TraceLens Investigator Manual

Call Directionality & Initiation Balance Class A

Who drives each relationship (IN/OUT/SMO/SMT mix)

Answers “who chases whom”. An Outbound Ratio near 1.0 means your subject initiates the relationship; near 0.0 means the other party does. Useful against the “I only ever received his calls” defence — and for spotting a handler who always calls in.

Call-Duration & Relationship Strength Class A

Engagement by talk-time; outlier long calls

Ranks relationships by time actually spent talking rather than call count — a weekly two-hour call outranks daily ten-second calls. The Max column finds the one unusually long call worth focusing on.

SMS Sender-ID Classification / Digital Footprint Class A

Banks, UPI, wallets, government services used

Builds a picture of the subject's life from automated SMS: which banks they hold accounts with, which wallets and services message them, each categorised (banking, payments, commerce, government…). A fast route to deciding where to send the next production order.

B-Party Operator Attribution Class C

Which operator and circle each contact belongs to (LRN-resolved where disclosed; allocation otherwise)

Tells you which telecom operator to serve next, per contact, and roughly which region issued the number. India has full number portability, so the prefix names who issued a number rather than who serves it — the routing number in the disclosure is what names the current operator, and the operators disclose what their own routing numbers mean. TraceLens reads that straight out of the evidence, so no reference table has to be bought for this to work.

Caveat. Read the Source column, which says where each answer came from. “LRN disclosed in this case” is the operator's own statement and is correct after porting; “…in another case in this workspace” is the same statement borrowed from a sister case; “allocated-prefix (pre-porting)” is the original allocation only, and the number may have moved operator since.

Flash / Unanswered Call Patterns Class B

Which relationships run on near-zero-duration calls — one ring, then hang up?

One ring, then hang up. A flash call carries no conversation, so it is a signal rather than a chat — “I am here”, “it is done”, “call me back on the other phone”. This finds the relationships built almost entirely out of them, which a report ranked by talk time will never surface because there is no talk time to rank.

International (ISD) Calls & SMS Class A

Contact with foreign numbers — which country, how much

Isolates every non-Indian counterparty with country and carrier — first stop on trafficking, terror-finance and cross-border fraud cases. If it says no foreign contact was found, that is itself a documented answer.

Relationship Channel: Voice-only, SMS-only or Mixed Class A

Which relationships never use voice, which never use SMS, and which use both?

Some relationships only ever text and some only ever call, and the difference is often deliberate. A contact that is voice-only across hundreds of events leaves no readable content behind; one that is SMS-only may be a service rather than a person. This separates the three kinds so you can see which is which.

Response Latency & Reciprocity Class B

How quickly does each contact answer the subject, and how quickly does the subject answer them?

Refines Top Associates / Contact Frequency — read that first.

How fast each side answers the other. A contact who calls back within seconds every time is in a different relationship from one who takes a day, and the asymmetry is the point: the Reads As column says whether they answer faster, the subject answers faster, or neither. Reading it next to the directionality report separates who initiates from who actually responds — a handler often does one and not the other.

Caveat. A reply is the first contact in the opposite direction inside the window, and one reply closes one approach. A burst of five calls answered by one call back is one reply, not five.

Call Bearer & Interconnect Profile Class B

Was each call carried over VoLTE, a 2G/3G switch or a media gateway, and which network did it cross?

How each call was actually carried — a modern VoLTE call, an older 2G/3G switch, or a media gateway — and which network it crossed on the way. Reads the operator's own call-type and trunk-group codes, which are printed in the report's parameters so the decoding can be checked.

Caveat. The route describes the carriage, not the parties. A gateway in the path is ordinary interconnection, not evidence of anything by itself.

Per-Contact Call-Duration Outliers Class B

Which single calls break sharply from that relationship's own normal length?

Refines Call-Duration & Relationship Strength — read that first.

