spike may be smoothed
1 day     → within-day structure may disappear

A report should therefore state not only that an anomaly was detected but also at what temporal resolution and under what aggregation rule. Temporal-network research likewise shows that treating communication edges as time-stamped events rather than continuously active ties changes the structural questions that can be asked.[22]

7.9.1. Separating Technical Order from Event Order When Timestamps Tie

If source time resolution cannot distinguish two events, their true chronological order may be unknown. Deterministic processing may nevertheless require a total technical ordering so that the same input produces the same output.

For example:

K(e) = (timestamp, source_sequence, source_record_id)

can define a stable processing key. The second and third components are technical tie-breakers; they do not establish that the real-world events occurred in that order.

This distinction matters in timelines, inter-event intervals, and temporal-path analysis. Events that the source resolution cannot order should remain in the same temporal equivalence class when interpretation depends on chronology; the technical ordering should serve reproducibility only.

7.10. Keeping Numbering, Subscription, and Equipment Identity Separate

A telephone number, network subscription, and equipment identity are different concepts. ITU-T E.164 defines the international public telecommunication numbering plan, while ITU-T E.212 defines the international identification plan for public networks and subscriptions.[40], [45] 3GPP TS 23.003 brings mobile-system numbering, addressing, and identification concepts together.[36]

A practical separation is:

E.164 number / MSISDN → numbering and routing context
IMSI                   → subscription / network identity
IMEI                   → equipment identity

For IMEI, GSMA TS.06 defines IMEI/TAC allocation principles and the requirement to preserve uniqueness.[41] Therefore:

same IMEI + different lines

does not by itself establish "same person", and:

same line + different IMEIs

should not automatically become "device definitely changed". Time, source quality, provider semantics, and corroborating observations are still required.

Number normalization should likewise preserve rather than erase the source representation:

source_value
canonical_value
normalization_rule_version

This allows +90..., 0090..., and national representations to be compared while the original value remains auditable.[40]

7.11. Layers of Location Evidence and the Limits of Geometric Distance

Location analysis should not be reduced to a single cell-site coordinate. A historical cell record is a network observation indicating the cell/sector associated with an event; it is not an exact physical coordinate for the device. Current SWGDE guidance on Historical Cell Site Analysis and RF propagation surveys makes this distinction especially important.[7], [46]

Location-related sources are not interchangeable evidence:

cell / sector record
        ↓
additional network measurements
        ↓
provider-specific location estimate
        ↓
post-event RF propagation survey

A propagation survey does not recreate the historical radio environment exactly. Load, antenna configuration, environmental obstructions, and network optimization can differ over time.[46]

A spherical formula such as Haversine gives an approximate geometric surface distance between two coordinates. That value is not:

the actual radio path between site and device

and is not:

the exact coverage radius of a cell

When high geodesic accuracy is required, direct/inverse geodesic algorithms on an ellipsoid can be used; Karney provides accurate and robust methods for that problem.[18]

A location report should therefore distinguish:

source network observation
computed geometric derivative
expert interpretation

7.12. Provenance and Analytical Lineage

A hash supports byte-level integrity of a file. It does not by itself explain how a graph edge, time-series anomaly, or common-contact score was derived from that file.

W3C PROV-O provides a general model for representing provenance across systems through entities, activities, and derivation relationships.[38] A lightweight HTS engineering interpretation can be:

source file
   ↓ normalization[v]
canonical dataset
   ↓ dedupRule[v]
analytical dataset
   ↓ queryScope + pageState
analytical snapshot
   ↓ algorithm[v] + parameters
graph / timeline / candidate
   ↓
report

For each transformation, it is useful to retain where feasible:

input identity / hash
algorithm or rule version
parameters
execution time
input record count
rejected / invalid record count
output identity / hash

This does not require every project to implement the full PROV-O ontology. The objective is traceability to source and reproducibility under the same transformation rules. That objective is consistent with NIST/ISO/SWGDE principles for integrity, repeatability, and evidence management.[19], [16], [23], [10]

7.12.1. Propagating Data Quality into Derived Results

Data quality should not be measured once at ingestion and then discarded. A derived result should remain accompanied by information about the data conditions under which it was produced.

