Digging into Verizon RTT Cell Phone Location Data

Nearly every new case I get there is new data provided by the wireless network operators. They are constantly adding or changing the information they provide under a search warrant or subpoena.

In this case I received an RTT data file from Verizon that has quite a bit of information on it. Of course, they only provide an explanation on a small subset of the data so we are left to figure out the rest. Luckily, I have many years of experience collecting wireless data from my testing that I am able to piece together much of the information they provide and make logical sense out of it.

Strangely enough I was not provided the CDR files. Typically Verizon only keeps the RTT files for 7 days but does keep the CDR's for at least one year. No matter, in this case the RTT file incorporates phone call logs that are also in the CDR.

The typical information the prosecution uses from this file is the Cell ID, antenna azimuth, distance from cell tower and latitude/longitude estimate of the phone location.

But the file contains 313 parameters and Verizon only provides explanations for 20 of them. Granted, many of the parameters have blank values and others don't seem useful but there are some that might be important depending on the specifics of the case.

Some interesting information provided is the cell site eNodeB, it's PCI, RSRP, RSRQ for the serving cell as well as up to 3 additional cells at the start of the measurement and at the end of the measurement. When I say cells this could mean a different sector on the same tower or a sector on a different tower. The following is a set of records that show measurements from 2 cell ID's. The primary cell is the serving cell. Some of the records show an RSRP of cell #1 stronger than the serving cell. This could be important in a legal case where phone location is critical.

The eNodeB indicates the tower ID and the PCI indicates the sector. The RSRP is a measurement of the signal strength and the RSRQ is a measurement of the receive channel quality. Note that you could have a strong signal but poor quality typically due to interference.

We can also identify phone calls by looking at the VoLTE parameter. The following table is taken from the RTT file and shows a single phone call shown in green, starting at the bottom record at time 5:44:43pm and ending at the top green record at 5:57:18pm.

The "Yes" in the column "VoLTE Category" in the record at the bottom indicates the start of the call. The "Good" at the top indicated the end of the call. Note that Verizon estimates the distance the phone is from the cell antenna at the beginning and ending of each measurement period during the call. It also provide the cell site information.

With Verizon's cell database we can cross reference the ID information to determine the location of the cell tower. The azimuth gives us the antenna direction so we can plot the location of the tower and the direction of the sector antenna serrving the phone.

Additional information is provided but not shown here for privacy reasons which includes the phone numbers for the parties on the call.

We can also determine from the data if a call was missed or rejected. The records in orange shown below are calls that were not connected. One was termintated by the network and the other was terminated by the user. I blanked out the phone numbers under the columns labeled "SIP Called Digits" and "SIP Calling Digits" for privacy reasons. These numbers would tell us the direction of the call.

Another piece of data that is available is the data throughput. The table below is an excerpt from the file showing the DL (downlink) and UL (Uplink) data rates in Megabits per second (Mbps).

These are instantaneous measurements for the short time period of the measurement but by looking at multiple consecutive measurement we can get an understanding of how much data is going to and from the network which may help in determining user interaction such as in accident cases.

There are many more parameters to analyze that I will have to get to at a later time. Thanks for taking time to read. Please send me an email if you have any questions or comments.