Narrows the duration profile to the individual calls that break sharply from that relationship's own normal length — the two-hour call inside a pattern of ninety-second ones. Each relationship is judged against itself, so a habitually long-talking contact does not flood the report.

SMS Origin: Header Decode & SMSC Route Class B

Through which operator, circle and message category did each automated SMS arrive, and which SMS centre delivered it?

Refines SMS Sender-ID Classification / Digital Footprint — read that first.

Decodes the six-character sender header on each automated message into the operator, the circle and the message category that registered it, and names the SMS centre that delivered it. Where the sender-ID footprint tells you which bank messages the subject, this tells you the route the message travelled.

Caveat. The header registry is a reference table, not a disclosure; the decoding and its source date are printed on the report.

Call-Forwarding Register Class A

Which calls were diverted, and to which number?

Which calls were diverted, and to where. A forwarding register turns “he never spoke to that number” into a checkable claim, and finds the second handset a subject routes their calls to.

Home / Work / Night-Anchor Inference Class A

Where the phone sleeps vs works vs billing address

Infers where the subject actually lives (HOME = the cell with the most midnight-to-6 a.m. activity) and works (WORK = most 9-to-6 activity) — which frequently differs from the billing address. Directly useful for surveillance and search-warrant planning.

Caveat. This names a serving cell, not an address — cell coverage can span hundreds of metres to kilometres. Treat as an area, and corroborate.

Movement / Travel-Path Reconstruction Class A

Daily tracks, speed checks, impossible-jump flags

Where the phone travelled, hop by hop, with the distance and implied speed between consecutive towers. Feeds the movement playback on the map tab.

Caveat. Impossible Jump = YES when the implied speed exceeds 900 km/h, or two different towers over 1 km apart carry the same timestamp. It means look here: a data error, a cloned SIM / SIM-box, or two handsets — the flag itself proves nothing on its own.

Location Cross-Validation & Gap-Filling Class A

Two independent record types corroborate placement

Uses two independently produced record types to corroborate the same placement on the same day — evidentially much stronger than either alone — and fills days where one type is silent.

Caveat. Corroborated = YES means both record types have activity for that device that day. Read the two location columns yourself to judge whether they agree.

Movement During Calls (Handover) Class B

Which calls started on one cell and ended on another — in what direction and at what implied speed?

A call that starts on one cell and ends on another proves the phone moved while it was in use — and gives you a direction and an implied speed for that movement, timed to the second by the call itself. The strongest movement evidence a CDR contains, because the start and end are both in the operator's own record.

Roaming Network & Circle Summary Class A

Which networks/circles the target used, home vs away

When the subject was outside their home circle and on whose network — travel evidence that works even when the disclosure carries no tower coordinates.

Serving Cell & Session Location Class A

Which cell held the subscriber, when, and for how much data

Places the subject at a location using data records — invaluable when no CDR exists. Shows the cell, its disclosed address, and session counts per cell.

Caveat. An IPDR names a cell and an address but never a map coordinate. The Coordinate source column tells you whether TraceLens could borrow a coordinate from another disclosure in the workspace (“resolved from …”) or not (“not resolved” — obtaining a tower dump for those cells would place them).

Co-Location / Meeting Inference Class A

Same tower + same time window across two targets

Finds hours in which two or more of the case's targets were on the same cell — candidate meetings, at a coarse (whole-hour) resolution.

Caveat. For minute-level precision use the Rendezvous / Meeting Detector, where you set the window yourself.

Roaming, Circle & CGI Location Class A

HOME vs ROAM, serving-cell placement

Per-subscriber home-versus-roaming split — travel evidence from data records. For the actual cells, use Serving Cell & Session Location.

Serving-Cell Path (Data Sessions) Class B

How did the subscriber move between serving cells over the disclosure, from the data records alone?

The movement report's counterpart for data: the order in which the subscriber's sessions moved between serving cells across the disclosure. On a case with no CDR at all, this is the only travel narrative available.