Two correlation results of the same type may differ in:

temporal coverage
fraction of records with resolved location
fraction with known direction
source diversity
count of invalid or unresolved records

These dimensions do not have to be collapsed into a single "confidence score." Missing temporal coverage is not the same problem as poor spatial resolution, and one does not compensate for the other. Separate quality dimensions allow the examiner to see where a result is well supported and where it is limited.

When the path back to source records is preserved together with these quality dimensions, a derived candidate can be reviewed not only as a value but also in terms of the scope and data quality from which it was produced.

7.13. Scope of Measures in Incomplete or Bounded Networks

A common graph-analysis error is to assume that the observed subgraph represents the complete network. Kossinets showed that missing network data, and especially network-boundary specification, can materially alter clustering, assortativity, and other network-level statistics.[34]

In HTS, missingness or bounding can arise from:

legal / authorization scope
time range
operator coverage
queries limited to selected targets
pagination / loaded-result limits
missing or invalid records
normalization loss

Thus:

PageRank(v) = p

is incomplete without scope. A more defensible statement is:

PageRank(v) = p
on the graph derived from N_observed records
within the declared query scope

The same principle applies to degree, k-core, connected components, bridges, common neighbors, Jaccard, Adamic-Adar, and community detection. The calculation may be mathematically correct while still changing as the observation boundary expands.[34], [4]

7.14. Temporal and Multilayer Communication Networks

For telephone communications, the mere existence of an edge is often insufficient. Voice calls, SMS, and data sessions are different event types, and the order and timing of events between the same endpoints can be analytically important.

Temporal-network analysis treats edges as events that become active at particular times.[22]:

A --t1 voice--> B
A --t2 SMS----> B
B --t3 voice--> C

t1 < t2 < t3

This retains ordering that a static graph discards. A time-respecting path, for example, requires not only that edges exist but also that their timestamps can be followed forward.

Multilayer-network analysis allows different relationship types to remain distinguishable rather than collapsing everything into one edge.[35]:

VOICE layer
SMS layer
DATA layer
DEVICE relation
CELL observation

These layers do not have to be stored in separate physical databases. The conceptual separation prevents a statement such as "173 interactions" from hiding the event types that produced that count.

7.15. Limits of Centrality, Community Detection, and Link Candidates

Degree, PageRank, k-core, or betweenness summarize structural position in a graph; they do not measure social status, organizational role, or legal significance.

Community detection has the same boundary. Traag, Waltman, and van Eck showed that Louvain can yield poorly connected and in some cases disconnected communities, and developed Leiden to address those structural deficiencies.[47] Therefore, an algorithmic community does not by itself establish:

real social group
organization
family
work relationship
criminal relationship

Common-neighbor link-prediction methods are likewise structural heuristics. Adamic-Adar assigns greater weight to less-common shared neighbors when ranking potential links.[4] In HTS, such a score can create:

relationship candidate for review

but not a forensic conclusion that a relationship exists.

7.16. Progressive Visual Analysis for Large Graphs

The purpose of a graph interface is not to display every node at once; it is to present enough context to answer the analyst's question without losing scope.

Van Ham and Perer's "search, show context, expand on demand" model supports finding a focus in a large graph, showing relevant context, and progressively expanding its neighborhood.[21] Progressive visual analytics research also shows how partial analytical results can be inspected while their incompleteness remains explicit.[44]

A safe HTS adaptation is:

search result
   ↓
versioned analytical snapshot
   ↓
focus node / relation
   ↓
1-2 hop context
   ↓
return to supporting evidence records

An "expand" interaction should not silently enlarge the analytical universe. If it only reveals additional nodes already present in the current snapshot, it remains a view operation. Loading more records is a separate, explicit data-acquisition action.

This separation supports forensic scope control as well as visual simplicity.

7.17. Problem Formulation for Anomaly Detection

Anomaly is not a synonym for "suspicious". It is an observation that deviates unexpectedly from a defined reference behavior. The anomaly-detection literature contains statistical, distance/density, clustering, and learning-based method families.[9]

Different time-series questions call for different tools:

single robust deviation       → median / MAD
small gradual drift           → EWMA
persistent small level shift  → CUSUM
regime change                 → changepoint detection
deviation from expectation    → forecast residual

For MAD:

m = median(x)
MAD = median(|x_i - m|)

provides a robust scale starting point; Rousseeuw and Croux analyze its robustness properties in detail.[42]

EWMA gives progressively less weight to older observations and can increase sensitivity to small or gradual changes.[32] CUSUM accumulates deviations and can be useful for persistent small shifts in a mean.[31]

When multiple changes are possible, methods such as PELT can provide exact segmentation with favorable computational properties under stated conditions.[25]

No method is universally best. Selection depends on event type, temporal resolution, seasonality, missingness, and the operational cost of false alarms.

