Last Known Location: Reconstructing a Missing Person's Final Hours via CDR
A 34-year-old man was reported missing after failing to return from a business trip. Cell tower handover analysis across two carriers narrowed the search area from a 40 km radius to a single 2 km corridor.
Background
Family members reported the subject missing after he stopped responding to calls following a scheduled client meeting. Local law enforcement obtained a court order compelling both the subject's mobile carrier and the carrier of his last known contact to produce Call Detail Records for the preceding 72 hours.
Evidence Seized
- 72-hour CDR dump from the subject's carrier (Carrier A)
- CDR for the last outgoing call recipient from Carrier B
- Cell site database (tower ID, lat/long, azimuth, sector) from both carriers
Tools Used
- Excel + Power Query (record cleaning and pivoting)
- Python (pandas, folium) for tower-to-map visualization
- QGIS (sector polygon plotting and azimuth cones)
Methodology
- Normalized both carriers' CDR exports into a common schema (A-party, B-party, IMEI, IMSI, first cell ID, last cell ID, LAC, call type, start time, duration).
- Filtered to the subject's IMSI/MSISDN and sorted chronologically to build a per-call tower sequence.
- Joined cell IDs against the carrier-provided cell site database to obtain tower latitude/longitude and sector azimuth for each call.
- Plotted each tower as a directional sector cone (azimuth ± half beamwidth) rather than a single point, since a handset can be anywhere within the serving sector, not necessarily at the tower.
- Identified the last three tower handovers before the phone went silent and computed the overlapping region of their sector cones to bound a probable last-known-location corridor.
- Cross-referenced the recipient's CDR (Carrier B) for the final call to confirm both handsets registered on geographically consistent towers, corroborating the location estimate independently.
- Delivered a bounded search-area map (not a pinpoint) to the search-and-rescue coordination team, with explicit uncertainty radius documented.
Key Artifacts Found
- A cluster of three consecutive tower handovers within an 18-minute window, consistent with movement along a specific highway corridor rather than a stationary location
- The final CDR entry was a short 4-second call with no subsequent activity, followed by the handset never re-registering on the network — consistent with power loss or destruction
- Sector-cone overlap analysis narrowed the probable last-location area to roughly 2 km along the corridor, versus the ~40 km single-tower coverage radius alone would have implied
Challenges
- The two carriers used different LAC/cell-ID numbering conventions, requiring careful schema mapping to avoid false matches.
- Investigators initially wanted a single pinpoint location; explaining that CDR provides a probabilistic serving-sector area — not GPS-grade precision — was essential to prevent search resources being misallocated to a single wrong spot.
- Daylight-saving and time-zone offsets between the two carriers' export formats had to be reconciled before the timeline would align.
Outcome
Search-and-rescue teams concentrated resources along the identified corridor and located the subject's vehicle, which had gone off-road, within the mapped 2 km search area approximately six hours after the search began.
Lessons Learned
Always model tower coverage as a directional sector, not a point radius — azimuth data dramatically tightens the probable location area. Independent corroboration from a second party's CDR is a powerful, underused validation step.