Caveat. Data sessions are sparser and less regular than calls, so a gap in the path means “no session”, not “did not move”.

Billing Address vs Night Anchor Class C

How far is the subscriber's registered pincode from the cell the phone sleeps at?

Measures the distance between the pincode the SIM is registered to and the cell the phone actually sleeps at. A large, consistent gap is the ordinary signature of someone living away from their registered address — and occasionally of a SIM taken in someone else's name.

Caveat. Pincode centroids come from a reference table named on every row, so the distance is to the centre of a postal area, not to a doorstep.

Odd-Hour / Night-Activity Profiling Class A

Which relationships run at 00:00–05:00

The relationships that operate in the middle of the night — often the ones that matter. Night Share normalises for volume, so a contact with 8 of 10 calls at night ranks above one with 20 of 900. The night window (midnight–5 a.m. IST) matches the Dashboard's late-night card exactly, so the two can never disagree.

Session Timeline / Online Presence Class A

Was this device transmitting at a given moment?

The alibi-and-presence report: was this phone online and transmitting at 02:14 on the night in question? Optionally focus on one MSISDN. The Reports tab draws an “Online presence” band above the grid — click a subscriber to narrow to their sessions.

Silent / Phone-Off Periods Class A

The longest stretches the phone went quiet, and where it resurfaced

Finds when the phone went dark — and, the real payload, where and on what handset it came back. Device Changed = YES across a silence is the classic “swapped the SIM into a new phone while dark” tell. Set Minimum gap (hours) if the default is too short for your case.

Bursts, Silent Periods & Contact Lifecycle Class A

Spikes, gaps, new/dormant contacts by day

A day-by-day pulse of the case: activity spikes (something happened), New Contacts (a relationship forming — numbers never seen on any earlier day), and silent gaps. Read it alongside your case diary: do the spikes line up with known events?

Cross-Channel Silence Corroboration Class B

During each voice/SMS silence, was the handset also silent on data (off) or still online (SIM pulled, phone alive)?

A phone that is off is silent on voice and on data alike. A phone whose SIM has been pulled is silent on voice while the handset stays online. This report takes each voice silence and asks what the data records were doing during it — which is the difference between “switched off” and “deliberately unreachable”.

Data Silent / Idle Periods Class B

The longest stretches a subscriber generated no data session, and where and on what handset it resumed

The same question as the voice silence report, asked of the data records: the longest stretches with no session at all, and where and on which handset activity resumed. On a data-only disclosure it is the only silence analysis available.

Fan-Out / Broadcast Bursts Class B

When did the subject contact an unusually large set of different numbers in a short window?

One number contacting an unusually wide set of different numbers inside a short window — the shape of a call-round, a warning passed down a list, or a bulk fraud campaign. Ordinary days do not fan out; the days that do are worth explaining.

Weekday vs Weekend Shift Class A

How does the subject's volume, contact set and timing change between working days and weekends?

How the subject's volume, contact set and timing change between working days and weekends. A contact who only ever appears at the weekend, or a routine that does not change at all, both say something about what the phone is for.

Channel-Migration / Encrypted-Comms Inference Class A

"Stopped calling, started encrypting" shifts

Detects a suspect moving off the phone network onto internet messaging — typically right after realising they are under investigation. Read the Encryption Ratio as a trend across weeks for one device: a rising line is the signature.

Caveat. Ordinary web browsing counts toward the ratio, so the absolute value means little — only the week-over-week change does.

Contact Churn & New-Contact Velocity Class B

Per week, how many contacts are new, how many went dormant, and how fast is the circle turning over?

How fast the circle turns over: new contacts appearing and old ones going dormant, week by week. A stable life has low churn. A sharp rise is a new network forming — a new job, a new venture, or a new conspiracy.