7.17.1. Distinguishing Zero from Unknown on a Temporal Grid

A time series can be distorted if it contains only intervals in which events were observed. The analysis interval should first be represented on a fixed temporal grid, after which the observability state of each interval is determined.

At least three states can be distinguished:

observed activity  → one or more events in a covered interval
observed zero      → the source covers the interval and no event is present
unknown            → source observability for the interval cannot be established

Silently replacing an unknown interval with 0 converts missing coverage into an assertion of no activity. Conversely, dropping intervals that are known to be covered but empty can inflate estimated activity levels and variability.

The construction of the temporal grid and the treatment of empty intervals should therefore be stated before applying robust deviation, EWMA, CUSUM, forecast residuals, or related methods. "No record is available" and "an observed zero occurred" are different data states.

7.18. Aggregated CDR Traffic Anomalies and Forecast Residuals

Mokhtari, Ghorbani, and Bahrak applied time-series anomaly detection to three months of anonymized CDR data from a mobile operator.[33] Five-minute inbound/outbound activity was aggregated into hourly call counts, and GARCH, K-means, and neural-network-based predictions were combined and compared.

The main analytical value of the study is the following chain:

raw events
   ↓
aggregate within a time window
   ↓
learn expected level / pattern
   ↓
compare observation with expectation
   ↓
threshold / model decision
   ↓
anomaly candidate

A forecast residual can be written as:

e_t = y_t - y_hat_t

As |e_t| grows, the observation is farther from what the model expected. The resulting interpretation still depends on threshold selection, training period, temporal aggregation, and seasonality.[33], [9]

The high accuracy and low false-positive rates reported by the paper on its own dataset must not be reused as universal HTS performance claims. The study is based on a limited dataset that is not publicly available because of commercial restrictions.[33] The training/test percentages reported in the paper also contain an internal numerical inconsistency, which is a useful reminder that published numerical details should still be critically checked.

A hybrid decision can be generalized as:

A OR B OR C flags it  → broader candidate set
A AND B AND C flag it → greater model agreement

The precision/recall effect depends on the models' correlated errors and the data distribution; logical combination alone provides no performance guarantee.

7.19. False Positives, Base Rates, and Multiple Testing

An HTS analysis may examine thousands of lines, time windows, cells, or relationship pairs. Repeating the same statistical decision over many candidates can produce many chance findings even when each individual threshold appears conservative.

Two questions are therefore different:

is this candidate's score high?
when thousands of candidates are tested, how often is such a score expected by chance?

The Benjamini-Hochberg procedure was developed to control the false discovery rate (FDR) in multiple hypothesis testing.[8] An HTS system does not need to convert every score into a p-value, but analysts should understand the multiplicity effect when many candidates are screened.

Accuracy alone can also be misleading for rare anomalies. A classifier labeling every observation as normal can appear highly accurate when the anomaly base rate is very low. Depending on the task, evaluation may need to consider:

false-positive rate
false-negative rate
precision
recall
PR curve
ROC
anomaly base rate

together.[33], [9]

In forensic work, a false positive is more than an operational cost; it can misdirect analyst attention. Scope, score, and supporting source records should therefore remain visible together.

7.20. 5G And Evolving Record Semantics

The concept of CDR should not be reduced to classic voice-call records. 3GPP TS 32.297 and TS 32.298 continue to define CDR file/transfer and parameter semantics within current charging management.[28], [27] For the 5G data-connectivity domain, TS 32.255 separately defines charging management and remains under change control for Release 20.[26]

Two consequences follow:

1. The fields a network can technically generate evolve by service and release.
2. An operator export delivered to an analyst or judicial authority does not necessarily contain every field defined in the relevant 3GPP specification.

