Skip to content
All Case Studies
IntermediateCDR/IPDRCell Tower MappingMissing Person

Last Known Location: Reconstructing a Missing Person's Final Hours via CDR

A 34-year-old man was reported missing after failing to return from a business trip. Cell tower handover analysis across two carriers narrowed the search area from a 40 km radius to a single 2 km corridor.

Background

Family members reported the subject missing after he stopped responding to calls following a scheduled client meeting. Local law enforcement obtained a court order compelling both the subject's mobile carrier and the carrier of his last known contact to produce Call Detail Records for the preceding 72 hours.

Evidence Seized

  • 72-hour CDR dump from the subject's carrier (Carrier A)
  • CDR for the last outgoing call recipient from Carrier B
  • Cell site database (tower ID, lat/long, azimuth, sector) from both carriers

Tools Used

  • Excel + Power Query (record cleaning and pivoting)
  • Python (pandas, folium) for tower-to-map visualization
  • QGIS (sector polygon plotting and azimuth cones)

Methodology

  • Normalized both carriers' CDR exports into a common schema (A-party, B-party, IMEI, IMSI, first cell ID, last cell ID, LAC, call type, start time, duration).
  • Filtered to the subject's IMSI/MSISDN and sorted chronologically to build a per-call tower sequence.
  • Joined cell IDs against the carrier-provided cell site database to obtain tower latitude/longitude and sector azimuth for each call.
  • Plotted each tower as a directional sector cone (azimuth ± half beamwidth) rather than a single point, since a handset can be anywhere within the serving sector, not necessarily at the tower.
  • Identified the last three tower handovers before the phone went silent and computed the overlapping region of their sector cones to bound a probable last-known-location corridor.
  • Cross-referenced the recipient's CDR (Carrier B) for the final call to confirm both handsets registered on geographically consistent towers, corroborating the location estimate independently.
  • Delivered a bounded search-area map (not a pinpoint) to the search-and-rescue coordination team, with explicit uncertainty radius documented.

Key Artifacts Found

  • A cluster of three consecutive tower handovers within an 18-minute window, consistent with movement along a specific highway corridor rather than a stationary location
  • The final CDR entry was a short 4-second call with no subsequent activity, followed by the handset never re-registering on the network — consistent with power loss or destruction
  • Sector-cone overlap analysis narrowed the probable last-location area to roughly 2 km along the corridor, versus the ~40 km single-tower coverage radius alone would have implied

Challenges

  • The two carriers used different LAC/cell-ID numbering conventions, requiring careful schema mapping to avoid false matches.
  • Investigators initially wanted a single pinpoint location; explaining that CDR provides a probabilistic serving-sector area — not GPS-grade precision — was essential to prevent search resources being misallocated to a single wrong spot.
  • Daylight-saving and time-zone offsets between the two carriers' export formats had to be reconciled before the timeline would align.

Outcome

Search-and-rescue teams concentrated resources along the identified corridor and located the subject's vehicle, which had gone off-road, within the mapped 2 km search area approximately six hours after the search began.

Lessons Learned

Always model tower coverage as a directional sector, not a point radius — azimuth data dramatically tightens the probable location area. Independent corroboration from a second party's CDR is a powerful, underused validation step.

This case has been anonymized and fictionalized for confidentiality. Names, identifiers, and specific circumstances have been altered or composited; any resemblance to a real investigation is coincidental.