Caveat. Churn Rate is the share of the whole circle that changed — everyone active in either week, not just this one — so it always sits between 0 and 1. Three contacts across two weeks with one arriving and one leaving is 0.67, not 1.0.

Cross-Domain Anomaly & Risk Scoring Class D

Weak signals fused into one triage ranking

When a case has 40 numbers, this tells you which three to start with, by combining night activity, suspicious sessions, multiple devices and anonymiser use into one ranking. The Contributing Signals column spells out the arithmetic on every row, so no score is unexplainable.

Caveat. A triage ordering, not a probability of guilt. Never quote a Risk Score as evidence — use it to order your work, then prove things with the underlying reports.

Service-Mix & VoWiFi-IP Analysis Class A

Voice/SMS/video/VoLTE/VoWiFi mix; broadband bridge

What kinds of communication the subject used. The VoWiFi UE-IP exposed count matters most: those calls travelled over Wi-Fi and disclose the handset's IP address — the seam the VoWiFi → Broadband Bridge report uses to reach a physical premises.

Temporal Patterns, Bursts & NAT Allocation Class A

Session-rate curves; port-allocation validation

Hourly activity curve for the data records, plus an internal-consistency check on the operator's port allocations. Mostly an analyst's tool.

Device Intelligence (TAC) Class C

Which handsets (make/model) the target used, per IMEI

Turns bare IMEIs into “POCO X3” / “iPhone 13” — so you know what to look for on a search and what to expect from a seizure. The operators usually disclose the handset themselves, beside the IMEI, and TraceLens reads that: no licensed reference table has to be bought for this to work. The Source column says whether the name came from this case's disclosure, from another case in your workspace, or from a loaded reference table.

Caveat. A blank make and model means nobody named this handset — the disclosure did not carry it and no reference table covers it. It does not mean “unknown handset”: a fuller disclosure from the operator would fill it in.

Device-Centric Identity Correlation Class A

Bind voice and data identities across number changes

Follows the handset, not the number. A suspect who changes SIMs to evade attention is still carrying the same phone — this report links their old and new numbers through the shared IMEI. The VOICE+DATA-CORRELATED flag confirms the same handset appears in both record types.

IMEI–IMSI Binding / SIM-Swap Detection Class A

Cloning, SIM-box, multi-SIM patterns

Every observed device↔SIM pairing. Two flags do the work: MULTI-SIM-ON-DEVICE (one handset carried several SIMs) and SIM-ACROSS-DEVICES (one SIM moved between handsets) — the signatures of SIM-boxes, cloning and passed-around phones.

Device & SIM Fingerprinting Integrity Class A

MSISDN↔IMEI↔IMSI binding violations

The IPDR-side SIM-swap detector: Binding Anomaly = YES when one number appears on multiple handsets or multiple SIMs within the data records. Cross-check with the CDR binding report.

IMEI Format, TAC & Cross-Subject Audit Class C

Is each disclosed IMEI complete, operator-masked, an IMEISV or a truncation — and was its TAC ever allocated?

Not every IMEI in a disclosure is a real IMEI. Operators mask them, truncate them, and sometimes send a software version number instead. This audits every disclosed device identity for shape and checksum, says which kind each one is, and flags a TAC that was never allocated to any handset — which usually means a tampered device.

Caveat. A malformed identity is most often an operator formatting artefact. Treat it as a question for the operator before treating it as a finding about the subject.

One SIM, Two Handsets at Once Class B

Which subscribers have data sessions on two different handsets that overlap in time?

Refines Device & SIM Fingerprinting Integrity — read that first.

One SIM cannot be attached to two radios at the same instant. The binding-integrity report above finds a number that appears on several handsets across a disclosure, which is ordinary if the subject changed phone; this finds sessions that actually overlap in time, which is not ordinary at all. It is the signature of a cloned SIM, a SIM-box, or an operator record that needs explaining.