A canonical schema should therefore avoid assuming a universal set of mandatory columns and instead follow:

field present in source
→ verified source meaning
→ canonical field
→ data-quality flag

Voice, messaging, packet data, and service-specific charging records can have different semantics. Unknown event types should remain OTHER or preserve the provider code until their meaning is validated; similarity of labels is not enough to invent semantics.

7.21. Advanced Models, Baselines, and Generalization

Machine learning or graph neural networks do not make explainable baseline methods obsolete. Recent work on temporal mobile-connectivity data has shown that more complex temporal graph models do not necessarily outperform simpler baselines in every setting.[24]

A safer evaluation order is:

simple explainable baseline
        ↓
time-aware train/validation/test separation
        ↓
more complex model
        ↓
comparison under the same metrics
        ↓
out-of-period / external validation

For time series, random train/test splitting can leak future information. A forecasting model should be trained on past observations, with validation and test periods occurring later in time.

A model may produce:

risk score
anomaly probability
link candidate
cluster label

None of these outputs alone establishes identity, exact location, relationship meaning, or legal responsibility.

7.22. Making Technical Validation Part of the Report

A strong HTS report is not only a result table; it also records how the result was produced.

A minimum validation matrix can include:

data scope               → date / target / operator / loaded records
source integrity         → hash / delivery information
normalization            → rule version / rejected records
deduplication            → rule / RAW-DERIVED separation
time                     → timezone / resolution / aggregation
location                 → source type / geometric derivative / RF limits
graph                    → directed/undirected / layer / scope
anomaly                  → baseline / window / threshold / model version
algorithm                → parameters / deterministic seed when relevant
evidence link            → source_file + source_row / canonical record

This structure improves reproducibility and keeps expert interpretation separate from algorithmic output.[16], [23], [10], [38]

The final rule remains:

measure
show the scope
return to source
do not conclude before testing alternative explanations

7.22.1. Validation Through Analytical Invariants

Expected algorithmic behavior can be constrained not only by example outputs but also by invariants derived from the analytical definition. Such checks do not prove the forensic conclusion; they show whether an implementation applies the same mathematical definition consistently.

Examples include:

Order-independent analysis:
F(X) = F(π(X))

Deduplication:
D(D(X)) = D(X)

Undirected commonality measure:
C(A,B) = C(B,A)

Here π(X) denotes a permutation of the same records. A second deduplication pass should not produce additional loss. For an undirected commonality measure, exchanging the two parties should not change the result.

Boundary cases should also be tested explicitly:

time difference exactly at the tolerance boundary
equal timestamps
missing location
empty set
single record
repeated copy of the same source row

Finally, the ability to trace every derived finding back to at least one source observation can be treated as a provenance invariant. These checks translate reproducibility and independent technical review into concrete analytical expectations.[16], [12]

7.22.2. Coverage-Aware Relationship Valuation and Distribution Analysis

Ranking a relationship only by total event count is often too crude. Two relationships with the same volume can differ substantially in persistence, reciprocity, duration, and recency. A stronger design keeps these as separate analytical signal dimensions rather than treating one count as a complete description.

A relationship profile can therefore contain:

frequency
persistence
reciprocity
duration
recency

Not every component will have equal data quality. If duration exists for only part of the observations, interpreting missing duration as zero artificially weakens the relationship. A coverage-aware approach adjusts a component's influence by the fraction of observations for which that component is actually evaluable:

effectiveWeight_i = configuredWeight_i × coverage_i

combinedValue =
    sum(effectiveWeight_i × component_i)
    -------------------------------------
          sum(effectiveWeight_i)

The combined value is not a legal, behavioral, or personal-importance score. It is only an analytical ordering of observable relationship properties inside the examined scope.

Persistence should measure how activity is distributed across the observation window, not merely how many events occurred. Daily buckets can be useful for short windows and weekly buckets for longer windows. This separates an intense one-day burst from a relationship that reappears throughout a longer period.

Reciprocity must be evaluated only when direction is known. An observation with unknown direction must not be converted into two-way activity or inserted as a fabricated directed edge. That distinction directly affects directed centrality and strongly connected component analysis.

7.22.3. Concentration and Effective Number of Peers

The number of distinct peers does not describe how communication is distributed among them. Two endpoints may each have ten peers while one concentrates most activity on a single peer and the other distributes activity almost evenly.

