Correlating CDR with other data sources

Currently, the world of digital forensics analysis is dividing into multiple branches, with each branch needing its own specific set of skills and competences. A growing number of best practices for analysing the different media are reported in many publications, such as the Scientific Working Group on Digital Evidence website [1]. The forensics analysis of a video, for example, shares nothing in common (except scientific procedure) with the examination of a mobile content extraction. This ongoing fragmentation of the digital forensics specialisations impacts on the ability to acquire a comprehensive global overview of the entire investigation. The range of data is vast, and thus, selecting the right insight is vital, for example, using a known procedure or tested tool to conduct the investigation, as described in the Computer Forensic Tool Testing Program (CFTT NIST) documentation [2]. CDR (Call Detail Record) analysis is a great source of information, but is sometimes overlooked; the volume of the data seems overwhelming and the lack of a standard model could be discouraging. Combining this massive amount of useful data with other data sources, such as GPS positions, BTS log files, mobile extractions, highway and traffic logs, will provide the investigator with a complete picture of the events. CDR analysis can be the keystone of the digital forensics world, pulling all the elements together to effectively counteract anti-forensics.