Caveat. Brief overlaps are usually a handover between cells being recorded on both sides, which is why the threshold is a parameter and every row says whether the overlap was sustained or brief. Take the sustained ones to the operator before taking them anywhere else.

Radio Access & APN Profile Class A

On which radio generation and access point did each device sit, and did either change?

Which radio generation each device sat on and which access point it used. A handset that suddenly drops from 5G to 2G, or moves to an unusual access point, has had something change about it — a different device, a different place, or a deliberate setting.

Device Handoff / Identity Migration (lead) Class D

After a number goes quiet, does a new handset appear on data with a similar destination profile — the same person on a new device?

A lead, not a finding. When a number goes quiet, this looks for a handset appearing on the data records soon afterwards with a similar destination profile — the shape of the same person continuing on a new phone. It gives you somewhere to look.

Caveat. An investigative lead (class D). Similar browsing is not identity; confirm through the device and binding reports before acting on it.

Application / Protocol Classification Class A

Port → HTTPS, DNS, XMPP, BitTorrent, NTP…

Translates raw port numbers into readable protocols so you can see at a glance what the traffic was — web, messaging, file-sharing, remote access. Suspicious = YES marks the categories worth a second look.

Caveat. A port is a strong hint about the application, not proof of it.

Destination ASN / Org Attribution Class C

Raw IPs → OpenDNS, Google, Zscaler, hosting labels

Turns a wall of meaningless IP addresses into named organisations, so you can see which destinations are ordinary services and which deserve a production order. Every label names its source in the Attribution Source column.

Per-Subscriber Activity / Top Talkers Class A

Session counts, destination diversity, outliers

Triage for a multi-subscriber disclosure: who is heaviest, and who reaches an unusually diverse set of servers. “Port-0” sessions (records with no meaningful port) are counted separately as a data-quality signal.

Reverse Destination Lookup Class C

Everyone who contacted server X in a window

The inverse question: given a known-bad server (phishing host, command server), which subscribers in this case reached it, how often, and when? Enter the Destination IP or leave blank to see every destination ranked.

Bulk IP Lookup Class C

Attribute a pasted list of IPs, and show this case's contact with each

A tool in report form. Another agency or a victim platform hands you a list of IPs: paste them into the IP addresses box (commas, spaces or new lines all work), click Apply, and each IP comes back attributed and cross-referenced against this case's own sessions. Leave the box empty to attribute every destination in the case.

Caveat. Results return in a fixed sorted order, not the order pasted — deliberately, so the same list always produces an identical export and certificate hash.

Data Volume by Destination Class A

Which destinations moved the most data — candidate exfil, backup or streaming endpoints

Servers ranked by bytes moved — where to look for data exfiltration or cloud backup of illicit material. Only appears when the disclosure actually carries volume figures; on a CGNAT-only case it stays hidden rather than showing misleading zeros.

Destination Geolocation / Foreign Comms Class C

Domestic CDN vs genuinely foreign endpoints

Refines Destination ASN / Org Attribution — read that first.

Separates genuinely overseas servers from foreign-owned servers physically located in India — a distinction that decides whether an MLAT request is worth the wait.

Caveat. The column is deliberately called Foreign Candidate: it is a coarse offline hint, not a geolocation fix.

Public IP & Port Ledger per Subscriber Class A

Which public IPs and port ranges did this subscriber hold, hour by hour — the reverse of CGNAT resolution

The CGNAT resolution read the other way round: for one subscriber, every public address and port range they held, hour by hour. This is what you attach when a platform asks you to prove the subscriber held the address at the time, rather than asking you who held it.

Suspicious-Protocol / Anomalous-Port Detection Class A

P2P, encrypted chat, proxies, port 0

Refines Application / Protocol Classification — read that first.

The filtered view of the protocol classification — only the categories worth attention, each with a sample subscriber to start from.

Caveat. Using a VPN or file-sharing is lawful; this is a lead, not an offence.