A Herfindahl-Hirschman-style concentration measure can be expressed as:

HHI = p1² + p2² + ... + pn²

where p_i is the share associated with peer i.

Higher values indicate concentration and lower values indicate dispersion. Thresholds must be interpreted within the analytical domain; thresholds borrowed from economic concentration analysis should not be treated as universal communication-analysis rules.

Shannon entropy provides a complementary view of diversity:

H = - Σ p_i × log(p_i)

Exponentiating entropy gives the intuition of an effective number of equally weighted peers:

effectivePeers ≈ exp(H)

Together, distinct-peer count, concentration, and entropy describe different aspects of the same communication neighborhood.

7.22.4. Consolidating Multiple Temporal Signals

The same day can be highlighted by several time-series methods. A robust deviation statistic, an exponentially weighted moving average, and a cumulative-shift detector may all point to the same period. Presenting these as three independent incidents creates alert duplication.

A clearer representation is:

date / period
  ├─ robust deviation signal
  ├─ smoothed process signal
  └─ persistent-shift signal

under one temporal candidate.

This makes method agreement visible without turning it into false certainty. The methods still share the same underlying observations and therefore are not independent experiments.

Missing time coverage must also remain distinct from zero activity. Filling an unobserved interval with zeros can distort baselines, variance, and change detection. The system should first determine which intervals were actually observable.

7.22.5. Subgraph Scope and the Semantic Boundary of Graph Metrics

A graph metric is valid for the graph on which it was computed. A filtered or loaded subgraph is not automatically equivalent to the complete real-world network.

Results such as:

high degree
high PageRank
high core number
bridge
articulation point

should therefore be read as structural properties within the observed graph.

Centrality does not establish real-world importance, intent, or legal significance. Likewise, a relationship first observed inside one analytical window is not necessarily historically new.

A defensible analytical interface keeps the metric connected to its scope:

which source observations?
which period?
which filters?
which known directions?
which subgraph?

This turns communication analytics from graph production into scope-aware, source-traceable, reproducible analysis.

7.23. Missing Data, Base Rates, and Alternative Hypotheses

An HTS record is not a complete copy of reality. Device state, collection policy, cell changes, source scope, and transfer failures can create gaps. "No record" is not equivalent to "no event."

Base rates also matter in relationship analysis. A number with naturally high communication volume can have many edges without implying close relationships.

Forensic interpretation should state at least one plausible alternative hypothesis for important observations. This reduces confirmation bias and makes the report more auditable.

7.24. Separating Evidence from Inference in Forensic Interpretation

An HTS/CDR record is an observation; relationship, intent, or event interpretation is an inference. Keeping raw records, derived features, and analyst conclusions distinct makes the result easier to audit.

Time zones, clock synchronization, operator retention/collection policy, cell coverage, and missing data all limit interpretation. “No record” is not equivalent to “no communication” unless the source's ability to observe the event is established.

Important findings should be challenged with alternative explanations. Co-occurrence in one cell can reflect coverage or network behavior, and relationship strength should be interpreted against base rates and overall communication volume.

The legal characterization of HTS/CDR data should be assessed separately in light of the concrete case, current legislation, and applicable judicial decisions.

7.25. Modeling HTS Data as a Temporal Network

In temporal networks, when an edge occurs is part of the structure, not merely metadata. In HTS relationship analysis, collapsing months of records into one static graph can combine contacts from different dates into temporally impossible paths, while short but investigation-critical interactions disappear inside long-term aggregate density. Time-respecting paths, temporal reachability, edge persistence, burstiness, and time-dependent centrality therefore complement static degree and one-shot community partitions.

• Show how static call totals and time-respecting contact chains can produce different conclusions.
• Use burstiness and edge persistence to distinguish sustained from short-lived interaction patterns.
• Keep temporal-centrality findings explicitly non-causal and non-semantic on their own.

7.26. Uncertainty and False Associations in Temporal Communication Patterns

Recurring temporal or counterparty patterns in communication records do not establish causal relationships. Observation windows, recording completeness, shared-device usage, and changing identifiers may support different explanations of an identical graph structure. Temporal density, reciprocity, and persistence metrics require an explicit baseline and selection criteria.

