How to analyse phone call records and find the patterns

Sort the records by time, then ask five questions of them, each of which is one pivot: who this number talks to most, and which way the traffic runs; when each contact started and when it stopped; what hours and days the phone is active, laid out as a week by hour; where the silences are; and, with two subscribers' records, which numbers both of them deal with. None of it is hard. It is tedious, it is easy to get wrong by hand, and the finding is usually a date — the day a contact stopped, or the two days nothing happened — rather than a number.

What a call record actually contains

A call detail record set from a network is a table with one row per event. The columns vary by operator and by the form of the request, but the four that carry the analysis are always there in some spelling: the date and time, the number the record belongs to, the other number, and the direction. Duration and the kind of event — call, text, data session — usually follow. Cell-site and location columns may or may not, and this page is not about them.

Two things about the time column before anything else. First, it is in a timezone, and the operator's is not always yours; a set produced in UTC read as local time puts every evening call an hour out and the night pattern in the wrong place. Second, the direction words differ — MO and MT, out and in, originating and terminating, sent and received — and a reading that gets them backwards has the wrong person making every call.

The five questions, and the pivot that answers each

A worked set

CDR opens on a made-up set built to hold the shapes an analyst looks for: two subscribers, six weeks, 272 records for the busier of them. Read the way the table above says, it gives up the following.

• One number is half the traffic. 07700900411 is 49% of everything: 134 contacts over 41.4 days, 69 out and 65 in, which is a relationship in both directions.
• One contact stops dead. 07700900742 is the second-heaviest number in the set, 77 contacts, and the last of them is on 31 January at 13:08. The record runs to 15 February. Fifteen days of silence from a number that had been in touch most days is the finding, and the date is the finding's date.
• The week has a shape. Laid out by hour, weekdays run from about nine in the morning to six in the evening with nothing overnight; weekends are lighter and later. The other subscriber in the set is the opposite — active between ten at night and five in the morning — and that difference is visible in the grid before a single row has been read.
• There is a two-day hole. The longest silence is 62.4 hours, from the evening of 23 January to the morning of the 26th, in a set that otherwise never goes a day without activity. Whatever happened on the 24th and 25th, the phone was not part of it, and that is evidence in the same way a call would be.
• The two subscribers never call each other, and share one number. 07700900411 is in both sets — 134 contacts with one subscriber, 66 with the other — and there is no direct contact between the two subscribers at all. That is the structure the question “are these two connected?” is really asking about.

Every one of those is a pivot somebody could build in a spreadsheet in an afternoon. Building all five, for two subscribers, correctly, and again on the next case, is what people do not do, which is why a record set is so often read as a list of the calls on the day in question and nothing else.

What counts as “stopped”, and why the thresholds are stated

A contact that appears once and never again has not stopped; it was a wrong number or a one-off. CDR calls a contact stopped when it appears three or more times and then goes silent for longer than a fifth of the record, or a week, whichever is longer, and it says so on the page, because a reader who is going to rely on the word “stopped” is entitled to know what it means. The same goes for a silence: the default is eight hours, it is a setting, and raising it to forty-eight on the sample leaves exactly one gap, the two-day one.

What it does not do

CDR reads the records you hold lawfully, in the page, and nothing leaves the device. It does not fetch anything, look a number up, or resolve a number to a person, and it does not read cell-site or location columns. It gives the counts, the dates, the grid, the gaps and the common numbers, and the CSV of the ranked contacts to take into whatever the work is done in next. What the pattern means is the analyst's, and the page does not pretend otherwise.

That it runs in the browser is not a convenience here. A record set under a production order is somebody's private life, and the software that does this work is ordinarily sold by the seat and hosted, which is exactly the wrong shape for that material. Reading it without it going anywhere is the only acceptable arrangement, and it is the reason the tool exists.