Threat-Intelligence Cross-Check Class C

Which data sessions reached addresses on a loaded known-bad list — botnet command servers, hijacked netblocks, abuse-reported hosts?

Cross-checks the case's destinations against a threat-intelligence list loaded into this deployment: botnet command servers, hijacked netblocks, abuse-reported hosts. A hit tells you the subject's phone reached infrastructure someone else has already documented as hostile.

Caveat. Exact with respect to the loaded list and its date, both printed on every row. An address can be cleaned up, or reused by an innocent service, after a list is published.

VPN / Tor / Anonymiser Detection Class C

Per-subscriber anonymizer-likelihood score

Ranks subscribers by how much of their traffic looks like deliberate track-covering — Tor exits, VPN ranges, VPN ports, peer-to-peer.

Caveat. The Anonymizer Score is a weighted ratio for ranking, not a probability. Use it to decide who to look at first, never as a figure to quote.

VoIP & Real-Time Communication Analysis Class C

Which calling/conferencing platforms a subscriber's data sessions reach

Finds calls made over the internet (WhatsApp, Telegram, Signal, Zoom…) — the calls that never appear in a CDR. Answers “he stopped calling — what is he using instead?”

Caveat. Read the Confidence column on every row: attributed (the platform's own range), candidate (a shared cloud range — one of several possible platforms), or port-only (“real-time media to a server we cannot name” — the weakest claim in the catalogue).

"Call-then-Connect" Correlation Class A

Does a call reliably precede a session to server X?

Detects a behavioural signature: a phone call, then within moments a data session to a particular server — consistent with “receive instruction by phone, then act online”.

Common-Destination Co-occurrence Clusters Class C

Subscribers sharing uncommon servers = candidate groups

Refines Reverse Destination Lookup — read that first.

Everyone reaches Google; only a group reaches one particular obscure server. This narrows the destination lookup to subscribers who independently reach the same uncommon destination — candidate associations. The Max subscribers per server ceiling is what filters out the popular services.

Caveat. Sharing a server is not proof of association — it may just be a niche app both happen to use. Corroborate.

DNS & NTP Behaviour Profiling Class C

Hardcoded resolvers, DoT, DNS-tunnelling volume

A phone deliberately configured to bypass the carrier's own directory service (DNS) — or moving suspicious volumes over it — is a technical tell of a sophisticated user. Ask your analyst to interpret unusual rows here.

Dark-Web / Tor Infrastructure Exposure Class C

Contact with Tor exits, guards and directory authorities

Identifies contact with the Tor anonymity network's infrastructure, with the role of each address (exit, guard, directory).

Caveat. Every row carries this printed caveat, and it belongs in your report too: “Tor use is lawful; treat as a lead requiring corroboration, not as an offence.”

High-Duration / Bulk-Transfer Outliers Class A

Long sessions: streaming, exfil, tunnels

Unusually long sessions — the shape of a big file transfer, a persistent tunnel, or hours of video. Adjust Minimum duration (s) if the default is not right for your case.

IPv6 Sessions (Port-free Identity) Class A

Which sessions carried a public IPv6 address, and which /64 prefix did the subscriber hold when?

IPv6 needs no port to identify a subscriber, because the address is not shared — which makes an IPv6 session a far stronger identification than an IPv4 one. This lists them, and the address prefix each subscriber held and when.

Upload / Download Ratio Profile Class A

Which subscriber-destination pairs moved more data up than down — the shape of exfiltration or file sharing?

Refines Data Volume by Destination — read that first.

Narrows the volume report to the pairs that moved more data up than down. Ordinary use downloads; sustained uploading to one destination is the shape of exfiltration, backup, or sharing a library of files.

VoWiFi → Broadband Bridge Class C

A call carried over Wi-Fi exposes the handset's IP: which network was it, and does this case's own data hold the same address?