An anomaly score is calculated against a defined baseline; rarity does not establish error or illegality. Missing records and clock offsets may invalidate temporal-path inference. Evidential interpretation requires distinguishing directly observed communication edges from algorithmically inferred candidate links.

7.27. Conclusion

An HTS record is not a story by itself. It is a recorded portion of the technical traces generated by a network during particular events, organized along the axes of time, device, line, and cell.

The task of the digital-forensics specialist is not to force those traces into a pre-established narrative, but to preserve the following chain:

Source
 ↓
Integrity
 ↓
Normalization
 ↓
Verification
 ↓
Correlation
 ↓
Algorithmic candidate
 ↓
Counter-hypothesis
 ↓
Expert interpretation
 ↓
Limitations

A record may show that a cell was used; it may not establish an exact address. An IMEI may link two lines; it may not establish that two people are the same person. A graph may show a common contact; it cannot determine the legal nature of the relationship. An anomaly may show unusual behavior; it does not show criminal intent.

Good HTS analysis is therefore not analysis that produces more definitive judgments. It is analysis that can return to the source, explain its algorithm, expose its parameters, test alternative explanations, and state the limits of its conclusions clearly.

Technical competence in digital forensics is not only the ability to derive conclusions from data; it is also knowing which conclusions cannot be derived from the data.

Unit 8: Text-Derived Link Analysis and Evidence Boundaries

A communication graph built from HTS/CDR event records and an entity/concept graph produced through information extraction are not the same data type. Both can be represented as nodes and edges, but the evidential semantics of an edge are different.

HTS / CDR event
    ↓
observed communication or network record
    ↓
event / relationship graph

versus:

text
  ↓
entity + relation extraction
  ↓
text-derived concept graph

8.1. Separating Text-Derived Links from Direct Observations

Two entities appearing in the same sentence do not automatically prove a specific real-world relationship. An edge may originate from:

• co-occurrence,
• an extracted relation,
• common document membership,
• a rule match,
• a model prediction.

A text-derived edge should therefore remain traceable to at least:

source document
span / evidence location
extraction method
relation type
confidence or rule provenance

8.2. Same Graph Mathematics, Different Interpretation

Text-derived graphs can still support:

• paths,
• cycles,
• degree,
• closeness,
• betweenness,
• partition/community analysis.

But:

graph structure ≠ real-world causality

High centrality does not prove that an entity caused an event, controlled others, or is the most important real-world actor. It describes structural position under the chosen node and edge semantics.

8.3. Network Pattern Matching

Link analysis can search for candidate subgraph forms such as:

A → B → C

A → {B,C,D}

A ↔ B

A → B → C → A

These are structural candidates. Matching a topology does not prove a predefined semantic interpretation of that topology.

In forensic work, the defensible statement is:

"A subgraph matching the defined structural pattern was found."

Stronger claims such as coordination, command, organization membership, or causation require independent evidence.

8.4. Distinguishing Graph Layout from Analytical Metrics

Force-directed or spring layouts optimize readability, not evidential meaning. Screen-space proximity may satisfy:

visual proximity ≠ graph distance ≠ semantic relation

Reports should therefore distinguish layout position from centrality, shortest-path distance, or edge weight.

8.5. Temporal Text Graphs versus HTS Temporal Graphs

Timestamped documents can support trend graphs in which concept relationships are classified as:

new
increased
decreased
stable

This is not equivalent to an event-ordered HTS temporal graph. Document publication time, the time of an event described in the document, and the timestamp of a telecom record may all differ.

A safe provenance model keeps:

document time
event time
network-record time

as distinct temporal semantics.

8.6. Combining Multiple Graph Sources

If textual and telecom evidence are used together, they should not collapse into one anonymous edge type. A safer typed-edge model is:

edge
 ├── observed-communication
 ├── shared-location-observation
 ├── text-cooccurrence
 ├── extracted-relation
 └── analyst-asserted hypothesis

Typed edges prevent distinct evidence levels from appearing equivalent in one visualization.

8.7. Observation Coverage and False Positives in Temporal Communication Graphs

A graph built from communication records represents observed links within a particular dataset; it does not independently establish personal identity, message content or the reasons for a relationship. Edge counts are not comparable without considering observation period and coverage. A shortest path or high centrality score does not prove direct contact or hierarchy outside the observed records.

