Readiness note. This is a private training programme. It builds knowledge and readiness. It does not grant any official certificate, licence, or government recognition, and it does not create any affiliation with a regulator or an agency. On passing, learners receive a Record of Completion.
Mission briefing
Much electronic evidence comes from telecommunications networks. To work with it, you first need the basic vocabulary: how networks are built, how a call travels, and what a cell tower does. This lesson gives you that foundation.
Focus: learn the core telecom concepts and terms so later lessons on call records and interception make sense.
Learning objectives
By the end of this lesson, you will be able to:
- Define the main network types and key terms, such as PSTN, VoIP, SIM, and IMSI.
- Explain, in simple steps, how a voice call is set up and ended.
- Describe what cell towers and base stations do, and what a handoff is.
- Explain why metadata, encryption, and data retention matter in a case.
Why this matters to you. Officers need these terms to read telecom records. Lawyers need them to question what a record can prove. Students and company teams need the vocabulary used in later lessons.
1. Core concepts and terms
A few terms appear again and again in telecom investigations:
- PSTN (Public Switched Telephone Network). The traditional landline network, using circuit-switched connections.
- Cellular networks. Mobile networks such as GSM, CDMA, and LTE that connect devices wirelessly.
- VoIP (Voice over IP). Voice carried over the internet as data packets, instead of a dedicated circuit.
- SIM (Subscriber Identity Module). The card that identifies a subscriber on a mobile network.
- IMSI (International Mobile Subscriber Identity). A unique number that identifies the subscription (the subscriber's account with the operator). The SIM card has its own number, the ICCID (unit 8A, Subscriber Identity: SIM, eSIM, IMEI and Number Portability).
- CDR (Call Detail Record). A log of a call: numbers, time, duration, and the cell tower used.
- IPDR (Internet Protocol Data Record). A log of an internet session: IP addresses, ports, and data usage.
These records and identifiers are the raw material of most communication-data investigations.
2. The evolution: 1G to 5G
Mobile networks have improved in stages, called "generations":
- 1G carried analogue voice only (1980s).
- 2G brought digital voice and SMS text (1990s).
- 3G added mobile internet and video calling (2000s).
- 4G gave much faster data for streaming and apps (2010s).
- 5G adds very fast speeds, low delay, and support for many connected devices.
On 4G and 5G networks, voice calls travel as data. The operator still makes a record of each call. A call made inside an internet app is different: the operator records only a data session, not who was called.
Each generation improved speed, capacity, and latency (the delay in sending data). Knowing which generation a network uses helps an investigator understand what data it can produce.
3. How a call flows
A voice call moves through clear stages. In simple terms:
- Setup. The caller dials. The network checks identity and authority to connect.
- Locating the callee. The network finds the callee, for example by paging nearby cell towers.
- Establishment. A connection is formed and the callee's device rings.
- Conversation. Once answered, voice is carried across the network and the connection is maintained.
- Termination. When either party hangs up, the network releases the connection.
- Post-call. The call details are logged for billing, creating a record.
Modern networks add extra parts for VoIP and advanced services, but the basic flow is the same.
4. Cell towers and base stations
Mobile networks divide an area into cells. Each cell is served by a cell tower and its base station (the equipment that sends and receives signals).
Key ideas:
- Coverage area. Each tower covers a set area. Dense areas use smaller cells; open areas use larger ones.
- Base station equipment. This includes transceivers, amplifiers, and processors that handle the signal.
- Handoff. As a user moves, the network switches the connection from one tower to the next. This switch is called a handoff.
A device connects to the cell the network selects, usually the one with the best signal. This is often, but not always, the nearest. So tower records give only a general idea of where a device was during a call or session. Unit 9A (Cell-Site Evidence: What It Can and Cannot Prove) explains the limits.
5. Why this matters in a case
Three points carry into the next lessons:
- Metadata. Information about a communication — timestamps, IP addresses, port numbers — gives context, even without the content.
- Encryption. It protects the confidentiality of communications and can make content hard to read without a key.
- Data retention. Operators keep certain records for a set period. The period differs by country. The records can be obtained only by proper legal procedure, with respect for privacy.
Activity — analyse a case
Case study: placing a phone.
A case turns on where, roughly, a suspect's phone was at a certain time.
Think about these questions:
- Which record would show the cell tower a call used, and what does that tell you about location?
- Why is a tower location only a general area, not an exact point?
- What is a handoff, and why might a single call show more than one tower?
There is no single right answer. The goal is to link the telecom basics to a real case.
Conclusion
You have completed this lesson. You now know:
- The core network types and key terms, including PSTN, VoIP, SIM, IMSI, CDR, and IPDR.
- How a call flows and how networks evolved from 1G to 5G.
- What cell towers and handoffs are, and why metadata, encryption, and data retention matter.
The next lesson goes deeper into Cell IDs, international roaming, and Call Detail Records.
Complete the Learning Check for this lesson before you move on.