A powerful chain: a call made over Wi-Fi exposes the handset's IP in the CDR. This report names the network that address belongs to and then looks for the same address in the case's own data records — mobile suspect → fixed line → premises. Rows with blank match columns are attempts with no bridge found, shown so you can see the misses as well as the hits.

Caveat. Network attribution comes from a reference snapshot named on each row. A match inside the case is a fact about the disclosure; the network label is exact only with respect to that snapshot.

OSINT Entity Graph (subscriber ↔ infrastructure) Class C

Typed edges linking subscribers to IPs, organisations and platforms

The whole case as a labelled network — who connected to what, what is hosted where, which platform each IP belongs to, which device each number used. Powers the on-screen entity graph and exports to link-analysis tools. Every connection carries a Basis column saying where it came from, so no line in the chart is unexplainable.

Numbers Across Crime References Class A

Which numbers appear in dumps requisitioned under different FIRs?

Where the recurring-numbers report works across cells, this works across cases: numbers appearing in dumps requisitioned under different FIRs. A number present at two unrelated offences is either a coincidence worth excluding or the connection the file has been missing.

Caveat. Only dumps whose consolidated file carries the requisitioning crime reference can be grouped this way.

Subscriber Activity Profile Class A

Per-number summary: sightings, cells, devices, voice/SMS, window

One row per number in the dump — the summary you scan before deciding which numbers to pursue for full CDRs.

Tower Presence / Cell Occupancy Class A

Which subscribers a cell saw, how often, and over what window

The base triage grid: per cell, per number — how many sightings, over what window, on how many handsets.

Continuous Presence (Dwell) at a Cell Class B

For how long, without a break, was each number under a given cell?

A number seen once at a cell was passing. A number seen continuously for forty minutes was there. This measures unbroken presence per number per cell, which is what separates the crowd on the road from the people at the scene.

Caveat. A run breaks when the gap between sightings exceeds the stated threshold, so dwell is a careful lower bound — never an overstatement.

Device / SIM Anomalies (IMEI ↔ number) Class A

Handsets carrying more than one SIM — SIM-swap, SIM-box, shared-device signals

A handset in the dump that carried more than one number — dual-SIM in criminal use, a passed burner, or a SIM-box — with the actual numbers attached.

Sector (Azimuth) Presence Class A

Which antenna sector of each tower saw the crowd, how many numbers, and over what window?

A tower is not a point: it is two or three antennas facing different directions. Knowing which sector saw the crowd narrows the area from the whole cell to the arc the antenna covers — often the difference between “near the market” and “in the lane behind it”.

Caveat. A sector is still an arc of coverage, not a position.

Activity Over Time (hourly) Class A

Sighting volume per hour across the dump's window — spot spikes and quiet hours

The crowd curve. Find the spike at the time of the offence, then filter the other dump reports to that hour.

Contact Frequency (B-party) Class A

Which numbers the subscribers near the tower called or texted most

Who the crowd at the tower was talking to. The key column is Distinct A-parties: a number called by many different people near the scene is a candidate coordinator or handler.

Dump Completeness by Operator Class A

For each cell, which operators' dumps arrived, over what window, and with how many silent hours inside it?

The dump you did not receive is the one the defence will ask about. For each cell this shows which operators' dumps arrived, over what window, and how many hours inside that window are silent — so a gap in coverage is something you found and can explain, not something you were shown.

Group Financial Timeline Class C

Every subject's bank and wallet alerts on one axis, with bursts where several subjects transact within minutes

Every subject's bank and wallet alerts on one axis, with the bursts marked where several subjects transact within minutes of each other — the signature of money being moved through a group on instruction.

Where the Phone Was When the Money Moved Class B

For each bank or wallet alert, which cell was serving the subject at that moment?

Refines Contact Around Bank & Payment Alerts — read that first.

The other half of the question the report above asks. That one finds who the subject was speaking to around each bank alert; this one finds where the handset was. A withdrawal in one city while the phone sat on a tower in another is either a card in somebody else's hands or a subject who was not there — and both are worth knowing before the statement is taken. Uses whichever record kind places the phone closest in time, and says which one it used.