Temporal paths depend on edge order and time range. Even when t_1 ≤ t_2 ≤ ... holds, the result shows chronological reachability, not causal influence. Comparisons between observation windows require aligned scope; truncated records and unknown observations must be disclosed.

In a synthetic sensitivity study, twenty percent of records can be removed at random and centrality rankings recalculated. The magnitude of ranking change reveals sensitivity to missing observations; it does not prove that the real dataset is missing twenty percent. Computation and interpretation remain separate layers of the analytic report.

8.8. Identity Uncertainty and Temporal Alignment in Record Correlation

Subscription, SIM, device and person are not interchangeable identifiers. One device may host different subscriptions over time; traffic associated with one subscription does not independently prove which person physically used it. Correlation rules need source identity and temporal validity, while unresolved identities should remain unresolved rather than filled with guesses.

Time zones, daylight-saving conversions, start/end event semantics and timestamp rounding affect temporal correlation. Detecting overlapping intervals does not automatically establish co-location or joint movement. Inference must remain at the resolution supported by the underlying data type.

References

• **[10]** SWGDE. Best Practices for Digital Evidence Collection.
• **[11]** Constitutional Court of Türkiye. Murat Albayrak, Application No. 2020/16168, 8 March 2023. Decision notice.
• **[12]** Thomas H. Cormen; Charles E. Leiserson; Ronald L. Rivest; Clifford Stein. Introduction to Algorithms. 4th ed., MIT Press, 2022.
• **[13]** Information and Communication Technologies Authority (BTK). Protection of Personal Data.
• **[14]** Personal Data Protection Authority of Türkiye (KVKK). Public announcement concerning the processing of location data.
• **[15]** RFC 5737. IPv4 Address Blocks Reserved for Documentation.
• **[16]** ISO/IEC 27042:2015. Guidelines for the analysis and interpretation of digital evidence.
• **[17]** NIST SP 800-101 Rev.1. Guidelines on Mobile Device Forensics.
• **[18]** C. F. F. Karney. Algorithms for geodesics. Journal of Geodesy, 87, 43-55, 2013.
• **[19]** NIST. Digital Forensics - Glossary.
• **[1]** European Parliament and Council. Directive 2002/58/EC.
• **[20]** K.-I. Goh, A.-L. Barabási. Burstiness and memory in complex systems. EPL, 81(4), 48002, 2008.
• **[21]** F. van Ham, A. Perer. Search, Show Context, Expand on Demand: Supporting Large Graph Exploration with Degree-of-Interest. IEEE Transactions on Visualization and Computer Graphics, 15(6), 953-960, 2009.
• **[22]** P. Holme, J. Saramäki. Temporal Networks. Physics Reports, 519(3), 97-125, 2012.
• **[23]** ISO/IEC 27037:2012. Guidelines for identification, collection, acquisition and preservation of digital evidence.
• **[24]** J. Jaskari, C. Roy, F. Ogushi, M. Saukkoriipi, J. Sahlsten, K. Kaski. Temporal social network modeling of mobile connectivity data with graph neural networks. PLOS One, 20(12), e0335267, 2025.
• **[25]** R. Killick, P. Fearnhead, I. A. Eckley. Optimal Detection of Changepoints With a Linear Computational Cost. Journal of the American Statistical Association, 107(500), 1590-1598, 2012.
• **[26]** 3GPP TS 32.255. Telecommunication management; Charging management; 5G data connectivity domain charging; Stage 2.
• **[27]** 3GPP TS 32.297. Telecommunication management; Charging management; Charging Data Record (CDR) file format and transfer.
• **[28]** 3GPP TS 32.298. Telecommunication management; Charging management; Charging Data Record (CDR) parameter description.
• **[29]** NIST. Evidence Management.
• **[2]** Turkish Code of Criminal Procedure No. 5271, Article 135.