Caveat. It places a handset near a serving cell, not a person at a counter. Every row states how close in time the placing record was, because a record two minutes from the alert and one twenty-five minutes away are not the same evidence.

Virtual-Asset (Crypto) Destination Exposure Class C

Sessions reaching known virtual-asset service provider ranges

Flags contact with cryptocurrency-exchange infrastructure — the starting point for a production order on the exchange in fraud and laundering cases.

Caveat. Most exchange front-ends sit behind shared cloud ranges, so expect the row's own caveat: “Shared cloud/CDN range — corroborate with the exchange before relying on this.”

Network / Link-Chart Export Class A

Weighted A↔B edge list; i2 / Gephi export

The case's contact network as an edge list ready to import into i2 Analyst's Notebook or Gephi for the chargesheet link chart. For an on-screen version, use the entity graph on the Map & graph tab.

Relay / Instruction Chains Class A

A call into a suspect followed by an outgoing call within minutes — the message-relay spine (A→B→C→D)

Traces how an instruction propagates: A calls B, B promptly calls C, C promptly calls D. Exposes command structure and who sits at the top. Tune the relay window and the maximum number of hops.

Caveat. A chain can only pass through numbers that are themselves case targets — the disclosure contains no one else's outgoing calls. Missing middle-men mean missing links, not innocence.

Rendezvous / Meeting Detector Class A

Which suspect pairs were at the same tower within minutes of each other, and when

The tight-window meeting detector. Set the Meeting window (min) and it lists every pair of suspects served by the same cell within that many minutes, with first and last meeting times and the tower address.

Caveat. Same cell means “within the same coverage area”, not “in the same room”. A candidate meeting — corroborate with CCTV, human intelligence or further records.

Shared Anchor Towers Class A

Which towers are a frequent base for two or more suspects — candidate shared premises

Not “they passed each other once” but “this tower is a regular base for several of them” — a candidate safe house, office or gathering place. Only towers in each suspect's top few count as an anchor.

Shared Device / SIM Ring Class A

Which handset (IMEI) or SIM (IMSI) is used by more than one suspect — a shared or passed device

A handset or SIM used by several suspects: a passed burner, a shared “office phone”, or one person operating under multiple numbers. The Type column says whether each row is an IMEI or an IMSI.

Contact Communities (Graph Clustering) Class D

Which tightly-connected groups does the contact network fall into, and who bridges them?

Splits the contact network into its tightly-connected groups and names the numbers that bridge between them. On a large case it turns one unreadable web into a handful of sub-networks you can work separately.

Caveat. An investigative lead (class D). The grouping is an inference from call patterns; who belongs to what is proved by the underlying contact reports, not by this one.

Chain of Custody — Evidence Files Class A

Who has handled each evidence file since it arrived, and when?

Courts ask about custody as often as they ask about authority. The Activity view already shows the case's audit trail; this puts it in the form the question is actually asked — per exhibit, who has handled it since it arrived, when, from what address, and whether they succeeded. Arrival is read from the file's own record rather than the trail, so it exists even for a file older than the logging. Exports are listed too: an export is the moment evidence leaves the platform. Each export also says whether it still reproduces. A certificate promises that re-running a report on the same evidence gives the same result hash, and that promise breaks in exactly one way: the evidence changes underneath an exhibit already filed. When a disclosure in the case has been parsed again since an export was taken, the row says so — withdraw that exhibit and re-run it.

Cross-Case Entity Overlap Class A

Which numbers, handsets, SIMs or cells in this case also appear in other cases this officer can see?

Which numbers, handsets, SIMs or cells in this case also appear in other cases you are allowed to see — the connection that would otherwise depend on somebody remembering it. Scoped to your own visibility: a case you cannot open contributes nothing.