• **[30]** Republic of Türkiye Ministry of Justice. Criminal Procedure Law training material.
• **[31]** NIST/SEMATECH. CUSUM Control Charts. e-Handbook of Statistical Methods.
• **[32]** NIST/SEMATECH. EWMA Control Charts. e-Handbook of Statistical Methods.
• **[33]** A. Mokhtari, N. Ghorbani, B. Bahrak. Aggregated Traffic Anomaly Detection Using Time Series Forecasting on Call Detail Records. Security and Communication Networks, 2022, Article 1182315.
• **[34]** G. Kossinets. Effects of Missing Data in Social Networks. Social Networks, 28(3), 247-268, 2006.
• **[35]** M. Kivelä et al. Multilayer Networks. Journal of Complex Networks, 2(3), 203-271, 2014.
• **[36]** 3GPP TS 23.003. Numbering, addressing and identification.
• **[37]** J.-P. Onnela, J. Saramäki, J. Hyvönen, G. Szabó, D. Lazer, K. Kaski, J. Kertész, A.-L. Barabási. Structure and tie strengths in mobile communication networks. Proceedings of the National Academy of Sciences, 104(18), 7332-7336, 2007.
• **[38]** W3C. PROV-O: The PROV Ontology, W3C Recommendation, 2013.
• **[39]** S. Perreault, I. Yamagata, S. Miyakawa, A. Nakagawa, H. Ashida. RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs). IETF BCP 127, 2013.
• **[3]** E. Abba, A. M. Aibinu, J. K. Alhassan. Development of multiple mobile networks call detailed records and its forensic analysis. Digital Communications and Networks, 5(4), 256–265, 2019.
• **[40]** ITU-T E.164 (02/2026). The international public telecommunication numbering plan.
• **[41]** GSMA TS.06 v28.1. IMEI Allocation and Approval Process, 2025.
• **[42]** P. J. Rousseeuw, C. Croux. Alternatives to the Median Absolute Deviation. Journal of the American Statistical Association, 88(424), 1273-1283, 1993.
• **[43]** BTK. Regulation on the Processing of Personal Data and Protection of Privacy in the Electronic Communications Sector.
• **[44]** C. D. Stolper, A. Perer, D. Gotz. Progressive Visual Analytics: User-Driven Visual Exploration of In-Progress Analytics. IEEE Transactions on Visualization and Computer Graphics, 20(12), 1653-1662, 2014.
• **[45]** ITU-T E.212 (06/2024). The international identification plan for public networks and subscriptions.
• **[46]** SWGDE 25-F-003-1.0. Best Practices for Radio Frequency Propagation Surveys, 2026.
• **[47]** V. A. Traag, L. Waltman, N. J. van Eck. From Louvain to Leiden: guaranteeing well-connected communities. Scientific Reports, 9, 5233, 2019.
• **[48]** F. Wang, C. Chen. On data processing required to derive mobility patterns from passively-generated mobile phone data. Transportation Research Part C, 87, 58-74, 2018.
• **[49]** Petter Holme; Jari Saramäki (eds.). Temporal Network Theory. 2nd ed. Springer Nature Switzerland, 2023.
• **[4]** L. A. Adamic, E. Adar. [Friends and neighbors on the Web](https://doi.org/10.1016/S0378-8733(03)00009-1). Social Networks, 25(3), 211-230, 2003.
• **[50]** Albert-László Barabási. Network Science.
• **[51]** Ronen Feldman; James Sanger. The Text Mining Handbook: Advanced Approaches in Analyzing Unstructured Data. Cambridge University Press, 2007.
• **[52]** Walter W. Piegorsch, Richard A. Levine, Hao Helen Zhang, Thomas C. M. Lee (eds.). Computational Statistics in Data Science. Wiley, 2022. ISBN 9781119561071.
• **[5]** N. R. Al-Molhem, Y. Rahal, M. Dakkak. Social network analysis in Telecom data. Journal of Big Data, 6, 99, 2019.
• **[6]** NIST/OSAC. SWGDE Recommendations for Cell Site Analysis.
• **[7]** SWGDE 17-F-001-5.0. Recommendations for Historical Cell Site Analysis, Version 5.0, 20 February 2026.
• **[8]** Y. Benjamini, Y. Hochberg. Controlling the False Discovery Rate: A Practical and Powerful Approach to Multiple Testing. Journal of the Royal Statistical Society Series B, 57(1), 289-300, 1995.
• **[9]** V. Chandola, A. Banerjee, V. Kumar. Anomaly Detection: A Survey. ACM Computing Surveys, 41(3), Article 15, 2009.